7 Minute Security

Today we're featuring a great interview with Matthew Warner, CTO and co-founder of  Blumira . You might remember Matt from such podcasts as  this one ) when Matt gave us a fountain of info on why out-of-the-box Windows logging isn't awesome, and how to get it turned up to 11! Today, we talk about a cool report that Blumira put out called  2022 Blumira's State of Detection & Response , and dive int...

In today's episode, I try to get us thinking about our extended family's emergency/DR plan. Why? Because I recently had a close family member suffer a health scare, and it brought to light some questions we didn't have all the answers for: Do we have creds to log onto his computer? How about his email accounts? Do we have usernames/passwords for retirement accounts, bank accounts, etc.? For vehicl...

In today's episode we talk about  Purple Knight , a free tool to help assess your organization's Active Directory security. I stuck Purple Knight in our  Light Pentest LITE pentest training lab  and did an informal compare-and-contrast of its detection capabilities versus  PingCastle , which we talked about in depth in  episode #489 . 

Today's another fun tale of pentest pwnage - specifically focused on cracking a hash type I'd never paid much attention to before:  cached domain credentials . I also learned that you can at least partially protect against this type of hash being captured by checking out  this article , which has you set the following setting in GPO: Under  Computer Configuration > Policies > Windows Settings > Se...

Today we're sharing an updates to  episode #512  where we ran Rapid7's  InsightIDR  through a bunch of attacks: Active Directory enumeration via  SharpHound Password spraying through  Rubeus Kerberoasting and ASREPRoasting via  Rubeus Network protocol poisoning with  Inveigh . Looking for a free way to detect protocol poisoning? Check out  CanaryPi . Hash dumping using  Impacket . I also talk abou...

I'm extra psyched today, because today's episode (which is all about updating your VMWare ESXi version via command line) is complemented by  video : https://www.youtube.com/watch?v=0-XAO32LEPY Shortly after recording this video, I found  this awesome article  which walks you through a different way to tackle these updates: List all upgrade profiles: esxcli software sources profile list --depot=htt...

Well friends, it has been a while since we talked about Microsoft's awesome  Local Administrator Password Solution  - specifically, the last time was  way back in 2017 ! Lately I've been training some companies on how to install it by giving them a live walkthrough in our  Light Pentest LITE  lab, so I thought it would be a good time to write up a refreshed, down and dirty install guide. Here we g...

Hey friends, a while back in  episode #505  we talked about pwning wifi PSKs and PMKIDs with Bettercap. Today I'm revisiting that with even some more fun command line kung fu to help you zero in on  just  the networks you're interested in and filter out a bunch of noisy events from  bettercap in the process.

Hey friends! Today's another swell tale of pentest pwnage, and it's probably my favorite one yet (again)! This tale involves  resource based constrained delegation , which is just jolly good evil fun! Here are my quick notes for pwning things using RBCD: # From non-domain joined machine, get a cmd.exe running in the context of a user with ownership rights over a victim system: runas /netonly /user...

Hey friends, today we're giving another peek behind the curtain of what it's like to run a cybersecurity consultancy. Topics include: Setting the right communication cadence - and communication channels - with a customer during a pentest. Tips for collaborating well with contractors so that the customer experience feels like "a single human pane of glass" (insert barf emoji here). How we're using ...

Hey friends, it's another fun tale of pentest pwnage today! This one talks about cool things you can do when you have full rights over an OU in Active Directory. Important links to review: BloodHound edges DACL Trouble: Generic All on OUs AD prep bug in Windows Server 2016

Today we're pumped to share a featured interview with  Amanda Berlin , Lead Incident Detection Engineer at  Blumira . You might already be familiar with Amanda's awesome  Defensive Security Handbook  or fine work with  Mental Health Hackers . We polled our  Slack  friends and structured this interview as an AAA (Ask Amanda Anything). That resulted in a really fun chat that covered many things tech...

