The Cyber Threat Perspective: Recent Episodes
Offensive Security
Step into the ever-evolving world of cybersecurity with the offensive security group from SecurIT360. We’re bringing you fresh content from our journeys into penetration testing, threat research and various other interesting topics.
Two pen testers have spent thousands of hours inside client networks, and the most common failure they see isn't a missing security product — it's an EDR nobody ever tuned.
In this episode, Spencer and Tyler open up the CrowdStrike Falcon console and walk through the specific settings that decide whether your team catches an attack or never sees it. They start with the story that kicked the whole thing off: Tyler running a pen test where every AMSI bypass gets blocked and detections fire left and right, while Spencer runs nearly identical tooling against the same product at another client and the SOC sees nothing all week. Same CrowdStrike. Same version. Different checkboxes.
From there it's a tactical walkthrough of Endpoint Security → Prevention Policies and the settings worth your attention: Enhanced Exploitation Visibility, which unlocks command-line and PowerShell telemetry that Microsoft disables by default; Enhanced DLL Load Visibility for side-loading attacks; WSL2 Visibility, which closes a sandbox threat actors have been using to run Kali tooling under the radar; memory scanning for in-memory C# tradecraft; Office malicious macro removal; file system containment for ransomware over SMB; vulnerable driver protection, the direct mitigation for BYOVD attacks and EDR killers; and cloud-based anomalous process execution for living-off-the-land binaries.
They also cover custom IOA rule groups for blocking unauthorized RMM tools, centralized firewall policy management, device policies for USB control, and a warning on exclusions — especially wildcard paths, which Tyler calls a threat actor's best dream.
The takeaway is simple: you're paying real money for EDR, and default configurations aren't giving you what you paid for. Open your console, work through the settings, test them against an IT pilot group, and enable what fits your environment.
TOPICS COVERED
- Why EDR vendors ship deficient defaults on purpose
- Enhanced Exploitation Visibility and the telemetry gap in PowerShell attacks
- DLL side-loading, WSL2 abuse, and vulnerable driver attacks
- Memory scanning and in-memory tooling detection
- Blocking RMM tools with custom IOA rule groups
- Exclusion hygiene and the wildcard path problem
- Device policies, USB blocking, and insider threat
Sentinel One and Defender for Endpoint are next — let us know what else you want covered.
Blog: https://offsec.blog
Work with us on an internal pen test: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Most cryptographic findings on your vulnerability report will never be exploited by a real attacker. So why do they keep showing up — and why should you still fix them?
In this episode of the Cyber Threat Perspective, Brad Causey and Jordan Natter break down OWASP Top 10 A04: Cryptographic Failures — the entry they openly call their least favorite on the list. They explain why SWEET32, BEAST, and the other scary-sounding named TLS vulnerabilities almost never translate into real-world compromise, why platforms like Security Scorecard and BitSight inflate their severity anyway, and where genuine cryptographic risk actually lives.
Jordan also walks through a real penetration test finding: a JSON Web Token signed with HS256, an exposed configuration backup sitting on the web server, and the signing secret that turned a standard user into an administrator.
In this episode:
- Why A04 dropped on the OWASP Top 10 without becoming less important
- The difference between exploitable risk, hygiene risk, and brand reputational risk
- An honest take on Security Scorecard and BitSight scores — what they measure, what they miss, and why a perfect score can coexist with a weak password policy and no MFA
- The two halves of A04: data in transit (TLS/HTTPS, integrity, tampering) and data at rest (secure storage of credentials, PII, and payment data)
- What a JWT actually is, and why pen testers love pulling them apart
- Real pen test story: exposed config backup → leaked JWT secret → signature tampering → privilege escalation to admin
- Broken server-side signature validation and other improperly implemented cryptography
- Why MD5 and SHA-1 still show up for password storage 20 years too late — and what to use instead (Argon2, scrypt, bcrypt)
- HSTS, secure renegotiation, and certificate expiration as A04 subcategories
- The coffee shop scenario: the full chain of conditions required to exploit SWEET32 — including roughly 250 GB of captured traffic — and why no one has ever documented it happening in the wild
- Why a decade-plus-old vulnerability in your environment says more about your vulnerability management program than about your crypto
- Quantum computing: how today's theoretical attacks may not stay theoretical
The takeaway: classify your data, choose modern algorithms, retire deprecated protocols, and keep a functioning vulnerability management program. Not because a threat actor is sitting in your local coffee shop waiting to derive your session key — but because leaving decade-old findings in place is a signal about everything else you might be missing.
Next up: OWASP A05, which Brad promises is way cooler than A04.
Blog: https://securit360.com/blog/
Podcast: https://securit360.buzzsprout.com/
YouTube: https://www.youtube.com/@SecurIT360
Contact: https://securit360.com/contact/
Have a topic you want us to cover? Send it our way.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Almost no one writes an application from scratch anymore, and that's exactly the problem. In Part 3 of our OWASP Top 10 series, Brad Causey and Jordan Natter break down A03: Software Supply Chain Failures, the category that climbed to #3 and topped OWASP's own community survey as the vulnerability organizations worry about most. If your team pulls in third-party libraries, buys SaaS, or lets anyone "vibe code" a project, this episode is for you.
Brad and Jordan cover both sides of supply chain risk: the trusted third-party applications you deploy (SolarWinds being the case that put this category on the map) and the open-source components you pull into your own code without always knowing what's inside. They explain why AI and vibe coding are accelerating the problem, why jQuery is the modern-day Flash, and why "just upgrade the package" is rarely that simple.
