Native Sysmon functionality coming to Windows techcommunity.microsoft.com/blog/windows... #infosec #blueteam

"HELP! MY ACCOUNT GOT HACKED!" - Business Email Compromise (BEC) Part 1 www.truesec.com/hub/blog/hel... "The Anatomy of a Business Email Compromise Attack" - Business Email Compromise (BEC) Part 2 www.truesec.com/hub/blog/the... #infosec #blueteam

Harden Windows Security is an open source PowerShell module (with GUI/CLI/Unattended mode) that documents, automates and hardens Windows security settings based on supported Microsoft mechanisms github.com/HotCakeX/Har... #infosec #blueteam

Prowler is an open-source security tool that helps assess and enforce security best practices across AWS, Azure, Google Cloud and Kubernetes. github.com/prowler-clou... #infosec #blueteam

Ransomware Tool Matrix by @bushidotoken.net: This repository lists tools used by ransomware gangs. Defenders can detect and block these commonly reused tools to stop intrusions. github.com/BushidoUK/Ra... #infosec #blueteam

State-of-the-art phishing: MFA bypass by Jaeson Schultz @talosintelligence.com blog.talosintelligence.com/state-of-the... #infosec #blueteam

ArgFuscator is an open-source web app that generates obfuscated command lines for common system tools. Great for testing your defenses against real-world attack techniques. argfuscator.net #infosec #pentest #redteam #blueteam

How well do you protect your privacy? The Privacy Checkup helps you assess your online surveillance defenses and take steps to protect your data. privacy-checkup.info (English, Deutsch, Español) #privacy #infosec

A great read on the exploitation of VMware vulnerabilities - from both attacker and defender perspectives - plus practical recommendations to strengthen your security posture. "Breaking the Virtual Barrier: From Web-Shell to Ransomware" www.sygnia.co/threat-repor... #infosec #blueteam

Eine kriminelle Organisation hinter mehr als 75.000 Fake-Shops, >1 Mio. Bestellungen & >$50M Schaden. Einblick in ihr ausgeklügeltes System & wie sie Käufer täuschen. #38C3: "Fake-Shops von der Stange: BogusBazaar" mit @kaibiermann.bsky.social und kantorkel. media.ccc.de/v/38c3-fake-... #infosec

"Mastering Sysmon: Deploying, Configuring, and Fine-Tuning" A free mini eBook for #DFIR professionals with practical steps to deploy, fine-tune, and start logging with Sysmon. dfirinsights.com/2024/11/27/m... #infosec #blueteam

Welche Daten enthält die elektronische #Patientenakte und was bedeutet sie für die ärztliche Schweigepflicht?

Carseat is a Python implementation of GhostPack's Seatbelt, a situational awareness tool for analyzing Windows security configurations. github.com/0xthirteen/C... #infosec #pentest #redteam

The fascinating security model of dark web marketplaces by @boehs.org boehs.org/node/dark-we... #infosec

That's a Cybersecurity Advisory worth reading, with many important points to note. Enhancing Cyber Resilience: Insights from CISA Red Team Assessment of a US Critical Infrastructure Sector Organization www.cisa.gov/news-events/... #infosec #blueteam

LOLESXi features a comprehensive list of binaries/scripts natively available in VMware ESXi that adversaries have utilised in their operations. lolesxi-project.github.io/LOLESXi/ #infosec #pentest #redteam #blueteam

Phishing remains one of the most widespread cyberattacks - here are some tips on how to avoid falling victim! 5 Phishing Email Scams and How NOT To Fall For Them www.huntress.com/blog/5-phish... #infosec

🚨 Exciting news for all hackers and tech enthusiasts! The #DEFCON32 talks are now available on YouTube! 🎉 youtube.com/playlist?lis... #infosec #pentest #redteam #blueteam

A tool that uses the Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server. github.com/netero1010/E... #infosec #pentest #redteam

Spannend & unterhaltsam: Die #BigBrotherAwards prämieren jedes Jahr die größten Datensünder in Wirtschaft & Politik! BigBrotherAwards 2024: Preisträger, Bilder und Livestream unter bigbrotherawards.de/2024 Also available in English: bigbrotherawards.de/en/2024 #infosec #BBA24

Guidance on Detecting and Mitigating Active Directory Compromises www.cisa.gov/news-events/... #infosec #blueteam

Event Log Talks a Lot: Identifying Human-operated Ransomware through Windows Event Logs blogs.jpcert.or.jp/en/2024/09/w... #infosec #blueteam

Active Directory Hardening Series - Part 5 - Enforcing LDAP Channel Binding techcommunity.microsoft.com/t5/core-infr... #infosec #blueteam

SharpExclusionFinder: This C# tool finds Windows Defender folder exclusions using Windows Defender through its command-line tool (MpCmdRun.exe) github.com/Friends-Secu... A blog explaining the technique utilised can be viewed here: blog.fndsec.net/2024/10/04/u... #infosec #pentest #redteam

ConPass: How to do password spraying while minimizing the risk of locking accounts. Spray passwords, avoid lockouts en.hackndo.com/password-spr... #infosec #pentest #redteam

A nice write-up by Rayan Bouyaiche of @mpgn's Active Directory workshop at LeHack 2024. The workshop aimed to compromise an Active Directory environment and become DA of two domains as quickly as possible using only NetExec. www.rayanle.cat/lehack-2024-... #infosec #pentest #redteam

That's a worth reading Cybersecurity Advisory. CISA Red Team’s Operations Against a Federal Civilian Executive Branch Organization Highlights the Necessity of Defense-in-Depth www.cisa.gov/news-events/... #infosec #blueteam

