Tweet

This Thread may be Removed Anytime!

Twitter may remove this content at anytime! Save it as PDF for later use!

More from @malmoeb

Stephan Berger

@malmoeb

Oct 15

1/ "By using DoH, attackers can hide DNS queries from C&C domains.

If SSL/TLS traffic is not being inspected using man-in-the-middle (MitM) techniques, DNS queries to the C&C server will therefore go unnoticed."

[1] 🧵

#CyberSecurity

2/ I have been mentioning this topic in one of my presentations for quite some time (see slide above).

When DNS logs are recorded, analyzed, and evaluated, the use of DoH can lead to a blind spot. I assume that more TAs and malware authors will use this technique in the future.

3/ If possible, block the DoH resolvers on the proxy or firewall.

The curl GitHub repo provides a starter list of resolvers:
github.com/curl/curl/wiki…

Read 4 tweets

Stephan Berger

@malmoeb

Oct 11

1/ Perhaps a lesser known "feature" of Microsoft Authenticator, but the diagnostic data can be very helpful in investigating a compromised #Azure account where MFA is enabled but the user claims not to have confirmed the MFA Consent Prompt. 🧵

2/ You will find the diagnostic data here:

Authenticator App
▪️ Burger Menu
▪️ Send feedback
▪️ Having trouble?
▪️ View diagnostic data

Click "Copy all" and send the text via mail or other ways to your analysis device.

3/ When logging into an MFA protected (the second factor is the Consent Prompt) account, we see the following entries (abbreviated) in the Authenticator diagnostic data:

Read 10 tweets

Stephan Berger

@malmoeb

Oct 10

@rootsecdev

1/ @rootsecdev published a blog post where common misconfigurations inside the Conditional Access Policies in Azure are discussed.

In an Azure Tenant from a customer, the following CA policy was implemented: Require MFA for administrative users.

🧵

2/ However, within the Directory roles checkbox, not all the roles were selected (see the picture below).

In Azure Assessments, I use, among others, the script Get-MsolRolesAndMembers.ps1 to find users which are part of such different roles. [2]

3/ The users or roles found with the mentioned script must be cross-checked with the CA (the checked roles from the menu above) to find possible users which could log in without MFA, resulting in a security gap. 🔎

Read 10 tweets

Stephan Berger

@malmoeb

Oct 8

@Avast

1/ #ThreatHunting: @Avast has blogged how Roshtyak checks the VBAWarnings registry value.

If the value is 1 ("Enable all macros"), then the code will not be executed because it is assumed that this setting is only enabled in a sandbox (or by courageous users). 🧵 #CyberSecurity

2/ "Interestingly, this means that users, who for whatever reason have lowered their security this way, are immune to Roshtyak." [1]

3/ However, this "Enable all macros" value can also be explicitly set for Outlook

(Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook - Level = 1).

If this value is set to 1 in a user context, a nifty persistence within Outlook may have been set up by a TA.

Read 7 tweets

Stephan Berger

@malmoeb

Sep 28

/1 Repeat after me: AV scans and password change is not enough after a full AD compromise.

A company has already been encrypted twice and asked us for a second opinion. The responders did a password change with an AV scan of the machines...

What could possibly go wrong? 🧵

@UK_Daniel_Card

2/ @UK_Daniel_Card has compiled a good checklist that gives an insight into the many different tasks that are part of a proper IR engagement or clean-up (list not exhaustive):

pwndefend.com/2021/09/15/pos…

3/ Another point missing on the checklist is the hunting for "legitimate" remote desktop solutions installed by the TA, which could be used as a backdoor for re-entry (Atera, Splashot, AnyDesk..).

Read 4 tweets

Stephan Berger

@malmoeb

Sep 27

@newtt42

1/ While analyzing AutoRuns entries in a Compromise Assessment, my teammate @newtt42 found four executables with different names but with the same hash (in the C:\Windows directory).

The binaries were ran as services with the following names: JXds, vdEp, JXmM, PTLt. 🧵

@Synacktiv

2/ @Synacktiv has published a blog post recently where our observations are described:

"The SysInternals PsExec starts a service that is named PsExeSvc by default whereas Impacket's psexec.py tool spawns a process with a randomly generated 4-characters name." [1]

3/ We can hunt for such binary and service names using this sigma rule [2]:

ImagePath|re: '^%systemroot%\\[a-zA-Z]{8}\.exe$'
ServiceName|re: '(^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)'

Read 5 tweets

Share this page!

Stephan Berger

People who liked this thread also liked...

Try unrolling a thread yourself!

More from @malmoeb

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Stephan Berger

Did Thread Reader help you today?

Don't want to be a Premium member but still want to support us?

Send Email!