7 Minute Security

Hey friends, today we're talking about how to monitor all your cloud thingies (Web servers, mail servers, etc.) with  UptimeRobot .  And  I'm sharing some fun tips to monitor your  internal  thingies as well - without the use of any extra agent software.

Today's episode is all about  Brute Ratel , a command and control center that is super cool, quick to setup, and much easier to use (IMHO) than Cobalt Strike. I also talk specifically about some of my favorite command line features, how slick and simple lateral movement is, and the "killer feature" that makes me giggle like the bad guy from Sonic the Hedgehog. In the tangent department, Mrs. 7MS m...

Happy new year friends! Today I share the good, bad, ugly, and BROKEN things I've come across while migrating our  Light Pentest LITE  training lab from on-prem VMware ESXi to Azure. It has been a fun and frustrating process, but my hope is that some of the tips in today's episode will save you some time/headaches/money should you setup a pentesting training camp in the cloud. Things I like No lon...

Today we're closing down 2021 with a tale of pentest pwnage - this time with a path to DA I had never had a chance to abuse before: Active Directory Certificate Services! For the full gory details on this attack path, see the  Certified Pre-Owned  paper from the SpecterOps crew. The TLDR/TLDL version of how I abused this path is as follows: Grab  Certi Grab  Certify Run  Certify.exe find /vulnerab...

HAPPY 500 EPISODES, FRIENDS! That's right, 7MS turned 5-0-0 today, and so we asked John Strand of  Black Hills Information Security  to join us and talk about all things security, including the John/BHIS superhero origin story, the future of pentesting, the (perceived) cybersecurity talent shortage,  how to get started with good security practices in your organization , and more! P.S. check out Jo...

Today we have some cool updates on this SIEM-focused series we've been doing for a while. Specifically, I want to share that one of these solutions can now detect three early (and important!) warning signs that bad things are happening in your environment: ASREPRoasting WDigest flag getting flipped ( reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t R...

Hi everybody, today we're continuing a series we started way back in June called  Securing Your Mental Health . Today I talk about some easy and relatively cheap things I'm doing to try and shutdown negative thoughts, punch imposter syndrome in the face, and be an overall happier and more positive person.  

Hey friends, today I'm giving you a peek behind the curtain of our  Light Pentest LITE  training to talk about the software/hardware we use to make it sing, the growing pains - and OMG(!) moments - that forced us to build in more infrastructure redundancy, and the cool (and expensive!) cloud options we're considering to offer a self-paced version of the course.

Today's tale of pentesting has a bunch of tips to help you maximize your pwnage, including: The new  Responder DHCP poisoning module All the cool bells and whistles from  CrackMapExec  which now include  new lsass-dumping modules ! Speaking of lsass dumping, here's a  new trick  that works if you have Visual Studio installed (I bet it will be detected soon). I close out today's episode with a stor...

Today we continue our  SIEM/SOC evaluation series  with a closer look at one particular managed solution and how it fared (very well) against a very hostile environment: the  Light Pentest LITE  pentesting course! Spoiler alert: this solution was able to detect: RDP from public IPs Password spraying Kerberoasting Mimikatz Recon  net  commands Hash dumping Hits on a "honey domain admin" account Use...

Hey, remember back in  episode #357  where we introduced  7MOIST  ( 7   M inutes  o f  I T and  S ecurity  T ips)? Yeah, me neither :-). Anyway, we're back with the second edition of 7MOIST and have some cool pentesting and general IT tips that will hopefully make your life a little awesome-r: Stuck on a pentest because EDR keeps gobbling your payloads?  SharpCradle  might just save the day! Crack...

Hello friends! We're long overdue for a tale of pentest pwnage, and this one is a humdinger! It's actually kind of three tales in one, focusing on pentesting wins using: Manual "open heart surgery" on the root of the Active Directory domain The new totally rad DHCP poisoning module of  Responder An opportunity to abuse GPOs with  SharpGPOAbuse  (P.S. we talked about this tool about a year ago in ...

