Skip to content
PwnDefend
  • Base
  • Comms Room
    • Customer Feedback
    • Company Information
    • Security Management
  • Services
    • Consulting Services
      • Enterprise Security Posture Assessment
      • Cyber Security Assurance & Security Testing Services
      • IT Security Healthchecks
      • Active Directory Assessment Services
      • Managed Remediation Services
    • Emergency Cyber Incident Response Support
    • Our Success Stories
    • Partner Services
  • Blog
  • Privacy

Cyber Threat Intelligence Resources

There are so many lists of “tools” of “free resources” for “cyber” etc. Well I don’t want to make a list of stuff for social media, this isn’t the TOP x tools, this is simply some resources that I use on a regular basis that should give people a fairly good idea of where to start looking. Cyber sleuthing is a mixture of:

  • HUMINT
  • OSINT
  • CSINT
  • RUMINT
  • SIGINT
  • SOCMINT
Read more “Cyber Threat Intelligence Resources” →

failed to open stream: Permission denied in /var/www/wordpress

I was doing some WordPress foo on the site (I know right, shockingly I don’t want to hand craft a website and I’d rather be helping customers or really anything else really) and I came into this error when I was installing the wpforms plugins:

 file_put_contents(/var/www/wordpress/wp-content/uploads/wpforms/cache/addons.json): failed to open stream: Permission denied in /var/www/wordpress/wp-content/plugins/wpforms-lite/src/Helpers/CacheBase.php on line 215
Read more “failed to open stream: Permission denied in /var/www/wordpress” →

Ransomware + Mega = Mega Cyber Pain

Did you ever read about ransomware actors? They often use mega upload to exfiltrate data! So I figured, why would we not detect this with MDE?

I mean sure we should probably block this with a custom indicator using Web Content Filtering and sure it would probably get blocked by Protective DNS but let’s say for whatever reason you don’t have those in place, let’s look at a really simple query to find mega connections in MDE:

Read more “Ransomware + Mega = Mega Cyber Pain” →

Volume Shadow Copy

If you are having fun today with Defender ASR deleting lnk files then you will see the MS Script has a v1.1 which looks to VSS to see if it can restore shortcuts from shadow copies, so whilst here I thought I’d note down a few different ways to list the Volume Shadow Copies.

You will need admin rights for these to work:

Read more “Volume Shadow Copy” →

Password Spraying Office 365

Clearly this is for penetration testing, not for evil! So if you have to pentest Office 365 you might want to be attacking the authentication services. This will be aligned to the tenant you are testing, as always make sure you have authorisation.

Deploy to your favourite LINUX instance or WSL etc.

Read more “Password Spraying Office 365” →

Practical Security Assurance

Penetration testing, adversary simulation, red teaming, purple teaming, rainbow teaming, call if what you like, the security outcome we are working towards is:

  • Improved Security Posture
  • Assurance of security investments and controls
  • Enablement of information sharing
  • Collaboration and Understanding
  • Identification of strengths and weaknesses
  • Optimization and Improvement Opportunities

This is to support the organisations mission, vision, goals, and objectives. Cyber security is to support and enable the organisation’s capability to execute digital services in a safe manner.

Read more “Practical Security Assurance” →
Ubuntu Logo

Cyber Essentials for Ubuntu Servers

I thought about doing a step by step bash script or CLI walkthrough but decided to go with the high levels steps. If we wanted to ensure our Linux servers are configured in alignment with Cyber Essentials what are the main areas we need to consider? For this I’m using Ubuntu Server as a base, I’ve not gone through every line in the standard but these should be in line with the 5 areas and fit within the Cyber Essentials theme. As always there are many ways to skin a cat! (don’t skin cats they are frens!). Anyway hope this is useful.

Read more “Cyber Essentials for Ubuntu Servers” →

Phishing (Cred harvester) Response

Incident Response Playbook (High Level)

Having a plan for how you will respond to common incidents is key. It’s a good idea to have procedural level “playbooks” (we used to just call these procedures, maybe I’m old!) but let’s get taktic00l and call them:

Playbooks/Runbooks/Aide-mémoire etc.

That aside (words are fun right!) they key part here is to identify the people, roles and responsibilities and the systems/actions/decisions you will need to take. To start with let’s look at a common incident of Phishing with credential harvesting, this may lead onto business email compromise (BEC) and attempted or successful fraud or downstream supply chain attacks.

Read more “Phishing (Cred harvester) Response” →

Service Security Architecture and Assurance

Have you every tried to understand the risk level of a service? Ever wanted to provide assurance to someone that “it’s been well designed, is secure from common threats, likely risk scenarios and is securely operated” etc.? have you ever tried to conduct testing against a service that is relatively unknown? Ever needed to actually do more than throw some packets at the front door? Guess what, I have. Most orgs don’t have a decent level of documentation on service architecture and security controls. And as the NSA nicely put, the way they get into networks is to know them better than you do! So in my travels I see lots of different orgs and largely there’s one common similarity, most of them aren’t well documented (docs are boring right!) and if we then make another huge sweeping generalisation, about 90% of orgs have security postures you wouldn’t want to have to defend as a blue teamer, but you might fancy if you were a nation state actor or cyber criminal!

Read more “Service Security Architecture and Assurance” →

What to do when you think you are being…

Planning is key but you can also respond

Recently I was helping a friend out when they were being targeted by a criminal online. I thought I’d put some notes down to try and help people. This isn’t a “how to” it’s more like thoughts and ideas. It’s UK centric, but probably works in lots of places.

One thing to note, preparation is greater than response, the more prepared you are, the less vulnerable you may be, the more prepared the smaller the attack surface.

You may for a variety of reasons become under heightened threat from an internet perspective. The information on here is not a catch all, a detailed guide to personal (PERSEC) and operational security (OPSEC). Read more “What to do when you think you are being targeted in cyberspace” →

Posts navigation

1 2 3 … 18

Recent Posts

  • Microsoft Outlook Elevation of Privilege Vulnerability (CVE-2023-23397)
  • The Long Game: Persistent Hash Theft
  • The Hacker on a Train
  • Adopting an Attacker Mindset to Defend Healthcare
  • Caught: A Hacker Adventure

Recent Comments

No comments to show.

Archives

  • March 2023
  • February 2023
  • January 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • July 2022
  • June 2022
  • May 2022
  • April 2022
  • March 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • August 2021
  • July 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • March 2020
  • February 2020
  • January 2020
  • October 2019
  • May 2019
  • April 2019
  • March 2019
  • February 2019
  • January 2019
  • December 2018
  • October 2018
  • September 2018
  • August 2018
  • July 2018

Categories

  • Architecture
  • Breach
  • Company News
  • CTF
  • Defence
  • Defense
  • Education
  • Fiction
  • Getting into Cyber
  • Guides
  • Hacking
  • IOT
  • Leadership
  • News
  • OSINT
  • Reviews
  • Strategy
  • Threat Intel
  • Uncategorized
  • Vulnerabilities
Copyright (c) Xservus Limited