Uncategorized

• Uncategorized

  • EMET - Consider keeping EMET for Windows 7 but prioritize upgrades to Windows 10 and Edge).
  • Here you go - dma-attack-on-windows-10.html)
  • Block Office macros
  • WEF
  • Preventing activation of OLE packages
  • GPO
  • (Microsoft ATA)
  • (Microsoft LAPS)
  • (KB2871997)
  • (Windows Firewall)
  • (including GPP)
  • PAWs
  • (FGPP)
  • LM/NTLMv1
  • Protected Users group
  • 111 Attacking EvilCorp Anatomy of a Corporate Hack
  • LDAP signing
  • SMB signing
  • Red vs Blue: Modern Active Directory Attacks & Defense
  • PowerView - Situational Awareness PowerShell framework
  • Offensive Active Directory with Powershell
  • Koadic - Koadic, or COM Command & Control, is a Windows post-exploitation rootkit
  • Beyond the Mcse: Active Directory for the Security Professional
  • BSides DC 2016 - PowerShell Security: Defending the Enterprise from the Latest Attack Platform
  • Six Degrees of Domain Admin... - Andy Robbins, Will Schroeder, Rohan Vazarkar
  • Advanced Incident Detection and Threat Hunting using Sysmon and Splunk
  • Real Solutions From Real Incidents: Save Money and Your Job!
  • AppLocker Bypass Techniques
  • From Workstation To Domain Admin - Why Secure Administration Isn't Secure
  • Exploiting AD Administrator Insecurities
  • How to go from Responding to Hunting with Sysinternals Sysmon
  • 111 Attacking EvilCorp Anatomy of a Corporate Hack
  • Real Solutions From Real Incidents: Save Money and Your Job!
  • ADSecurity
  • Harmj0y's blog
  • Use of PSExec
  • Preventing Mimikatz attacks
  • Useful list of Windows Security Log Events
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • From Kekeo to Rubeus
  • Windows oneliners to download remote payload and execute arbitrary code
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • these file types
  • Excel file extensions
  • LLMNR
  • WPAD
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Responder - A LLMNR, NBT-NS and MDNS poisoner
  • AD Control Path - Active Directory Control Paths auditing and graphing tools
  • Empire - PowerShell and Python post-exploitation agent
  • Mimikatz - Utility to extract plaintexts passwords, hash, PIN code and kerberos tickets from memory but also perform pass-the-hash, pass-the-ticket or build Golden tickets
  • Tools Cheatsheets - (Beacon, PowerView, PowerUp, Empire, ...)
  • UACME - Defeating Windows User Account Control
  • CrackMapExec - A swiss army knife for pentesting Windows/Active Directory environments
  • SharpSploit
  • Rubeus - Rubeus is a C# toolset for raw Kerberos interaction and abuses
  • SILENTTRINITY - A post-exploitation agent powered by Python, IronPython, C#/.NET
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • NetCease
  • Samri10
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • PowerShell logging
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • PowerShell logging
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • PowerSploit - A PowerShell Post-Exploitation Framework
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • BSides DC 2016 - PowerShell Security: Defending the Enterprise from the Latest Attack Platform
  • 111 Attacking EvilCorp Anatomy of a Corporate Hack
  • PingCastle - an Active Directory audit tool (and free!) with pretty good metrics.
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • PowerShell logging
  • Explaining and adapting Tay’s Sysmon configuration - config/blob/master/sysmonconfig-export.xml)
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • How to go from Responding to Hunting with Sysinternals Sysmon
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • these file types
  • Hardentools - Collection of simple utilities designed to disable a number of "features" exposed by Windows
  • Introducing SharpSploit: A C# Post-Exploitation Library
  • Rubeus - Rubeus is a C# toolset for raw Kerberos interaction and abuses
  • SMB signing
  • Excel file extensions