7 Minute Security

Today we talk about Simple Ways to Test Your SIEM. Feel free to check out the  YouTube version  of this presentation, as well as our  interview with Matt from Blumira  for even more context, but here are the essential tools and commands covered: Port scanning nmap 10.0.7.0/24  - basic nmap scan massscan -p1-65535,U:1-65535 --rate=1000 10.0.7.0/24 -v  - scan all 65k+ TCP and UDP ports! Password spr...

Hey friends, today's episode is hosted by an AI from  Murf.ai  because I suffered a throat injury over the holidays and spent Christmas morning in the emergency room! TLDL: I'm fine, but if you want the (sort of) gory details and an update on my condition after my ENT appointment, check out today's episode. Otherwise, we'll see you next week when our regularly scheduled security content continues...

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit  safepass.me  for more details, and tell them 7 Minute Security sent you to get a 10% discount! Today's tale of pentest pwnage covers some of the following attacks/tools: Teleseer  for packet capture visualizations on steroids! Copernic Desktop Search Running  Respo...

Today we welcome our pal Matthew Warner (CTO and co-founder of  Blumira ) back to the show for a  third  time (his first appearance was  #507  and second was  #529 ). I complained to Matt about how so many SIEM/SOC solutions don't catch early warning signs of evil things lurking in customer networks. Specifically, I whined about 7 specific, oft-missed attacks like port scanning, Kerberoasting, ASR...

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. Hey friends, today's episode is extra special because it's our first episode we've ever done  live  and  with video(!) . Will we do it again? Who knows...

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. Today my friends Christopher Fielder and Daniel Thanos from Arctic Wolf chat with me about what kinds of icky things bad guys/gals are doing to our net...

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit  safepass.me  for more details, and tell them 7 Minute Security sent you to get a 10% discount! Happy belated Thanksgiving! This is  not  a brag or a flex, but this episode covers a coveted achievement I haven't achieved in my whole life...until now:  TDAD: Triple D...

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. Today we're talking about tales of pentest pwnage - specifically how much fun  printers can be to get Active Directory creds . TLDL: get into a printer...

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. Today we're talking about securing your mental health! I share some behind-the-scenes info about my own mental health challenges, and share a  great ti...

Today's episode of the 7 Minute Security podcast is brought to you by Blumira, which provides easy-to-use automated detection and response that can be set up in…well..about 7 minutes. Detect and resolve security threats faster, and prevent breaches. Try it free today at blumira.com/7ms. Hey friends, today we're giving you a first impressions look at a free easy asset management tool called  Snipe-...

Today's episode is brought to us by Blumira, which provides easy to use, automated detection and response that can be setup in…well…about 7 minutes! Detect and resolve security threats faster and prevent breaches. Try it free today at  blumira.com/7ms ! Today we have a really fun interview with Nato Riley of Blumira. He cut his IT/security teeth working for a cell phone company, exorcising malware...

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. Hey friends! Today we talk about a SoSaaS (Spreadsheet on Steroids as a Service... not a real thing ) that is helping 7MinSec be more organized - both...

This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit  Arcticwolf.com/7MS  to learn more. In today's episode we talk more about eating the security dog food (following the best practices we preach!). Specifically, we focus on keeping that bl...

SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit SafePass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount! Today we talk about configuring your Active Directory with MFA protection thanks to  AuthLite . In the tangent department, we give you a short, non-spoilery review of the f...

Today we're excited to kick off a new series all about blue team bliss - in other words, we're talking about pentest stories where the blue team controls kicked our butt a little bit! Topics include: The  ms-ds-machineaccount-quota  value is not an "all or nothing" option! Check out  Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > User Rights Assignment...

Today we revisit a series we haven't touched  in a long time  all about eating the security dog food. TLDL about this series is I often find myself preaching security best practices, but don't always follow them as a consultancy. So today we talk about: How the internal 7MS infosec policy development is coming along Why I'm no longer going to be "product agnostic" going forward Some first impressi...

Hey friends! Today we're giving you a first impressions episode all about  Airlock Digital , an application allowlisting solution. They were kind enough to let us play with it in our lab with the intention of exploring its bells and whistles, so we're excited to report back our findings in podcast form. TLDL: we really like this solution! It is easy to deploy (see  this YouTube video  for a quick...

In today's episode we share some tips we've picked up in the last few weeks of pentesting, with hopes it will save you from at least a few rounds of smashing your face into the keyboard. Tips include: If you find yourself with "owns" rights to a bajillion hosts in BloodHound, this query will give you a nice list of those systems, one system per line: cat export-from-bloodhound.json | jq '.nodes[]....

Today we're so excited to welcome  Amanda Berlin , Lead Incident Detection Engineer at  Blumira , back to the show (did you miss Amanda's first appearance on the show?  Check it out  here )!  You might already be familiar with Amanda's awesome  Defensive Security Handbook  or her work with the  Mental Health Hackers  organization.  Today we virtually sat down to tackle a variety of topics and ques...

Today's episode covers three remediation-focused topics that kind of grind my gears and/or get me frustrated with myself. I'm curious for your thoughts on these, so reach out via  Slack  or  Twitter  and maybe we'll do a future  live stream  on this topic. How do you get clients to actually  care  when we explain the threats on their network that are a  literal  10/10 on the CVSS scale? Password p...

Hey friends, today we share the (hopefully) thrilling conclusion of  last week's pentest . Here are some key points: If you find you have local admin on a bunch of privileges and want to quickly loop through a secretsdump of ALL systems and save the output to a text file, this little hacky script will do it! #!/bin/bash File="localadmin.txt" Lines=$(cat $File) for Line in $Lines do echo --- $Line...

Ok, ok, I know.  I almost always say something like "Today is my favorite tale of pentest pwnage."  And guess what?  Today  is  my favorite tale of pentest pwnage, and I don't even know how it's going to end yet, so stay tuned to next week's (hopefully) exciting conclusion.  For today, though, I've got some pentest tips to hopefully help you in your journeys of pwnage: PowerHuntShares  is awesome...

Hey friends, wow...we're up to  thirty-nine  episodes of pwnage? Should we make a cake when we hit the big  4-0 ?! Anyway, today's TLDL is this: If you get a nagging suspicion about something you find during enumeration, make sure to either come back to it later, or exhaust the path right away so you don't miss something! Because I did :-/ A tip that's been helping me speed along my use of  CrackM...

Today we're joined by some of our friends at Arctic Wolf - Eugene Grant and Christopher Fielder - to talk about compliance. Now hold on - don't leave yet! I know for many folks, compliance makes them want to bleach their eyeballs. But compliance is super important - especially because it is  not  the same as being secure. So we discuss the differences between security and compliance, and practical...

Hey friends, we have another fun tale of pwnage for you today. I loved this one because I got to learn some new tools I hadn't used before, such as: Get-InternalSubnets.ps1  - for getting internal subnets Adalanche  for grabbing Active Directory info (similar to SharpHound) This tool worked well for me with this syntax: adalanche-windows-x64-v2022.5.19.exe collect activedirectory --domain victim.d...