IR Leader @Mandiant. Hacking things and responding to things being hacked. Opinions my own
Joined February 2018
- Tweets482
- Following110
- Followers2.5K
- Likes327
Pinned Tweet
🚨🚨 New technique to steal AD FS secrets over the network. Defenders need to block internal traffic to AD FS servers over port 80 now!
Read more: fireeye.com/blog/threat-rese…
shoutout to @DrAzureAD who had the same though to look into AD FS replication and all his great work! 1/3
What is old is new again. Very cool work from @TrustedSec team! Highlights the importance of understanding what a vendor means when they use the word “patch”
Today, TrustedSec is releasing #Specula (our previously internal framework) into the world, which will transform the Outlook email client into a beaconing C2 agent. @oddvarmoe and @freefirex2 walk through how to use Specula in our latest blog! hubs.la/Q02JfFFN0
Great news for DFIR 🕵️ Except! These logs won’t be searchable from the Unified Audit Log for E3 licensees unless you manually toggle auditing for every mailbox in your tenant… 💀🤦🏽♂️ @Microsoft365 likes to make things difficult
learn.microsoft.com/en-us/pu…
#DFIR
For those who were waiting for the additional logging and events to be available in the standard audit logging in Microsoft 365, like MailItemsAccessed, they should be available now in public preview for you - techcommunity.microsoft.com/…
Audit log query graph API for @Microsoft365 rolling out in May. Has anyone found the actual documentation for the new API? Asking for a friend 💀#m365 #DFIR
Doug Bienstock retweeted
"Microsoft Signed my Malware"
Doug Bienstock (@JWilsonSecurity), Mandiant
Jared Wilson (@doughsec) , Mandiant
Barry Vengerik (@BarryV), Mandiant 14/15
🚨 NetScaler vulnerability CVE-2023-4966 is being actively exploited. It can lead to VDI session hijacking, including MFA bypass. There are no logs on the appliance to monitor for exploitation. Upgrade now and investigate your environment!
mandiant.com/resources/blog/…
#DFIR
Today we launched a 🔎 scanning tool for orgs to search their Citrix netscalers for evidence of CVE-2023-3519 post-exploration. You can run this direct on the ADC or against a forensic image. With public POCs out there expect more exploitation!
mandiant.com/resources/blog/…
#DFIR
😡 Is it me or is the @msftsecurity Defender for Cloud Apps API completely broken? Documentation is wrong, api behaves erratically.. ignores filters doesn’t page, etc
#dfir #Microsoft365 #cloudsecurity
Does anyone know what happens when you mix @Microsoft365 licenses? E.g. AAD free and Premium? Will sign-ins for some users actually retain for only 7 days?
#dfir #Microsoft365
👏🏽👏🏽💪🏽
Folks, today we are launching the 'App instance lock 🔐' public preview.
This feature will block the tampering of multi tenant apps by attackers.
learn.microsoft.com/azure/ac…
Remember Solorigate? This helps ISVs and customers protect themselves from the app hijack.
How?🧵👇
ALT Screenshot of app instance lock
The alternate title was "What's attestation signing? It's about certs, it's about trust babe"
A Microsoft-signed malicious driver we discovered during an IR turned up quite a bit more badness after some hunting by our threat intel team:
mandiant.com/resources/blog/…
#dfir @Mandiant
Testing out @azuread Authentication Strength Conditional Access.. what am I doing wrong here? All conditions satisfied but policy result fails, love it
#Microsoft365
🙀 ADFS Malware hot off the presses attributed to #NOBELLIUM / #APT29
Instead of Golden SAML why not embed code to look for a magic value during claims processing that allows you to obtain a Security Token for any user and add in an MFA claim to boot?
#DFIR
Microsoft has discovered a post-compromise capability we’re calling MagicWeb, which the threat actor tracked as NOBELIUM is using to maintain persistent access to environments they have compromised. In-depth technical analysis and hunting guidance here: msft.it/6016jeB4i
Dropping some 🔥APT29 observables this afternoon. Updates to our AADInvestigator and white paper too!
mandiant.com/resources/apt29… APT29 continues to up their opsec game 🥷 targeting #Microsoft365 #DFIR
Continued innovation in opsec makes APT29 one of the hardest groups to track. They seem to know more about Microsoft 365 than most and can blend their activities with standard admin actions in your org.
Our investigator script attempts to highlight common “dual use” activities favored by APT29
github.com/mandiant/Mandiant…
