C2, Red Team C2, DNS C2, dnscat2, PowerShell, tunneling

PowerShell DNS Command & Control with dnscat2-powershell

Luke Baggett // Imagine a scenario where a Penetration Tester is trying to set up command and control on an internal network blocking all outbound traffic, except traffic towards a […]

Read the entire post here

Blue Team backups, be prepared, breach, Christmas delivery phish, good times all around, Oh !@$# moments, Osiris ransomware, ransomware

My Ransomware Post-Mortem

Cody Smith* // As information security professionals we’re not invincible to breaches. Even the most robust security system can’t make up for a lack of user education, which I was […]

Read the entire post here

Author, John Strand, Red Team, Webcasts bypassing AV, Sacred Cash Cow Tipping

WEBCAST: Sacred Cash Cow Tipping 2016

John Strand with BHIS testers // Yes, we did this in 2017, but it’s reflecting work done in 2016.

Read the entire post here

Red Team, Red Team Tools All the AVs, anti-virus, bypassing AV, Carrie Roberts, mimikatz, Windows Defender

How to Bypass Anti-Virus to Run Mimikatz

Carrie Roberts // * Would you like to run Mimikatz without Anti-Virus (AV) detecting it? Recently I attempted running the PowerShell script “Invoke-Mimikatz” from PowerSploit on my machine but it was […]

Read the entire post here

Author, C2, David Fletcher, Red Team Apple, Install, Mac, Malware, phishing

How to Phish for Geniuses

David Fletcher // Recently we were involved in an engagement where we expected to see a large number of Macs in the target environment. As an element of the engagement […]

Read the entire post here

C2, Red Team exploit, malicious outlook rules, Outlook, Sacred Cash Cow Tipping

Malicious Outlook Rule without an EXE

 Carrie Roberts // My current favorite exploit is creating malicious outlook rules as described here. The rule is configured to download an executable file with an EXE extension (.exe) when an […]

Read the entire post here

Phishing, Red Team con artistry, Marketing, pen-testing, penetration testing, Pentesting, phishing, social engineering

A Marketer’s Lessons in Con Artistry for Good & Learning

Sierra Ward* // Normally I am hidden in the back rooms at BHIS, chipping away at 10 million marketing tasks.  I show up occasionally in webcasts, lurking again in the shadows, […]

Read the entire post here

Blue Team, Blue Team Tools, Webcasts Domain Password Audit Tool, DPAT, webcast

WEBCAST: Demo of Domain Password Audit Tool

Check out Carrie’s demo of her DPAT, and if you missed her blog, check that out here.

Read the entire post here

InfoSec 101 ebooks, electronic text, Millineals, reading online, reading with children, reading with kids, tiny people

Bite the Pages of an Ebook: Tiny People Need to See You Get Excited about Electronic Text

 Gail Menius // We avoid tasks that are too hard. When we avoid them (consciously or unconsciously) the things we do instead are called “avoidance behaviors.” Adults and teachers alike […]

Read the entire post here