MailFail is a Firefox browser extension that identifies and provides commands to exploit a large number of email-related misconfigurations for the current domain and subdomain. m.ail.fail #infosec #pentest #redteam #blueteam

An alternative method to retrieve NTDS hashes from a domain controller after obtaining Domain Admin privileges on the network. Bypassing EDR NTDS.dit protection using BlueTeam tools. medium.com/@0xcc00/bypa... #infosec #pentest #redteam #blueteam

Kerberoasting allows attackers to extract and crack service account passwords from a domain controller. This blog post will look into the details of Kerberoasting from a DFIR perspective. DFIR Breakdown: Kerberoasting www.cybertriage.com/blog/dfir-br... #infosec #blueteam #dfir

Certiception is a honeypot for Active Directory Certificate Services (ADCS), designed to trap attackers with a realistic and attractive bait that triggers highly relevant alerts. github.com/srlabs/Certi... #infosec #blueteam

Der belgische Vorschlag zur Chatkontrolle wird die Verschlüsselung schwächen. Das sehen auch 36 Abgeordnete aus dem Europaparlament und dem Bundestag so. Am Donnerstag soll über den Vorschlag abgestimmt werden – das Bundesinnenministerium verrät nicht, wie es sich dann verhalten wird.

Chatkontrolle: Kuhhandel, während niemand hinschaut Nach einem weiteren Hütchenspielertrick, den massenhaften Angriff auf Verschlüsselung nicht als solchen erscheinen zu lassen, wackelt nun der Widerstand Frankreichs. German: www.ccc.de/de/updates/2...

GPOZaurr: A PowerShell module that aims to gather information about Active Directory Group Policies but also allows fixing issues that you may find in them. github.com/EvotecIT/GPO... Check out the blog post too: evotec.xyz/the-only-com... #infosec #blueteam

Want to get better at phishing? Check out the blog post about potential failure points in phishing campaigns. Phish Sticks; Hate the Smell, Love the Taste - I’ll Make You Great at Phishing or Your Money Back posts.specterops.io/phish-sticks... #infosec #pentest #redteam

ScriptSentry: A PowerShell script that finds misconfigured and dangerous Active Directory logon scripts. github.com/techspence/S... Check out the blog post too: offsec.blog/hidden-menac... #infosec #pentest #redteam #blueteam

ADeleg: A powerful tool for managing Active Directory delegations. It allows you to make a detailed inventory of delegations in a forest, along with their potential issues. It also allows you to document your delegation model. github.com/mtth-bfft/ad... #infosec #pentest #redteam #blueteam

Microsoft has fixed an Outlook remote code execution vulnerability (CVE-2024-30103). An attacker who successfully exploited this vulnerability could bypass Outlook registry block lists and enable the creation of malicious DLL files. blog.morphisec.com/cve-2024-301... #infosec #blueteam

Locksmith by @dotdot.horse: A small tool built to find and fix common misconfigurations in Active Directory Certificate Services (AD CS). Identifies issues and attack paths and provides you with cmdlets that you can run to fix them. github.com/TrimarcJake/... #infosec #blueteam

Penetration testing applications for iOS/Android are essential tools to assess the security of mobile apps. This blog covers jailbreak/root methods, important files/folders, hooking, SSL pinning, content providers & more. redteamrecipe.com/mobile-pente... #infosec #pentest

As Windows LAPS deployments become more popular, it's crucial to review the configuration items and implement policies to secure endpoints and prevent attacks. 6 Tips to Harden Your Windows LAPS Deployment www.ravenswoodtechnology.com/6-tips-to-ha... #infosec #blueteam

The "Living Off the Living Off the Land" website provides a great list to various projects, including binaries, scripts, libraries, drivers, and other tools that can be exploited by attackers to bypass security controls. lolol.farm #infosec #pentest #redteam #blueteam

Learn how to effectively select and categorize domains to avoid getting blocked by reputation checks in phishing campaigns. One Phish Two Phish, Red Teams Spew Phish - How to Give your Phishing Domains a Reputation Boost posts.specterops.io/one-phish-tw... #infosec #pentest #redteam

Surveillance Self-Defense (SSD) by @eff.org provides comprehensive resources to protect online privacy and security. It includes guides on creating strong passwords, using encryption, and avoiding phishing attacks, as well as recommendations for secure communication tools. ssd.eff.org #infosec

Purple Knight - another great and free tool to find, prioritize, and fix security gaps while reducing the attack surface of your Active Directory, Entra ID, and Okta. www.semperis.com/purple-knight/ #infosec #pentest #blueteam

Deploy your own (Active Directory) lab environment in minutes! All you need is a browser to access your lab environment. A Snap Labs (Immersive Labs) Community Edition account (free) and an AWS account are required. www.blackhillsinfosec.com/deploy-an-ac... #infosec #pentest #redteam #blueteam

A post about macOS Red Teaming redteamrecipe.com/macos-red-te... #infosec #pentest #redteam

This post highlights some possibilities for NTLM relay attacks: -Enumerating AD usernames (non-Admin SMB relay) -Relaying to MS SQL -Relaying to LDAP and configuring RBCD -Shadow Credentials Attacks www.guidepointsecurity.com/blog/beyond-... #infosec #pentest #redteam

Very informative blog post, providing an overview of assumed breach methods and how they could change your next round of offensive testing. It's worth reading. Assumed Breach: The Evolution of Offensive Security Testing trustedsec.com/blog/assumed... #infosec #pentest #redteam

Files with TXZ extension used as malspam attachments. Be cautious and consider blocking uncommon file extensions! isc.sans.edu/forums/diary... #infosec #blueteam