Attack Tool(s): Kerbrute, NetExec, Net Use, lolbins Kerbrute: https://github.com/ropnop/kerbrute NetExec: https://github.com/Pennyw0rth/NetExec Net Use: Native Windows command. lolbins: https://lolbas-project.github.io Detection Link(s): User and Entity Behavior Analytics (UEBA) Active Defense and Cyber […]
Attack Tool(s): CredMaster, MSOLSpray, FireProx, FindMeAccess CredMaster: https://github.com/knavesec/CredMaster MSOLSpray: https://github.com/dafthack/MSOLSpray FireProx: https://github.com/ustayready/fireprox FindMeAccess: https://github.com/absolomb/FindMeAccess Detection Link(s): Security Information and Event Management (SIEM) Log Analysis Active Defense and Cyber Deception User […]
| Ethan Robish It’s been nearly a year since Lastpass was breached and users’ encrypted vaults were stolen. I had already migrated to a different password manager for all my […]
Kent Ickler // Because, you know—that should be a thing. TL;DR: Don’t run the Unifi Controller on a laptop in the closet. BACKGROUND Ubiquiti’s Unifi controller is a network device, or software […]
tokyoneon // Spoofing credential prompts is an effective privilege escalation and lateral movement technique. It’s not uncommon to experience seemingly random password prompts for Outlook, VPNs, and various other authentication […]
Why are companies still recommending an 8-character password minimum? Passwords are some of the easiest targets for attackers, yet companies still allow weak passwords in their environment. Multiple service providers recommend […]
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Spotify | Amazon Music | RSS
Michael Allen // Every year around the holidays I end up having a conversation with at least one friend or family member about the importance of choosing unique passwords for […]
Why are companies still recommending an 8-character password minimum? Passwords are some of the easiest targets for attackers, yet companies still allow weak passwords in their environment. Multiple service providers recommend […]
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Spotify | Amazon Music | RSS
Darin Roberts // “Why do you recommend a 15-character password policy when (name your favorite policy here) recommends only 8-character minimum passwords?” I have had this question posed to me […]
