Ryan Nel

Recommended Mitigations 1) Boot Windows into Safe Mode 2) Navigate to the directory C:\Windows\System32\drivers\CrowdStrike 3) Locate the file matching C-00000291*.sys and delete it 4) Boot the host normally Note: You can also boot in Windows Recovery Environment (WinRE) #crowdstrikefriday

5

⏲ Windows Privilege Escalation Cheat Sheet by Aabhishhek Mitra is packed with essential tips and tricks! ⚡ Here's a sneak peek at your red teaming game! 🎯 1️⃣ Basic Enumeration: 🕵️‍♂️ * Gather system info with systeminfo. * Check network configs with ipconfig /all. * List users and groups using net users and net localgroup administrators. * Find installed software with wmic product get name,version. 2️⃣ Service Exploitation: 🔧 * Identify auto-start services: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" * Spot unquoted service paths and insecure permissions. 3️⃣ DLL Hijacking: 💾 * Use listdlls.exe -v to list loaded DLLs and target weak spots! 4️⃣ Scheduled Tasks: 📅 * List tasks with schtasks /query /fo LIST /v and exploit weak permissions. 5️⃣ Token Manipulation: 🔐 * Check privileges with whoami /priv and use tools like Juicy Potato. 6️⃣ Password Mining: 🗝️ * Extract passwords using mimikatz or search for plain text in config files. 7️⃣ Registry Exploitation: 📝 * Search for sensitive info with reg query HKLM /f password /t REG_SZ /s. 8️⃣ Weak Permissions on Files/Directories: 📁 * Check permissions with icacls. 9️⃣ Exploiting Vulnerable Software: 🛠️ * Identify known exploits via sites like Exploit-DB. 🔟 Windows Exploit Suggester: 📊 * Use this tool to match system info against vulnerabilities. ⚠️ Pro Tip: Always ensure you have permission to test systems and adhere to legal and ethical guidelines. Stay updated with the latest tools and techniques in the cybersecurity community. #CyberSecurity #RedTeam #Pentesting #PrivilegeEscalation #EthicalHacking #Infosec #WindowsSecurity #HackThePlanet #TechTips #CyberAwareness 🌐💻🔍

456

6 commentaren

⏲ Windows Privilege Escalation Cheat Sheet by Aabhishhek Mitra is packed with essential tips and tricks! ⚡ Here's a sneak peek at your red teaming game! 🎯 1️⃣ Basic Enumeration: 🕵️‍♂️ * Gather system info with systeminfo. * Check network configs with ipconfig /all. * List users and groups using net users and net localgroup administrators. * Find installed software with wmic product get name,version. 2️⃣ Service Exploitation: 🔧 * Identify auto-start services: wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" * Spot unquoted service paths and insecure permissions. 3️⃣ DLL Hijacking: 💾 * Use listdlls.exe -v to list loaded DLLs and target weak spots! 4️⃣ Scheduled Tasks: 📅 * List tasks with schtasks /query /fo LIST /v and exploit weak permissions. 5️⃣ Token Manipulation: 🔐 * Check privileges with whoami /priv and use tools like Juicy Potato. 6️⃣ Password Mining: 🗝️ * Extract passwords using mimikatz or search for plain text in config files. 7️⃣ Registry Exploitation: 📝 * Search for sensitive info with reg query HKLM /f password /t REG_SZ /s. 8️⃣ Weak Permissions on Files/Directories: 📁 * Check permissions with icacls. 9️⃣ Exploiting Vulnerable Software: 🛠️ * Identify known exploits via sites like Exploit-DB. 🔟 Windows Exploit Suggester: 📊 * Use this tool to match system info against vulnerabilities. ⚠️ Pro Tip: Always ensure you have permission to test systems and adhere to legal and ethical guidelines. Stay updated with the latest tools and techniques in the cybersecurity community. #CyberSecurity #RedTeam #Pentesting #PrivilegeEscalation #EthicalHacking #Infosec #WindowsSecurity #HackThePlanet #TechTips #CyberAwareness 🌐💻🔍