Today we're joined by Louis Evans of  Arctic Wolf  to talk about all things cyber insurance, including: History on cyber insurance - who's buying it, what it does and doesn't cover, and when it started to be something you didn't want to leave home without What are insurance companies asking/demanding of customers before writing a cyber insurance policy? What basic things organizations can do to re...

Hey friends! Today we're going to recap the SIEM/SOC players we've evaluated so far ( Arctic Wolf ,  Elastic ,  Sumo Logic ,  Milton Security ) and then talk about a  new  contender that was brought to our attention:  Blumira  (not a sponsor, but I'm really digging what I'm seeing/hearing/experiencing thus far)!

Today we're talking about  Ping Castle  (not a sponsor), an awesome tool for enumerating tons of info out of your Active Directory environment and identifying weaknesses, misconfigurations and paths to escalation! It's wonderful for both red and blue teamers. Some of Ping Castle's cool features include being able find: Kerberoastable and ASREPRoastable users Plain text passwords lingering in Group...

Today we continue our series focused on  building a security consultancy  and talk about: A phishing campaign that went off the rails, and lessons learned from it First impressions of an  awesome  tool to help add MFA to your Active Directory (not a sponsor) A tangent story about how my wife brought some thieves to justice!

Hey friends! Today I've got some exciting personal/professional news to share: our  Light Pentest eBook  - which is a practical, step-by-step playbook for internal network penetration testing - is now available for purchase! Note: this eBook and the  Light Pentest LITE  training are two separate things, but do cover some of the same topics. The Light Pentest eBook covers: Grabbing and analyzing pa...

Today our good buddy  Joe Skeen  and I virtually sit down with Matt Quammen of  Blue Team Alpha  to talk about all things incident response! Topics covered include: Top 5 things to do and  not  do during ransomware event Challenges when responding to ransomware events Opportunities to break into infosec/IR The value of tabletop exercises, and some great ideas for conducting your own Incident respo...

Today our friend Christopher Fielder from  Arctic Wolf  is back for an interview  four-peat ! We had a great chat about making sense of vendor alphabet soup terms (like SIEM, SOC, EDR/MDR/XDR, ML, AI and more!), optimizing your SOC to "see" as much as possible, tackling vendor/customer communication problems, and simplifying security product pricing to make purchases less stressful for customers!...

Today we're continuing our series called Desperately Seeking a Super SIEM for SMBs - this time with a focus on a new contender in our bake-off: Perch Security! It might help you to go back and take in  part 1  and  part 2 , but today we're focusing on the first experience I had chatting with the sales/technical folks at Perch. TLDL: I  really  liked a lot of things I was hearing and seeing. Pros (...

Today we continue our series we started recently (part 1 is  here  about finding a super SIEM for SMBs. Specifically I have some updates on (and frustrations with) Arctic Wolf, Elastic, Milton Security and Perch Security. Here's the TLDL version: Arctic Wolf They remain a strong contender in my bake-offs. They also could tick several boxes for an org as they offer continuous internal/external vuln...

Today we're continuing our discussion on phishing campaigns - including a technical "gotcha" that might redirect your phishing emails into a digital black hole if you're not careful! As I mentioned last week, I've been heavy into spinning up and tearing down phishing campaigns, so I finally got around to documenting everything in  episode 481 . This week I ran into a bizarre issue where test phish...

Today we're revisiting how to make a kick-butt cred-capturing phishing campaign with  Gophish ,  Amazon Lightsail ,  LetsEncrypt ,  ExpiredDomains.net  and a special little extra something that makes creating phishing landing pages  waaaaaaayyyyyyyyyy  easier! For some quicker review, you can check out  part 1  and also the complementary  YouTube  video, but I wanted to revisit this kick-butt proc...

Today we're talking about the SIEM bake-off for SMBs that we've recently embarked on. We're currently evaluating several solutions - either for customer-facing purposes, internal kick-the-tires fun, or both. Candiates include: Arctic Wolf Elastic Milton Security Protocol46 Sumo Logic First we're starting by running each vendor through a  series of questions , then likely following up with a demo w...