Awesome way of getting really comprehensive local admin and session data - fantastic work!
Just released SCCMHound! A BloodHound collector for SCCM. SCCMHound allows both attackers and defenders to construct BloodHound datasets using the vast
amount of information that is stored/retrievable through SCCM. Feel free to take it for a spin!
github.com/CrowdStrike/sccmh…
TESTIFY
PSA for Cybersecurity folk: Our co-workers are tired of being "tricked" by phishing exercises y'all, and it is making them hate us for no benefit.
I have many thoughts that won't fit in a (non-bluecheck) tweet, so you can find them here:
security.googleblog.com/2024…
l0ss retweeted
Here's the biggest solutions to all my shenanigans:
Require signing - for SMB and LDAP
Don't have unsupported OS's
Run Certipy in your environment and consult the SpecterOps ADCS whitepaper for solutions
Disable the NAA accounts and use Enhanced HTTPS
Go through all the Misconfiguration Manager repo and apply solutions where necessary
Restrict ability to add computer accounts to admins
Crawl your own shares with Snaffler
Check your GPO permissions to make sure users can't change stuff - same with logon scripts
Cease using deprecated protocols - I love'em!
Increase password length for users, despite what NIST says. NIST is wrong :P
Firewall and VLANs all the things
Practice least privilege on shares
l0ss retweeted
just walked past a guy talking on the phone and wearing the biggest pair of pants ive seen since the 1990s and heard him say "yeah im wearing them right now"
l0ss retweeted
John Clarke and Bryan Dawe sketch:
“So you’re unhappy about this poster”
“That’s right Bryan, it says ‘From the river to the sea’. That’s a call for genocide Bryan.”
“So where are Israel’s borders now?”
“From the river to the sea Bryan”
“Is that genocide?”
“Of course not Bryan.”
l0ss retweeted
Australia’s abstention from the United Nations vote on the protection of civilians and upholding international legal and humanitarian obligations in the Israel/Palestine conflict is deplorable and deeply sad.
That should be a given.
l0ss retweeted
“The only thing that was keeping me online for the past few years was they were worried it would make China look bad if they cracked down on me. Now that they know that I could be dead in a ditch and no one would say a word I’m 1000x less safe here.” hackingbutlegal.com/naomi-wu…
l0ss retweeted
Something tells me that the thousands of McDonald’s employees aren’t taught l how to make a “McGangBang” but told not to talk about it
This looks SUPER cool. Can’t wait to take it for a spin!
Hey😊
I'm sure you all know Group3r (@mikeloss ) and know it's an excellent and useful tool!
To make the exploration more enjoyable, I created GUI for Group3rs log.
Have Fun 😋
#GroupPolicy #activedirectory
github.com/sap8899/Group3rEx…
l0ss retweeted
I really want everyone to pivot back from video. I fucking hate video. Do not ever make me watch a video just to obtain information. Making me watch a video instead of giving me text I can read is an act of violence against me specifically. When will it end.
From the top: Snaffler not Snaffle, they didn't mention @sh3r4_hax , it isn't an AD audit tool, it doesn't help with "collection analysis and reporting" of pentest data, it's still not called snaffle, it's not especially user friendly, it doesn't collect network and system (1/n)
This quoted post is unavailable.
Wanna do pretend crimes with me (and other, more exciting people) at CrowdStrike? We're hiring for a Senior Red Team Consultant in APJ. Here's the ad, DM me with questions - replies may take a couple of days. linkedin.com/jobs/collection…