1

Curious about OSCP+ and recertification? Join OffSec on November 13 at 12:00 pm ET for an interactive webinar where they will cover: ✅ Why OSCP+ matters ✅ How it can help your career ✅ What hiring managers look for in certifications https://lnkd.in/eSsVwqTe

7

Curious about OSCP+ and recertification? Join OffSec on November 13 at 12:00 pm ET for an interactive webinar where they will cover: ✅ Why OSCP+ matters ✅ How it can help your career ✅ What hiring managers look for in certifications https://lnkd.in/eSsVwqTe

2

Curious about OSCP+ and recertification? Join OffSec on November 13 at 12:00 pm ET for an interactive webinar where they will cover: ✅ Why OSCP+ matters ✅ How it can help your career ✅ What hiring managers look for in certifications https://lnkd.in/eSsVwqTe

1

Curious about OSCP+ and recertification? Join OffSec on November 13 at 12:00 pm ET for an interactive webinar where they will cover: ✅ Why OSCP+ matters ✅ How it can help your career ✅ What hiring managers look for in certifications https://lnkd.in/eSsVwqTe

2

Curious about OSCP+ and recertification? Join OffSec on November 13 at 12:00 pm ET for an interactive webinar where they will cover: ✅ Why OSCP+ matters ✅ How it can help your career ✅ What hiring managers look for in certifications https://lnkd.in/eSsVwqTe

10

Curious about OSCP+ and recertification? Join OffSec on November 13 at 12:00 pm ET for an interactive webinar where they will cover: ✅ Why OSCP+ matters ✅ How it can help your career ✅ What hiring managers look for in certifications https://lnkd.in/eSsVwqTe

2

Summary: The article highlights five lesser-known features of Windows 11 Task Manager designed to enhance user experience and productivity. Main Points: - Efficiency mode helps manage resource allocation effectively to improve system performance. - The Task Manager allows users to customize columns, giving more control over displayed information. - Dark mode can be enabled for a more comfortable visual experience in low-light settings. Takeaways: - Familiarizing yourself with Task Manager increases the efficiency of system resource management. - Customizing Task Manager settings can streamline your workflow and enhance productivity. - Knowing these features is beneficial for both everyday users and IT professionals. #Windows11 #TaskManager #TechTips #cybersecuritynews

1

Practical Guide with useful tips and practical information, including; NMAP OpenVAS Metasploit Exploitation Use cases Great start for Penetration Testing 👍👍👍👍 #grcico

67

1 commentaar

Dear Microsoft Customer! Maybe, one day you'll understand why you need to embrace a Prevent & Protect setup - rather than a Detect & Response setup. An emerging phishing-as-a-service (PhaaS) platform called Mamba 2FA has been observed targeting Microsoft 365 accounts in AiTM attacks using well-crafted login pages. Mamba 2FA is currently sold to cybercriminals for $250/month, which is a competitive price that positions it among the most alluring and fastest-growing phishing platforms in the space. Additionally, Mamba 2FA offers threat actors an adversary-in-the-middle (AiTM) mechanism to capture the victim's authentication tokens and bypass multi-factor authentication (MFA) protections on their accounts. ... NOT possible in Prevent & Protect ... read the full article here: https://lnkd.in/dUd5FN9r

8

2 commentaren

SUMMARY: The article discusses the patching of severe security vulnerabilities affecting widely-used software, emphasizing the importance of prompt updates to protect against potential exploitation. MAIN POINTS: - Several critical vulnerabilities in popular software products have been identified and patched. - These security flaws could allow attackers to gain unauthorized access or execute arbitrary code. - Organizations are urged to implement the patches immediately to minimize security risks. TAKEAWAYS: - Timely software updates are crucial in mitigating cybersecurity threats. - Keeping systems updated helps protect against exploitation of known vulnerabilities. - Cybersecurity awareness and proactive measures can significantly reduce the risk of breaches. #patchmanagement #vulnerabilitymanagement #securityupdates #cybersecuritynews

