Kent Ickler Archives - Black Hills Information Security

Fun & Games, How-To, Informational, InfoSec 101 Kent Ickler

How SPF, DKIM, and DMARC Authentication Works to Increase Inbox Penetration (Testing) Rates

Kent Ickler // TL;DR Want a quick fix? Almost every marketing platform we’ve seen has decent tutorials on authorizing outbound email with SPF and DKIM authorization. Salesforce: https://help.salesforce.com/articleView?id=000315520&language=en_US SendGrid: https://sendgrid.com/docs/glossary/spf/ MailChimp: https://mailchimp.com/help/set-up-custom-domain-authentication-dkim-and-spf/ MailGun: https://mxtoolbox.com/c/outboundemailsources?public=Mailgun Amazon SES: https://docs.aws.amazon.com/ses/latest/DeveloperGuide/send-email-authentication-spf.html Constant Contact: https://knowledgebase.constantcontact.com/articles/KnowledgeBase/34717-SPF-Self-Publishing-for-Email-Authentication?lang=en_US If you’re a marketing arm of your organization or are a mass marketing company and […]

Read the entire post here

00476_07232020_HowToAppliedPurpleTeamingLabBuild

How-To, Informational Azure, Detection Lab, Jordan Drysdale, Kent Ickler, purple teaming, Terraform

How To: Applied Purple Teaming Lab Build on Azure with Terraform (Windows DC, Member, and HELK!)

Jordan Drysdale & Kent Ickler // tl;dr Ubuntu base OS, install AZCLI, unpack terraform, gather auth tokens, run script, enjoy new domain. https://github.com/DefensiveOrigins/APT-Lab-Terraform For those of you who have been diligently following along – three webcasts now, a four-hour intro training session on a Saturday, our students who have attended the virtual courses – it […]

Read the entire post here

Informational Jordan Drysdale, Kent Ickler, Windows Optics

How To Deploy Windows Optics: Commands, Downloads, Instructions, and Screenshots

Jordan Drysdale & Kent Ickler // TL;DR Look for links, download them. Look for GPOs, import them. Look for screenshots, for guidance. Sysmon + Windows Audit Policies + Event Collectors and Forwarding (Handlers) + WinLogBeat + Elastic = The baseline configuration for producing endpoint optics that matter (for almost free). PART 1 – Building Your […]

Read the entire post here

00466_06052020_WebcastBlueTeamPerspective

Blue Team, Blue Team Tools, How-To, Hunt Teaming, Informational, InfoSec 101, Red Team, Red Team Tools, Webcasts Blue Team, Jordan Drysdale, Kent Ickler, Red Team, Red Team vs. Blue Team

Webcast: A Blue Team’s Perspective on Red Team Hack Tools

Kent and Jordan are back to continue their journey to make the world a better place. This time around, they will be reviewing a series of tools commonly used on pentests to identify flaws in Active Directory and general network design and implementation. You’ve probably heard of most of them, like BloodHound, ADExplorer, mimikatz…, wait, […]

Podcast: Play in new window | Download

Subscribe: Android | RSS

Read the entire post here

Blue Team, How-To, Informational, InfoSec 101, Red Team, Webcasts Jordan Drysdale, Kent Ickler, Purple Team

Webcast: Enterprise Recon For Purple Teams

Do you know what your attackers know? There’s a good chance you know, but you might not be aware of just how much information can be found historically and in real-time about your business operations and organization. Join Jordan Drysdale and Kent Ickler as they discuss and demonstrate Purple Team Enterprise Reconnaissance methods that increase […]

Podcast: Play in new window | Download

Subscribe: Android | RSS

Read the entire post here

00427_01072020_WebcastLetsTalkAboutElkBaby

Blue Team, Blue Team Tools, How-To, Informational, Webcasts Active Directory, applocker, Atomic Red Team, ATT&CK, ELK, Group Policies, Jordan Drysdale, Kent Ickler, Sysmon, Windows logging, Winlogbeat

Webcast: Let’s Talk About ELK Baby, Let’s Talk About You and AD

BHIS’ Defensery Driven Duo Delivers Another Delectable Transmission! We know you are worried about your networks. After hours of discussion, we’ve come to the realization that some of our dedicated followers seem to be much more interested in catching malware than learning how to be (please forgive this next statement) “l33t hax0rs.” Slides for this […]

Podcast: Play in new window | Download

Subscribe: Android | RSS

Read the entire post here

00419_11262019_WEBCAST_GroupPoliciesKillKillChains

Blue Team, Informational, Webcasts Best Practices, CMD, Group Policies, honey accounts, Jordan Drysdale, Kent Ickler, Kerberos, LAPS, LLMNR, Local Admin Controls, Logging, PowerShell, SMB Message Signing, Sysmon

Webcast: Group Policies That Kill Kill Chains

On this webcast, we’ll guide you through an iterative process of building and deploying effective and practical Group Policy Objects (GPOs) that increase security posture. Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_GroupPoliciesThatKillKillChains.pdf 0:45 Introducing what a kill chain is and general background you need for this webcast 15:53 Getting into group policies, best […]

Read the entire post here

Blue Team, Blue Team Tools, How-To, Informational, Podcasts Attack Tactics, BHIS, Blue Team, Defenses, john strand, Jordan Drysdale, Kent Ickler, podcast

Podcast: Attack Tactics 6! Return of the Blue Team

Download slides: https://www.activecountermeasures.com/presentations In this webcast we walk through the step-by-step defenses to stop the attackers in every step of the way we showed in Attack Tactics Part 5!!! Originally recorded as a live webcast on May 16th, 2019Presented by: John Strand, Jordan Drysdale, Kent Ickler Join the BHIS Blog Mailing List – get notified when […]

Podcast: Play in new window | Download

Subscribe: Android | RSS

Read the entire post here

Blue Team, How-To, Informational, Webcasts Attack Tactics, Blue Team, canary tokens, cobalt strike, crackmapexec, Defenses, fixthefuture, honey accounts, john strand, Jordan Drysdale, Kent Ickler, LLMNR, MailSniper, RITA, ssh brute force

Webcast: Attack Tactics 6! Return of the Blue Team

Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_AttackTactics6ReturnofBlueTeam.pdf In this webcast we walk through the step-by-step defenses to stop the attackers in every step of the way we showed in Attack Tactics Part 5!!! Timecode links take you to YouTube: 2:53 Introduction, password spray toolkit, account lockout, honey accounts, canary tokens, and two factor […]

Read the entire post here