@detectdotdev
 Rhode Island, USA
blog.detect.dev
Joined July 2022
  • Tweets85
  • Following111
  • Followers230
Long-awaited parallel (threaded) queries arrive in MSTICPy! 🏃‍♀️🏃‍♀️🏃‍♀️ Split big queries into separately executing chunks or across multiple workspaces and clusters.
msticpy@msticpy25 Jul 2023
MSTICPy 2.6.0 released - Parallel queries for multiple instances of MS Sentinel workspaces and Kusto clusters - Parallel split queries (large time-range queries divided by smaller time periods) - Velociraptor data provider for querying exported data sets github.com/microsoft/msticpy…
4
12
1,615
🚨Small update for TokenTacticsV2 ▫️Two new device platforms ▫️Linux, since it's now supported by Conditional Access ▫️OS/2, because it's not 😁 github.com/f-bader/TokenTact…

GitHub - f-bader/TokenTacticsV2: A fork of the great TokenTactics with support for CAE and token...

A fork of the great TokenTactics with support for CAE and token endpoint v2 - f-bader/TokenTacticsV2

github.com
3
22
61
10,087
Official confirmation from Microsoft that there is no supported way to rotate nor change DPAPI backup keys! Compromised keys? ➡️ Burn the domain and rebuild a new one 💥
This Post is from an account that no longer exists. Learn more
7
85
7
257
70,080
I know a lot of excellent people are looking for jobs right now. We have several openings at @redcanary, including my peer, Senior Director of Detection Engineering, and a Threat Hunter on a team I lead. I hope you'll consider applying or sharing. redcanary.com/job-openings/
7
140
4
304
66,100
ryan mc retweeted
Dirk-jan
@_dirkjan8 Jun 2023
Small update to roadtx, with thanks to @Flangvik for the idea: you can now do the interactive authentication with a "borrowed" ESTSAUTHPERSISTENT cookie from a browser, to get tokens or have an authenticated browser session.
7
63
2
205
36,484
ryan mc retweeted
nyxgeek
@nyxgeek6 Jun 2023
New blog is out! OneDrive to Enum Them All trustedsec.com/blog/onedrive… Major updates: • database storage • logging of previous runs • easily append digits or strings to usernames • stale job detection • skip tried usernames Special thanks to @DrAzureAD and @thetechr0mancer!

OneDrive to Enum Them All

THIS POST WAS WRITTEN BY @NYXGEEK Greetings fellow hackers, Today we'll be diving into the topic of user enumeration via OneDrive. In short, OneDrive can…

trustedsec.com
3
124
5
258
42,246
Replying to @Secureworks
@Secureworks' latest Threat Analysis report "Tampering with Conditional Access Policies Using Azure AD Graph API" out now! 1️⃣ Regular users can read Conditional Access Policies (CAPs) 🤔 2️⃣ Administrators can modify CAPs without proper logging 😲 secureworks.com/research/tam… #IWorkForSecureworks
1
27
75
7,982
This Friday I'll be running an #AzureAD token workshop in @NorthSec_io conference, Montreal, Canada. Here are some teasers 😋 nsec.io/schedule-workshop/
1
7
47
6,938
Next version of #AADInternals will be published during the @BlackHatEvents #BHAsia on May 11th at #BHArsenal! Some teasers: ◾ Exploitation tooling for findings covered in our Briefings talk with @SravanAkkaram 😈 ◾ Totally re-written token handling 🤞 ◾ Automatic FOCI client handling (thx to @detectdotdev) 🔥
1
8
2
74
15,835
Into Windows security / forensics? I just released a post I started writing 3 years ago: blog.christophetd.fr/dll-unl…

Hiding in Plain Sight: Unlinking Malicious DLLs from the PEB - Christophe Tafani-Dereeper

In this post, we take a look at an anti-forensics technique that malware can leverage to hide injected DLLs. We dive into specific details of the Windows Process Environment Block (PEB) and how to...

blog.christophetd.fr
2
38
89
9,026
I've long been interested in how EDRs work under the hood and how we can apply a more evidence-based approach to evasion. I'm happy to announce that I've written a book covering these topics with @nostarch which is now available for preorder 🎉 nostarch.com/book-edr

Evading EDR

A guide to understanding the attack-detection software running on Microsoft systems, and how to evade it.

nostarch.com
45
328
22
1,108
154,282
This quarter @Secureworks had two researchers in the @msftsecresponse researcher leaderboard🔥 Congratulations to all other researchers who made it, great job everyone! My colleague @SantasaloJoosua have had a fantastic streak this year keeping us all safe - so proud of working with him ❤ msrc.microsoft.com/leaderboa… #WeWorkForSecureworks
1
7
41
10,494
New chapter of #AzureAD Attack & Defense Playbook: Are you looking for a way to track and verify your identity security posture? @samilamppu, @PitkarantaM and I have worked on a solution which includes also comparison to recommendations and #MITRE mapping. github.com/Cloud-Architekt/A…
48
1
132
18,830
I'll deliver a workshop, "Tokens, everywhere!" at @NorthSec_io, Montreal 🇨🇦 in May! In this hands-on deep-dive, I'll cover #AzureAD #OAuth implementation, different token types, #FOCI, and various attack scenarios. Check out details and get tickets at nsec.io
1
3
19
3,690
Check out this new doc that lists all the 🍪 cookies involved in an Azure AD authentication. 😀 learn.microsoft.com/azure/ac…
Screenshot of Azure AD cookies.

ALT Screenshot of Azure AD cookies.

4
113
4
380
37,853
Our latest full-length episode is available! @olafhartong was kind enough to join us again after a few years and catch up - catch the episode wherever you consume podcasts, or at the YouTube link below! youtu.be/47pwrsMucSg
6
2
19
12,291
If you are a user of Microsoft Defender for Endpoint or are considering it you might find this series useful. A 🧵 The first edition covers the differences between #MDE and #Sysmon and telemetry acquisition 1 - Sysmon vs Microsoft Defender for Endpoint medium.com/falconforce/sysmo…
9
174
6
684
87,832
⚡️MSTICpy is a powerful python library for threat intelligence and threat investigation! I created a new security artwork for a brief overview. Learn more with @ianhellen & @PeteABryan at BlueHat for an in-depth look. 🤓@msticpy #ThreatIntel #infosec #python @MsftSecIntel
85
1
223
28,101
📣 Speaker Announcement 📣 We’re thrilled to announce our first #BlueHat speaker, Nate Warfield @n0x08, Director of Threat Intelligence at Eclypsium. Nate's #BlueHat talk will discuss firmware vulnerabilities and mitigation. 👏
BlueHat 2023: Meet Our Speakers 0-Day firmWarez Nate Warfield Direct of Threat Intelligence | Eclypsium Microsoft BlueHat: February 8-9, 2023 | Redmond, WA

ALT BlueHat 2023: Meet Our Speakers 0-Day firmWarez Nate Warfield Direct of Threat Intelligence | Eclypsium Microsoft BlueHat: February 8-9, 2023 | Redmond, WA

1
13
1
32
9,826
Update on #AzureAD Attack & Defense Playbook: @samilamppu and I have added new attack scenarios on #RefreshToken replay from our latest research: - Decrypted HTTPS traffic from #Azure PowerShell - Replay RT from Edge browser on compliant device 🔗Link: github.com/Cloud-Architekt/A…
36
108
8,725
Load more