Share this page!

Stephan Berger Profile picture
Twitter logo
Mar 18 • 4 tweets • 3 min read
1/ Do you monitor newly created services within your environment, and would you notice when a (vulnerable) driver is loaded?

The screenshot below (#Velociraptor 🤩) is from a recent #XMRig CoinMiner investigation ⤵️

🧵 #CyberSecurity
2/ We talked about vulnerable drivers before:

3/ And here:

4/ And Florian covers vulnerable drivers with #Sigma rules here:

• • •

Missing some Tweet in this thread? You can try to force a refresh
　

Keep Current with Stephan Berger

Stephan Berger Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!

PDF

Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @malmoeb

Stephan Berger Profile picture
Mar 17
1/ #Velociraptor has covered hunting for malicious WMI Event Consumers for some time. [1]

However, Velociraptor does not provide an eradication hunt for malicious WMI Event Consumers out of the box.

🧵 #CyberSecurity
2/ @threatpunter wrote a detailed blog about WMI persistences and how to remove them.

"The simplest method to remove the entry from the WMI database is to use Autoruns. Launch Autoruns as an administrator and select the WMI tab to review WMI-related persistence." ✂️ Image
3/ "Alternatively, you can remove the WMI event subscriptions from the command line." [2] Image
Read 4 tweets
Stephan Berger Profile picture
Mar 15
1/ Number #10 of the #ActiveDirectory hardening measures:

Easy Wins (for Attackers)

🧵 #CyberSecurity
This is the last thread in this AD hardening measure series, but there would still be so much to discuss 😅

Here are more points you should focus on to defend your networks even better.
"Administrative accounts should never be enabled for delegation.

You can prevent these privileged accounts from being targeted by enabling the ‘Account is sensitive and cannot be delegated’ flag on them. You can optionally add these accounts to the ‘Protected Users’ group.
Read 11 tweets
Stephan Berger Profile picture
Mar 14
1/ Number #9 of the #ActiveDirectory hardening measures:

Relaying

🧵 #CyberSecurity
2/ There exists a ton of different techniques of how attackers can relaying credentials to another host in order to raise their privileges or get a shell on the target server.
3/ @TrustedSec has written an excellent blog post about the different relaying techniques, how they work and which prerequisites have to be in place that the attack is successful. [1]
Read 8 tweets
Stephan Berger Profile picture
Mar 13
1/ Number #8 of the #ActiveDirectory hardening measures:

Print Spooler Service

🧵 #CyberSecurity
2/ A running print spooler service on domain controllers is still a relatively common finding in our AD assessments, even though an attack path via spooler service and unconstrained delegations have been known for years. [1]

Screenshot below from #PingCastle (@mysmartlogon)
3/ Apart from the (older) attack technique with unconstrained delegations (see above), the printer spooler has had various critical vulnerabilities over the last two years. [3]
Read 8 tweets
Stephan Berger Profile picture
Mar 12
1/ Number #7 of the #ActiveDirectory hardening measures:

Harden critical accounts

🧵 #CyberSecurity
2/ To raise the bar again, add critical accounts to the Protected Users Security Group.

"This group provides protections over and above just preventing delegation and makes them even more secure; however, it may cause operational issues, so it is worth testing in your env." [2]
3/ Benefits:

1⃣ Credential delegation (CredSSP) will not cache the user's plain text credentials [..]

2⃣ Beginning with Windows 8.1 and Windows Server 2012 R2, Windows Digest will not cache the user's plain text credentials even when Windows Digest is enabled.
Read 8 tweets
Stephan Berger Profile picture
Mar 11
1/ Number #6 of the #ActiveDirectory hardening measures:

Privileges and Permissions

🧵 #CyberSecurity
2/ #PingCastle lists, among many other things, the privileges assigned to domain users via GPOs.

The screenshot shows that the Default Notebook Policy grants Domain Users the SeLoadDriverPrivilege privilege.

Why is this bad?
3/ As @0xdf put it:

"If I can load a driver, I can load a vulnerable driver, and then exploit it." [1]

I know that some EDR's raise an alert when a vulnerable driver is loaded or dropped to disk, as such a driver could be exploited for a LPE.
Read 13 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!

Ethereum

0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy

Bitcoin

3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!

Send Email!

:(