1

Secure email gateways (SEGs) are essential for protecting organizations from malware, spam, and phishing attacks. However, threat actors are exploiting SEGs to encode malicious URLs and bypass email defenses. How It Works: SEG Encoding: SEGs rewrite URLs in outgoing emails to point to their infrastructure for safety checks. Exploitation: Attackers embed malicious URLs that recipient SEGs trust and let through without proper scanning. Key Insights: Notable SEGs Exploited: VIPRE Email Security, Bitdefender LinkScan, Hornet Security Advanced Threat Protection URL Rewriting, and Barracuda Email Gateway Defense Link Protection. Mitigation Strategies: User Awareness and Training: Educate employees on recognizing suspicious emails and URLs. Vigilant Monitoring: Regularly update SEG configurations to ensure comprehensive URL checks. By staying informed and vigilant, organizations can better protect themselves from these sophisticated email threats. #CyberSecurity #EmailSecurity #SEG #ThreatDetection #UserAwareness

5

Understanding the Terrain: IR and Forensics in GKE Environments In the landscape of containerized applications, effective IR and forensic practices are crucial for maintaining security in your GKE environment. You must have data to be in the best possible position to respond to an incident! Below are some highlights and tips: >> Cloud Audit Logs: Capture logs for GKE and Compute Engine nodes, including Kubernetes audit logs. These logs provide detailed information about API calls and system activities. >> OS-Specific Logs: Collect logs from your nodes' underlying operating systems to capture events outside the container runtime. >> Application Logs: Ensure your applications are configured to produce detailed logs that can be collected and analyzed during an incident. Tips for GKE Log Collecting: >> Enable Cloud Logging: Integrate Google Cloud Logging for comprehensive logging and monitoring. This service aggregates logs from various sources and provides powerful search and analysis capabilities. >> Deploy Fluentd: Use Fluentd as a DaemonSet to collect logs from all nodes and pods. Fluentd can be configured to send logs to multiple destinations, including Google Cloud Logging. >> Centralize Logs: Use Google Cloud’s operations suite to centralize and analyze logs. Centralized logging allows for easier correlation and analysis across different components of your environment. >> Log Labels: Apply labels to logs for easier filtering and searching. Labels help categorize logs, making identifying and retrieving relevant information during an incident simpler. >> Log Retention Policies: Define log retention policies to ensure that logs are available sufficiently to support forensic investigations. >> Logging Agents: Deploy logging agents on your nodes to collect system and application logs. Ensure these agents are configured to capture all relevant log data and forward it to your centralized logging solution. >> Monitor Log Health: Regularly monitor the health of your logging pipeline to ensure logs are being collected and stored as expected. Set up alerts for any disruptions or anomalies in the logging process. >> Volatile Data Handling: Capture volatile data, such as in-memory state and running processes, which are crucial for understanding an incident's context. Tools like LiME can be adapted for use in container environments to assist in this process. >> Data Analysis: Analyze collected data to reconstruct the event timeline and understand the attack vector. Use tools like log correlation and specialized forensic tools for deeper filesystem and memory dumps analyses. A well-prepared incident response team and robust forensic capabilities are critical for managing and mitigating security incidents in GKE environments. By focusing on preparation, data collection, and post-incident activities, you can enhance the ability to respond to and recover from incidents. #cybersecurity #security #informationsecurity

35

When the power goes out, does your identity access management service stop working? Protect your cloud applications with Microsoft Entra. Read the case study to learn how one university protects its cloud with Entra. @Microsoft Security

