Tweet

More from @malmoeb

Stephan Berger

@malmoeb

Apr 23

#ThreatHunting:

1/ When examing AutoRuns entries during an IR or CA - would you consider a Scheduled Task with the name COMSurrogate and with the following launch string as malicious (spoiler: it is 😉)?

"powershell.exe" -windowstyle hidden

#CyberSecurity #dfir

@Malwarebytes

2/ @Malwarebytes has found out that the Colibri malware on Windows 10 systems (and up) drops a file called Get-Variable.exe in the path %APPDATA%\Local\Microsoft\WindowsApps.

3/ "It so happens that Get-Variable is a valid PowerShell cmdlet which is used to retrieve the value of a variable in the current console. Additionally, WindowsApps is by default in the path where PowerShell is executed. So when the Get-Variable command is issued on PowerShell

Read 7 tweets

Stephan Berger

@malmoeb

Apr 22

1/ Finding web vulnerabilities at scale: As part of a security team in a previous role, my job was, among other things, to find vulnerabilities in web applications. The environment had hundreds of (externally accessible) web applications, many of which had not yet been pentested.

2/ The goal was to quickly find as many low-hanging fruits, including SQLi and command injections, to prevent at least a beachhead by an attacker into the internal network.

We had the advantage of breaking up all the internet traffic and routing all the requests through a proxy.

3/ All URLs from the web applications we wanted to assess with all parameters were available within the proxy logs. This gave us in-depth coverage of the different applications with all paths and parameters (from the GET method).

Read 8 tweets

Stephan Berger

@malmoeb

Apr 22

1/ #Hardening: More and more attackers in ransomware cases are attacking the ESXi and vCenter infrastructure to encrypt a large part of the systems in a company within a short time.

2/ Once an attacker has gained access to a network, the captured credentials are used for logging into the vCenter infrastructure.

Removing ESXi and vCenter from Active Directory prevents compromised Active Directory accounts from being used to authenticate directly to the

3/ virtualization infrastructure. Authentication would need to happen directly on the relevant systems, and administrators must have dedicated accounts for logging in. These measures cannot prevent compromise but at least make it more

Read 4 tweets

Stephan Berger

@malmoeb

Apr 6

Real-World #PingCastle Finding #8: Non-admin users can add computers to a domain. A customer called us because he discovered two new computer objects. Such new computer objects can be a sign of more targeted attacks against the #ActiveDirectory.
1/8

#CyberSecurity #dfir

The computer names are relatively unique, and one quickly finds a GitHub repository with corresponding exploit code.

The code tries to exploit the two vulnerabilities CVE-2021-42278 and CVE-2021-42287 (from an authenticated user directly to DA).
2/8

github.com/WazeHell/sam-t…

Inside the exploit code, a new computer name is generated following the pattern SAMTHEADMIN-(random number from 1 to 100), precisely the naming scheme we see in the client's AD.
3/8

Read 8 tweets

Stephan Berger

@malmoeb

Apr 5

@pastebin

On a hacked GitLab server, we found a command in a cron job that was downloading code from @pastebin every 3 minutes and executing it (wget, curl.. | sh).

Interestingly, in the paste where we would have expected to find more code, there was only the shebang line present.
🧵(1/4)

At first, we thought the attackers made a mistake in the paste, which was "incomplete" (?). But the access numbers of the paste are high (over 200K) - and when we observed the access numbers over time, we found out that about 30 (hacked?) systems regularly download the paste.
2/4

@pastebin

After reporting the paste to @pastebin, the paste was removed - but was there any investigation of the accesses to identify hacked systems, from which IP ranges the paste was downloaded, to inform the companies or ISPs?
(3/4)

Read 4 tweets

Stephan Berger

@malmoeb

Mar 8

Many customers log process starts and executed programs in a SIEM, or have an EDR in use. Nevertheless, the question often arises: which product could one still buy? None at all! Best build-up detections with the existing logs. An example (🧵):

#CyberSecurity

@falconforceteam

#UACME (github.com/hfiref0x/UACME) lists a large set of UAC bypass techniques. Here is a (recent) overview of which techniques currently work and which do not: medium.com/falconforce/fa…

@falconforceteam

The file we use to bypass UAC is "Akagi64.exe" - either compile it yourself from the UACME repository or download it (at your own risk) from a public source. Use the upload task from #Covenant to upload the binary to the target host (given ofc that we already have a shell).

Read 14 tweets

Share this page!

Stephan Berger

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @malmoeb

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?