ʇıq retweeted
I’ve always wanted to build a game, and with the help of AI and Apple’s latest technologies, I’ve finally made it happen with ThreatHunter: Bad Apples. It’s a mobile game focused on macOS security challenges, where you explore cities, investigate cases, and outsmart the bad apples. I’ll keep adding new cities and challenges over time, and I’m always open to suggestions and feedback! give it a try on the App Store and let me know what you think :)
apps.apple.com/us/app/threat…
#ios #ipados #appstore #game #cybersecurity #macos
ʇıq retweeted
I've just built and released a free tool: dbsc.dev
Now you can check if your browser supports Device Bound Session Credentials!
scotthelme.co.uk/introducing…
ʇıq retweeted
Great post and thank you for sharing this because it's really important.
#1 Always revoke the signin as the first step.
Let's talk a bit about Sessions and Tokens. For defenders, it's helpful to understand a couple key concepts for response:
OAuth Access Tokens and Refresh Tokens can be used from machines or browser based applications. Most browser based apps use session tokens (cookies). In the case of Entra, a user opens an app in the browser and the browser redirects to Entra to pick up tokens to give to the app after you're authenticated. Then, the authorization to the app is determined by the configuration of the app resource. So, when you revoke a session token in Entra, the app authorization may stay available as it's determined by the how the app is configured to handle the session. In the case of non-Microsoft apps where Entra is the IdP, Entra doesn't directly revoke a session token issued by a 3rd party app which is usually configured in the app itself.
Let's take an example from my lab to make it a bit more clear. I have Atlassian set up with Entra SSO via SAML. Entra gives me tokens to access the app. Atlassian authentication policies will determine how long my session lasts after I login from Entra. I've hardened my Atlassian authentication policies to idle session timeout after 30 minutes and session lifetime to 1 day (I'm not showing my SAML SSO Authentication policy here but it is there and I have tested what I'm saying). The defaults for the Atlassian session lifetime was something crazy like 365 days if I recall correctly. So, technically, my session token survives an Entra reset of my signin because the Atlassian authentication policy determines the life of my session on the application side, which is how many organizations are set-up. Most organizations are not very good at following AAL2 NIST Standards for authentication in SSO. So, if I revoke my session in Entra, the session token for Atlassian will live on in my browser until the Atlassian session expires.
In Atlassian, you would need to do this:
Administration --> Directory --> Users --> select the user --> Security --> Devices --> Logout
From the same screen, be sure to revoke any API keys, enforce Atlassian MFA in Entra, and harden the Authentication policy.
Before you go copying the policy in the fisrt screenshot, I want you to notice something in the that is often overlooked. The mobile session policy is set to never expire. The minimum session time for mobile is 7 days.
For Microsoft apps, keep in mind that even after revoking the session in Entra for Microsoft apps, Access Tokens can continue to allow access to the Microsoft APIs for ~75 minutes after the reset. Not all services support CAE, and CAE app support can vary by cloud (e.g., differences between GCCH and commercial clouds).
If it were me, I would also force reset the password and force re-register all factors for MFA in Entra too.
The default inactivity period for a user's Primary Refresh Token (PRT) in Entra is 90 days. This means an actor with authentication material stored in a browser or device may be able to maintain access as long as that material continues to be refreshed; 90 days of inactivity would cause the PRT to expire. Most organizations don't change the default.
learn.microsoft.com/en-us/en…
The employee changed his Microsoft 365 password twice.
The attacker still logged back in.
That was the moment we knew we were not dealing with a normal stolen-password incident.
The first alert came from an impossible-travel sign-in. The employee had authenticated from Maryland, then the same account appeared from another country less than an hour later.
We reset the password.
Twenty minutes later, another suspicious session appeared.
So we reset it again and forced MFA re-registration.
The attacker came back.
At that point, I stopped looking at the account and started looking at the employee’s laptop.
Inside the Downloads folder was a file called:
Invoice_Viewer.exe
The employee remembered downloading it from a website that claimed he needed a special viewer to open an invoice.
Windows logs showed the file running at 9:14 AM.
Seconds later, it launched PowerShell in the background.
Then we found something else.
A scheduled task called MicrosoftEdgeUpdateCheck had been created on the machine.
The name looked legitimate enough to ignore if you were moving quickly, but it was not one of Microsoft Edge’s normal update tasks.
We also found an outbound HTTPS connection from the compromised host to an external IP address.
The file hash was submitted for malware analysis.
It came back as an information stealer.
That explained why changing the password had not solved the problem.
The malware had stolen browser data, including authentication cookies and active session information.
The attacker was not repeatedly discovering the employee’s new password.
They were reusing a session that had already been authenticated.
We revoked every active Microsoft 365 session, isolated the laptop from the network, removed the persistence, reset the credentials again, and rebuilt the endpoint.
The suspicious logins finally stopped.
A compromised account does not always mean the attacker still knows your password.