3

🌟 𝗨𝗻𝗹𝗼𝗰𝗸 𝘁𝗵𝗲 𝗙𝘂𝗹𝗹 𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹 𝗼𝗳 𝗦𝗕𝗢𝗠𝘀 𝗶𝗻 𝗬𝗼𝘂𝗿 𝗢𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻! 🔍 Why SBOM? Dive into this Starter Guide to understand how a 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗕𝗶𝗹𝗹 𝗼𝗳 𝗠𝗮𝘁𝗲𝗿𝗶𝗮𝗹𝘀 (𝗦𝗕𝗢𝗠) can transform your approach to vulnerability management. 𝘛𝘩𝘪𝘴 𝘨𝘶𝘪𝘥𝘦 𝘰𝘧𝘧𝘦𝘳𝘴: ✅ A clear, diagrammatic overview of SBOM application in tracking and managing vulnerabilities.  ✅ Step-by-step processes for Producing, Managing, and Sharing SBOMs effectively.  ✅ Best practices for Deploying SBOMs to secure your software supply chain. 🚀 𝗧𝗮𝗸𝗲 𝗔𝗰𝘁𝗶𝗼𝗻!  Enhance your expertise by enrolling in our 𝗖𝗲𝗿𝘁𝗶𝗳𝗶𝗲𝗱 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗦𝘂𝗽𝗽𝗹𝘆 𝗖𝗵𝗮𝗶𝗻 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 𝗘𝘅𝗽𝗲𝗿𝘁 course. Master the skills to safeguard your digital assets against the evolving threats in the software supply chain. 👉 𝗘𝗻𝗿𝗼𝗹𝗹 𝗡𝗼𝘄:  https://lnkd.in/dkWmuJP9 📈 Stay ahead of the curve by following our Certified Software Supply Chain Security Expert (CSSE) LinkedIn page for the latest software supply chain security tips and industry insights. Credits: TNO, Nationaal Cyber Security Centrum (NCSC-NL). Follow Authors: Gwen Jansen-Ferdinandus, Niels Brink, Silke Mergler, Andre Smulders, and Peter-Paul Meiler #SoftwareSupplychain #SBOMs #B2BSecurity #SoftwareSupplyChainSecurity #Securitytraining #Innovation #PracticalDevSecOps

15

🌟 𝗨𝗻𝗹𝗼𝗰𝗸 𝘁𝗵𝗲 𝗙𝘂𝗹𝗹 𝗣𝗼𝘁𝗲𝗻𝘁𝗶𝗮𝗹 𝗼𝗳 𝗦𝗕𝗢𝗠𝘀 𝗶𝗻 𝗬𝗼𝘂𝗿 𝗢𝗿𝗴𝗮𝗻𝗶𝘇𝗮𝘁𝗶𝗼𝗻! 🔍 Why SBOM? Dive into this Starter Guide to understand how a 𝗦𝗼𝗳𝘁𝘄𝗮𝗿𝗲 𝗕𝗶𝗹𝗹 𝗼𝗳 𝗠𝗮𝘁𝗲𝗿𝗶𝗮𝗹𝘀 (𝗦𝗕𝗢𝗠) can transform your approach to vulnerability management. 𝘛𝘩𝘪𝘴 𝘨𝘶𝘪𝘥𝘦 𝘰𝘧𝘧𝘦𝘳𝘴: ✅ A clear, diagrammatic overview of SBOM application in tracking and managing vulnerabilities. ✅ Step-by-step processes for Producing, Managing, and Sharing SBOMs effectively. ✅ Best practices for Deploying SBOMs to secure your software supply chain. 🚀 𝗧𝗮𝗸𝗲 𝗔𝗰𝘁𝗶𝗼𝗻! Enhance your expertise by enrolling in our Certified Software Supply Chain Security Expert (CSSE) course. Master the skills to safeguard your digital assets against the evolving threats in the software supply chain. 👉 𝗘𝗻𝗿𝗼𝗹𝗹 𝗡𝗼𝘄: https://lnkd.in/dkWmuJP9 📈 Stay ahead of the curve by following our Certified Software Supply Chain Security Expert (CSSE) LinkedIn page for the latest software supply chain security tips and industry insights. Credits: TNO, Nationaal Cyber Security Centrum (NCSC-NL). Follow Authors: Gwen Jansen-Ferdinandus, Niels Brink, Silke Mergler, Andre Smulders, and Peter-Paul Meiler #SoftwareSupplychain #SBOMs #B2BSecurity #SoftwareSupplyChainSecurity #SoftwareSupplychainSecuritytraining #Innovation #PracticalDevSecOps

13