Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Andy Robbins Profile picture
@_wald0
May 13, 2021 • 8 tweets • 4 min read • Read on X
Scrolly
(1/n) The other day, @JulioUrena asked a great question in the BloodHound Slack:

"How can I determine which Group Policies apply to members of a certain group?"

We can use #BloodHound to answer this question, but I want to explain the moving pieces here as well
(2/n) Group Policy can't be applied directly to security groups, except when using SID filtering and linking the Group Policy correctly. SID filtering on GPOs is not very common, so #BloodHound doesn't currently model that.

We can still use #BloodHound to figure this out though
(3/n) Take for example this security group -- real data so labels are hidden (left CTRL in BloodHound GUI). This group has 7 users in it, but because it has a group added to it...
(4/n) ...there are actually many more users effectively joined to this group:
(5/n) Group Policies are linked to containers, so let's find out where these users live in the OU tree structure:
(6/n) Last step: let's find which GPOs are linked to any container in this structure:
(7/n) The best part of all this? The cypher for this query is *very* simple, and @neo4j completes the query in milliseconds:
(8/8) Read more about how Group Policy works here: wald0.com/?p=179 - with special thanks to @grouppolicyguy.
Join the #BloodHound Slack here: bloodhoundgang.herokuapp.com

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Andy Robbins

Andy Robbins Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @_wald0

Andy Robbins Profile picture
Feb 17, 2023
This week I added 5 new functions to #BARK. A quick thread explaining each one with examples:
Get-ServicePrincipalOwner

List the current owner(s) of a specified #Azure AD Service Principal.

Example:
New-ServicePrincipalOwner

Add a new owner to an AAD Service Principal. Owners can add credentials to SPs and then auth as them.

Example:
Read 8 tweets
Andy Robbins Profile picture
Feb 16, 2023
Azure App Service Web Apps are yet another #Azure service that supports managed identity assignments.

Here's how attackers can use #BARK to abuse those assignments: Image
There are at least 3 ways to achieve code execution on an Azure App Service Web App ("Azure Web App" from here on) instance:

1. The Kudu shell execution API endpoints
2. Poison deployment to include a web shell in the app
3. Find a cmd execution vulnerability in the deployed app
We'll focus on #1 - abusing the built-in Kudu shell execution endpoints.

This is the feature the Azure GUI uses as its "Debug Console" and is documented here: github.com/projectkudu/ku…

@kfosaaen discussed this in his August 2020 blog post here: netspi.com/blog/technical… Image
Read 9 tweets
Andy Robbins Profile picture
Feb 4, 2023
Interest check: should I continue developing this research? Read my notes here and please let me know if you think this is worth pursuing further.

Problem: attackers have been moving their C2 channels to legitimate services to evade detection, slip through block lists, etc.
Examples:

github.com/boku7/azureOut…
3xpl01tc0d3r.blogspot.com/2020/03/introd…

Defenders and vendors have to play catch-up whenever one of these novel C2 methods becomes popular.
I believe it's possible to proactively, semi-automatically discover these methods in existing and emerging cloud services. We can assess their attractiveness to attackers, vendors can make them less attractive and prioritize their own detection efforts.

How?
Read 15 tweets
Andy Robbins Profile picture
Sep 20, 2022
#Azure Managed Identity assignments are "secure by default."

Dangerous attack paths can emerge around these assignments.

Here's those attack paths emerge, how attackers abuse them, and how defenders can eliminate them: 🧵
First we should understand what Managed Identities are. I think the best way is to understand the problem they are designed to solve.

We have a great recent example of this problem from the alleged Uber breach, where a PowerShell script may have been storing plain text creds:
This problem is not new and not surprising to many people:
Read 25 tweets
Andy Robbins Profile picture
Sep 13, 2022
Tiered Administration is among the strongest security controls that exist.

But the vast majority of organizations do not use it.

Here is how you can get started using Tiered Administration TODAY in your #Azure environments: 🧵
First, understand the problem we are trying to solve with Tiered Administration:

Tiered Administration protects your most privileged assets from compromise in the event that less privileged assets are compromised.

It's the wombo combo of least privilege and defense in depth.
Do Tiered Administration effectively and you DRAMATICALLY reduce risks posed by ransomware actors, insider threats, etc.

Most efforts get stuck in the very first step: identifying which assets go into which tiers.

Here's how you do this:
Read 11 tweets
Andy Robbins Profile picture
Aug 25, 2022
How to prevent Kerberoasting:

Kerberoasting is an incredibly powerful and reliable attack against Active Directory. In some situations it can result in an attacker becoming Domain Admin nearly instantaneously.

Here's how to prevent this attack: 🧵 Image
First we need to identify Active Directory users that are "kerberoastable" - possible targets for the attacker to choose to Kerberoast.

Kerberoast relies on a user having some value in their "serviceprincipalnames" attribute.

Find all of them instantly with no 3rd party tools:
dsquery has been built in to Windows Server since Server 2008. You also get it when installing RSAT.

Here's the command:

dsquery * "dc=contoso,dc=com" -filter "(&(objectcategory=user)(servicePrincipalName=*))" -attr distinguishedName servicePrincipalName
Read 12 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us!

Send Email!

:(