Today I close my @TrustedSec laptop for the last time, and open my @CrowdStrike laptop for the first time; my work at TS has concluded, my work at CS begins. I’m honored to have been a contributor at TS and to begin contributing to CS.
Thank you to @SecShoggoth, @HackingDave and others who approved my job offer some 3 years ago, for making TrustedSec a great place to be, and for wishing me well. And thanks to the TS IR team for growing with me along the way.
Nick retweeted
Its not as "sexy" as shellcode injection or side loading but the truth about compromising cloud environments is undeniable. UEBA will be critical to platforms for detections. #cloudsecurity
Images courtesy of Googles Threat Horizons report and Elastic Global Threat Report.
Nick retweeted
Amazon S3 beginning to apply two security best practices to all new buckets by default
As announced on December 13, 2022, Amazon S3 is now deploying two new default bucket security settings by automatically enabling S3 Block Public Access and disab... aws.amazon.com/about-aws/wha…
Nick retweeted
Exciting news! @awscloud GuardDuty has just released three new findings for detecting unusual usage of external DNS resolvers and encrypted DNS services. Check out the new finding types here: docs.aws.amazon.com/guarddut… #AWS #GuardDuty #Cybersecurity #DNS #Encryption #cloudsecurity
Great collaborative effort by the team in getting this out
🚨 Critical #cybersecurity vulnerability 🚨 #Microsoft has taken action against an #Outlook vulnerability (CVE-2023-23397) that's been actively exploited for almost a year. Find out how it works and what you can do to mitigate the threat. hubs.la/Q01HnJpB0
Great series of recommendations for hardening AD
1/ I presented 10 #ActiveDirectory hardening measures a few weeks ago, and I will tweet my recommendations in the next ten days.
The list is neither prioritised nor complete, but it might give companies and administrators good input on improving (AD) security.
🧵 #CyberSecurity
3/4 LastPass now has the institution experience of a catastrophic breach by a sophisticated threat actor. Yes, they got owned, but that experience is incredibly valuable. Does any other major cloud provider have that proven experience?
Today I discovered that @0xdabbad00 released the CloudTrail logs from flaws.cloud, the AWS attack lab (I’m late to the party). That’s 3.5 years worth of AWS attack data! 1. Download the logs. 2. Import into tools. 3. Go hunting to boost your #AWS #DFIR skills. Link ⬇️
summitroute.com/blog/2020/10…
The blog post includes a summary of which attacks to look for. You can import these logs into SOF-ELK using the built-in aws-cloudtrail2sofelk.py script.
Check out github.com/easttimor/aws-inc… for some example queries using Athena.
Nick retweeted
1/ In a recent investigation, we found out that the TA executed the elevate command from CobaltStrike to raise the privileges on the beachhead:
> elevate uac-schtasks
> Tasked Beacon to run windows/beacon_https/reverse_https (<redacted>) in a high integrity context
🧵 #DFIR
Would love to see this forensics report.
GoDaddy has stated an unknown Threat Actor has maintained persistent access to their network since at least 2019. The Threat Actor unveiled themselves 4 times, without losing access, in 2019, 2020, 2021, and 2022
Intel via @Gi7w0rm
More information: bleepingcomputer.com/news/se…
A follow-up to our previous primer on #ESXiArgs
In continuation of our coverage of the #ESXiArgs Ransomware Attacks, Principal Research Analyst @_snus takes a deeper dive into the code behind the #ransomware. Read it now on our #blog. hubs.la/Q01BKPJf0
