John Strand // I have quite a few calls with customers who do not know where to begin when it comes to application whitelisting. Often, the approach some organizations take is to try and implement full application whitelisting on every single application across their entire environment. While this goal is fun and seems like a […]
John Strand // In this blog, I want to walk through how we can set up Sysmon to easily get improved logging over what we get from normal (and just plain awful) logging in Windows. Basically, trying to get information from standard Windows logs is a lot like playing tennis against curtains. Sure, you can […]
In this BHIS podcast, originally recorded as a live webcast, we cover some new techniques and tactics on how to track attackers via various honey tokens. We cover how to track with Word Web Bugs in ADHD, and cover the awesome toolkit from Thinkst. We also cover some of the legal ramifications involved in doing […]
Podcast: Play in new window | Download
In this BHIS webcast, we cover some new techniques and tactics on how to track attackers via various honey tokens. We cover how to track with Word Web Bugs in ADHD and cover the awesome toolkit from Thinkst. We also cover some of the legal ramifications involved in doing this. Download slides: https://www.activecountermeasures.com/presentations/ I am covering this […]
John Strand // I wanted to take a few moments and address the “Hacking Back” law that is working people up. There is a tremendously well-founded fear that this law will lead to mass confusion, collateral damage and some say… possibly war. “At least they have not brought me up in this debate… Yet.” – A. Hitler […]
This is the in-studio version of our live in DC event from July. In this webcast, John covers how to set up Active Directory Active Defense (ADAD) using tools in Active Defense Harbinger Distribution (ADHD). He shows how to create honey accounts, create callback word documents, and create fake SMB shares! Slides here: https://www.dropbox.com/s/kyfugi66j56ek8v/HoneyAdmin_AndShare.pptx?dl=0
Ethan Robish // If you’re familiar with ADHD and Web Word Bugs, you likely already know the method to create web tracking software using .html files renamed as .doc files. This works, but you also likely know that it makes it difficult to use existing documents, especially if you want to update the documents in […]
John Strand // Lets take a look at how to use HoneyPorts on the new Active Defense Harbinger Distribution. For those of you who do not know, this is a really cool script which dynamically blocks an IP address which makes a full established TCP connection. This is cool because it makes spoofing very hard […]
