What do you do if someone says, there might be a zero day being used against your make/model of internet facing device (such as a VPN server)?
There’s always a challenge subject to the level of intelligence available about the specific scenario, the device and the way they function and the telemetry/capabilities you have.
Read more “Suspected Zero Day – What to do if you have a device that may be in scope for exploitation?”
This weekend I was running a workshop with my awesome friend James, where we were discussing the realities of wireless network security, man in the middle attacks and what we have found in the field, both from an offensive perspective and as corporate network defenders. As with all things in life, sometime reality doesn’t work quite as well as a demo! So I’ve done a quick thread on twitter showing the kill chain an adversary can deploy when attacking WPA2 PSK (without PMF enforced) networks. This is written as a twitter thread so bear with the style!
Read more “Breaching WPA2 PSK Wireless Networks”
In my travels I have found it matters more how you do IT securely than how you ‘do security’. What I mean by this is, the prevailing themes of orgs recently is to bolt on SOCs/MDR and other services to a low maturity/low capability IT organisations with the hope that its magic’s all the security problems away. This sounds lovely, the salespeople will almost certainly productise your security improvement journey and make it sound like a dream.
Read more “Bolting on security does not work”
I’m back with my AI enabled self! This evening I’m jumping into some interesting things about WIFI probes! Now back in the day you could deploy a pineapple etc. can you would hear phones calling out all the time for SSIDs to connect to, you could fingerprint phones (and infer people) from them!
But that’s not really the case anymore! If we camp with a pineapple or other setup, it’s not really the same anymore! (unless someone has a hidden SSID… they are terrible for PERSEC/OPSEC!!)
Want to know why? Well it’s down to how phones are programmed to poll (probe) for SSIDs… I’ve tested this in a car park miles away with a range of kit! (not dodgy at all right!)
To help me answer this I turned to my currently favourite LLM: GROK
Read more “Wifi, Iphones and Persec/Opsec”
Ok this morning I woke up really really early! I then went on a bit of a KQL thread on twitter, and then IRL work destroyed my plans to play in the lab. However I’m publishing this in its current state [use at own risk etc.] because I think it might help people! So let’s get to it:
These queries can help you identify 3 common active directory attack techniques from logs on a domain controller (this does not rely on ADCS logs etc.)
Read more “Hunting for common Active Directory Domain Services Exploitations”
There are so many lists of “tools” of “free resources” for “cyber” etc. Well I don’t want to make a list of stuff for social media, this isn’t the TOP x tools, this is simply some resources that I use on a regular basis that should give people a fairly good idea of where to start looking. Cyber sleuthing is a mixture of:
I was doing some WordPress foo on the site (I know right, shockingly I don’t want to hand craft a website and I’d rather be helping customers or really anything else really) and I came into this error when I was installing the wpforms plugins:
file_put_contents(/var/www/wordpress/wp-content/uploads/wpforms/cache/addons.json): failed to open stream: Permission denied in /var/www/wordpress/wp-content/plugins/wpforms-lite/src/Helpers/CacheBase.php on line 215Did you ever read about ransomware actors? They often use mega upload to exfiltrate data! So I figured, why would we not detect this with MDE?
I mean sure we should probably block this with a custom indicator using Web Content Filtering and sure it would probably get blocked by Protective DNS but let’s say for whatever reason you don’t have those in place, let’s look at a really simple query to find mega connections in MDE:
Read more “Ransomware + Mega = Mega Cyber Pain”
If you are having fun today with Defender ASR deleting lnk files then you will see the MS Script has a v1.1 which looks to VSS to see if it can restore shortcuts from shadow copies, so whilst here I thought I’d note down a few different ways to list the Volume Shadow Copies.
You will need admin rights for these to work:
Read more “Volume Shadow Copy”
Clearly this is for penetration testing, not for evil! So if you have to pentest Office 365 you might want to be attacking the authentication services. This will be aligned to the tenant you are testing, as always make sure you have authorisation.
Deploy to your favourite LINUX instance or WSL etc.
Read more “Password Spraying Office 365”