Sometimes you already changed the password.
The attacker is still inside because they stole the session.
ʇıq retweeted
The team at @Google developed the original Zero Trust idea with the Beyond Corp paper and implementation over a decade ago. See the next iteration of that model for the AI era - Beyond Zero
spawn-queue.acm.org/doi/10.1…
ʇıq retweeted
Google's latest BlackFile writeup reinforces two points I have been talking about a lot recently,
In the report they detail how UNC6671 was observed using scripts to harvest data from SharePoint and OneDrive. In one case, the actor accessed and downloaded over 1 million files.
Two things the article reinforced for me:
1: Volume/threshold-based detections for resource access are incredibly important.
What does abnormal resource access look like in your tenant? How many files should one user access in an hour? In a day? When does that activity stop looking like normal work?
2: The importance of having well-placed canary tokens in the productivity suite.
Attackers are going to search and pull data from the places users already work every day. SharePoint and OneDrive need canary tokens, not just logs waiting to be reviewed after the fact.
Detecting post-exploitation behavior is even more critical in this AI-assisted landscape.
ʇıq retweeted
Just added the DigiCert breach to my Breach Report Collection repo. The cause was a combination of social engineering, persistence, and misconfigurations. These types of reports are useful & rare. I recommend others to check it out: github.com/BushidoUK/Breach-…
ʇıq retweeted
My new blog post is released. It explains in detail how applications (App Registrations, Service Principals, MI) and their permissions really work, why they can introduce several subtle paths for privilege escalation, and presents my open-source tool designed to uncover them.
Do you know how Entra ID applications work?
What about the security mess they can bring and what they can quietly break?
New blog post on Entra ID application permissions, the audit nightmare they create, and QAZPT, our OSS tool built to make sense of it:
blog.quarkslab.com/auditing-…
ALT Auditing Azure permissions will make your head spin Use the QAZPT, Luke!
ʇıq retweeted
Introducing Combat Theater, a malware technique emulator built for blue teams, detection engineers and security researchers to perform testing and detection validation quickly and easily.
Check out the introduction blog to learn more!
combat.theater/blogs/introdu…
ʇıq retweeted
wow! alright… took 1h 57m, but the content is solid and thoroughly reviewed. built a free alternative AI red-team course with original content + hands-on Docker labs generated using pplx Computer. 0x4d31.github.io/airt/
ʇıq retweeted
Really cool blog about azure storage accounts by @Haus3c !
Although there is a lot of information missing in the logs, he suggests some solid KQLs for detections, and explains several attack methods 🔥
hausec.com/2025/12/15/azure-…
ʇıq retweeted
I fell down the Kubernetes security rabbit hole. So I wrote a deep-dive on attack techniques, detection engineering, and scripts to test everything in a lab. Shoutout to @GrahamHelton and @raesene for their previous work!
heilancoos.github.io/researc…
ʇıq retweeted
After Months of Development, FINALLY ready to share: Harden System Security🎉
✅ Complete System Hardening
✅ Security Posture Analysis
✅ All-in-One Toolkit
✅ Built-in Intune support for Scalability
✅ Beautiful Modern UI
✅ CLI support
github.com/HotCakeX/Harden-W…
#Cyber #Windows
ʇıq retweeted
I just released MFTool, an NTFS parser that builds an in-memory map of a volume, allowing you to:
- Read any file without opening a handle
- Get the contents of locked/deleted files (registry hives, pagefile.sys, etc)
- Perform fast, in-memory searches across the entire disk
🔗👇
ʇıq retweeted
Player weaponized_autism (@droogie1xp) has won the Phrack CTF!
CTF is 2 binary exploitation challenges containing realistic vulns across 2 different targets. It began on Aug 7 and remained unsolved until now. So 1337 😎
Keep playing - all who finish will get a special prize!
ALT Player weaponized_autism won the Phrack CTF
ʇıq retweeted
During a recent incident response case, we observed the following file access: \\localhost\C$\@ GMT-2025.06.21-10.53.43\Windows\NTDS\ntds.dit
This is a clever method of accessing a Volume Shadow Copy (VSS) snapshot. Many EDR and detection systems typically monitor for commands such as 'vssadmin list shadows', and may trigger alerts based on their use.
However, by leveraging the "Previous Versions" feature in Windows (see screenshot), attackers can select a snapshot, view its properties, and enter the '@ GMT' path directly in Explorer. This allows them to browse the snapshot's contents without needing to use the command line.
Because this technique doesn't rely on typical shadow copy commands, it may evade detection by your EDR or SIEM solution. You might want to test it in your environment to identify and close this potential detection gap 🦸♂️🦸♀️
ʇıq retweeted
What to do when missiles fell near your house? Chill out and write the blog post you wanted to write 5 month ago!🥳 Peace and love everyone!💕☮️
sapirxfed.com/2025/06/20/wha…
