Overview Performing lateral movement in an OpSec safe manner in mature Windows environments can often be a challenge as defenders hone their detections around the indicators generated by many of...

Overview In part 1 of this series, we discussed lateral movement using WMI event subscriptions. During this post we will discuss another of my “go to” techniques for lateral movement,...

Overview In the past two posts of this series, we’ve covered lateral movement through WMI event subscriptions and DCOM, detailing approaches to improve the OpSec of our tradecraft. In the...

Overview APT-Hunter is the threat hunting tool for windows event logs which will detect APT movements and uncover suspicious activities. It was written by ahmedkhlief. Also, Ahmed would like to thank Joe Maccry for his amazing contribution to Sysmon use cases…

Silver Ticket is similar to Golden Ticket, wherein the golden ticket attack, attackers have full control to Domain itself. But Silver Ticket provides access only to the specific service account (e.g SharePoint, MSSQL), Adversaries who have the password hashes…

Microsoft warned admins today to immediately patch a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.

A repository of DFIR-related Mind Maps geared towards the visual learners! - AndrewRathbun/DFIRMindMaps

Lately, I have been working on a few projects such as OSSEM , HELK and ThreatHunter-Playbook with a main goal of integrating all of the...

Red team exercises focus on checking your internal team’s ability to respond and the resiliency of your IT systems against real-life cyber attacks.

Intro / TL;DR

Introduction: Densityscout calculates the density ( like entropy ) for files of any file system and makes analysts quickly find the packed malware in the potentially infected machine. It was written by Christian Wojner. In general, a normal file will have…

Researchers have a working exploit for the vulnerability (now patched), which allows for unauthenticated RCE and affects an estimated 70,000+ VPN/firewalls.