Today we're continuing a series we haven't done in a while (click  here  to see the whole series) all about building and deploying pentest dropboxes for customers. Specifically, we cover: Auto installing Splashtop This can be done automatically by downloading your  splashtop.exe  install and issuing this command: splashtop.exe prevercheck /s /i confirm_d=0,hidewindow=1,notray=0,req_perm=0,sec_opt=...

In today's episode I talk about a cool  self-defense class  I took a while ago which was all about less lethal methods of protecting/defending yourself. I also talk about some safer ways to handle/hide cash while traveling on vacation.

Today we continue the series we started a few years ago called Security Your Family During and After a Disaster (the last part in this series was from  a few years ago . In today's episode we focus on some additional things you should be thinking about to strengthen the "in case of emergency" document you share with your close friends and family.

Welcome to another fun tale of pentest pwnage! This one isn't a telling of one single pentest, but a collection of helpful tips and tricks I've been using on a bunch of different tests lately. These tips include: I'm seeing nmap scans get flagged a bit more from managed SOC services. Maybe a "quieter" nmap scan will help get enough ports to do a  WitnessMe  run, but still fly under the logging/ale...

Today we're joined by our friends Christopher Fielder and Jon Crotty from Arctic Wolf to talk about their interesting report on  The State of Cybersecurity: 2022 Trends  (note: you can get some of the report's key points  here  without needing to provide an email address). The three of us dig in to talk about some of the report's specific highlights, including: Many orgs are running the bare minim...

Today I'm sharing some first impressions of the Rapid 7  InsightIDR  as kind of a teaser for an eventual new chapter in our  Desperately Seeking a Super SIEM for SMBs  series. Disclaimer: remember these are  first impressions . There may be some missed detections I talk about today that are a  me  problem and not the technology. I hope to get to the root of those unresolved issues by the time I ta...

Today we're continuing our series focused on [owning a security consultancy], talking specifically about: How  not  to give up on warm sales leads, even if they haven't panned out for 5+ years! Some cool Mac tools that help me manage 7MS - such as  Craft  and  OmniFocus A sneak peek at a SIEM vendor that will soon be featured in an episode of  Desperately Seeking a Super SIEM for SMBs  

Today we share some first impressions of  Tailscale , a service that advertises itself as "Zero config VPN. Installs on any device in minutes, manages firewall rules for you, and works from anywhere." Is it really  that  cool and easy? Listen to today's episode to find out!

Today we revisit our  phishing series  with a few important updates that help us run our campaigns more smoothly, such as creating a simple but effective fake O365 portal, and being aware that some email systems may "pre-click" malicious links before users ever actually do.

Hey friends! We have another fun test of pentest pwnage to share with you today, which is kind of tossed in a blender with some first impressions of  ShellcodePack . We were on a bunch of pentests recently where we needed to dump credentials out of memory. We usually skim  this article  and other dumping techniques, but this time nothing seemed to work. After some discussion with colleagues, we we...

Today's featured interview is with Matthew Warner, CTO and co-founder of  Blumira . We had a great chat about why out-of-the-box Windows logging isn't super awesome, "free" ways to get logging turned up to 11 ( Microsoft's audit policy recommendations ,  sysmon ,  sysmon modular ), as well as how to get better logging in hard-to-reach places like  Kerberos . Be sure to also check out Blumira's res...

Today's my favorite tale of pentest pwnage (again)! This time we're talking about  sAMAccountName spoofing  specifically. We also talk about my always-under-construction list of things I try early in a pentest for maximum pwnage: Run  PingCastle Do the SharpHound/BloodHound dumps Run the DHCP poisoning module of  Responder Check the  ms-DS-MachineAccountQuota  value in the domain - if its at the d...

Hey friends, today I talk about the old school way I used to pwn wifi networks, then a more modern way, and then my new  favorite  way (spoiler alert: I use  Bettercap ).