From there it gets practical:
- What a Software Bill of Materials (SBOM) is and why you need one
- Transitive dependencies — the packages hiding beneath your packages
- Building security checks into your CI/CD pipeline and shifting left
- Why a flaw caught in static analysis can cost ~$200, while the same flaw found in a pen test can cost $20,000+
- Why a pen test should validate your controls, not be your first line of defense
- How SecurIT360's Project Lantern and ChainGarde automate SBOM analysis against known and actively-exploited vulnerabilities
- A playbook for vetting vendors, writing accountability into contracts, and holding third parties responsible for actually fixing findings
The takeaway: whether you're writing software or buying it, you need a way to inventory your components, check them against known vulnerabilities, and hold your vendors accountable — and most of it you can do with tools and teams you already have.
Part 1 — Broken Access Control, IDOR & CORS: https://youtu.be/BwYJ-kZ3XaY
Part 2 — Security Misconfigurations: https://youtu.be/Po8H140BijE
Need a web app pen test? SecurIT360 | Cybersecurity From Every Angle
More content: https://offsec.blog
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, Spencer and Tyler discuss why deception is one of the best ways to catch threat actors.
Resources
- Spencer's Cyber Deception Webinar
- Spencer's X posts on the topic of cyber deception
- https://thinkst.com/, https://canary.tools/
- @_subtee on X, @haroonmeer on X
- https://tracebit.com/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Need a pentest or vCISO? Work with us! https://www.securit360.com/
A major leadership failure in Cybersecurity is l buying tools first then figuring out where they fit and how to use them. That’s super backwards. Here’s what I would do instead. Plan first, buy & implement second. I’m going to cover just the planning part this week. Next week we will talk about buying and implementing. Because honestly, implementation is where a lot of security teams go wrong.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode Spencer and Tyler discuss real life Active Directory attack paths, taken from real internal pentest engagements over the last several years.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Some of the most dangerous security gaps aren't sophisticated — they're the ones hiding in plain sight.
In this replay, Brad and Spencer break down the biggest blind spots they see over and over in mid-size companies: poor asset inventory, flat networks, flat identities, overconfidence in security tools, credential reuse, and the emerging risks with AI.
If any of these hit home, go to our website, fill out the form, and see if we're a fit for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
AI agents can search the web, manipulate files, run commands, make API requests, access cloud platforms, and operate fully autonomously. They are powerful, they are here, and most organizations have no security controls around them whatsoever.
In this episode, Brad and Spencer break down the five major AI agent risk categories security teams need to understand right now, using Simon Willison's "lethal trifecta" as a framework and building on it with two additional risk areas they see in the field.
In this episode:
- What an AI agent actually is and why the definition matters before you can secure it
- What AI agents are capable of: files, commands, APIs, memory, cloud access, and autonomous execution
- The lethal trifecta: access to private data, exposure to untrusted content, and external communication
- Risk category 1: Access to private data - why agents inherit your permissions and why that is dangerous
- Risk category 2: Exposure to untrusted content and prompt injection attacks
- Risk category 3: External communication and data exfiltration (including a real canary token experiment)
- Risk category 4: Privileged access and limiting blast radius with least privilege identities
- Risk category 5: Autonomous actions, approval gates, rate limits, and kill switches
- Why backups, rollback plans, and recovery playbooks are more important than ever in an AI agent world
Resources mentioned:
- Simon Willison's lethal trifecta post (June 2025): https://simonwillison.net
- Zach Korman's ContinuumCon sandbox escape workshop: https://continuumcon.com/schedule/
- offsec.blog | securit360.com
Need a pen test before end of year? Q3 slots are filling up fast.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Think Active Directory is dead? Think again. According to Microsoft data, 86% of organizational workloads still touch Active Directory, and nearly 20% of organizations don't expect to reach a hybrid state for 10-20+ years. In this episode, Brad and Spencer break down why AD attack paths remain one of the most critical threats in enterprise environments and what defenders can do about it right now.
Spencer also previews his ContinuumCon workshop "Killing AD Attack Paths Once and For All" where he demonstrates how authentication policies and silos can eliminate an entire class of lateral movement attacks built into Windows and Active Directory.
In this episode:
- Why Active Directory is still alive, well, and heavily targeted
- What an Active Directory attack path is and how attackers use them
- The four prerequisites attackers need to abuse AD attack paths
- Real-world examples: Kerberos ticket theft, SCCM abuse, certificate misconfigurations, and misconfigured permissions
- Tools defenders should know: Bloodhound, PingCastle, Purple Knight, Locksmith, and ADelegator
- How to prioritize remediations based on ease of exploitation vs. impact
- Why retesting is the most overlooked step in any remediation cycle
Resources mentioned:
- Spencer's ContinuumCon Workshop (Fri. June 12, 10:30am PT / 1:30pm ET): https://continuumcon.com/schedule/
- Hybrid Identity Protection Podcast (Semperis): https://www.semperis.com/hybrid-identity-protection-podcast/
- Bloodhound CE: https://github.com/SpecterOps/BloodHound
- PingCastle: https://www.pingcastle.com
- Purple Knight: https://www.purple-knight.com
- Locksmith: https://github.com/TrimarcJake/Locksmith
- offsec.blog | securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Security misconfiguration is one of the most frequently found vulnerabilities in web application pen testing — and most of the fixes are just a checkbox. In Part 2 of their OWASP Top 10 series, Brad Causey and Jordan Natter cover OWASP A05: Security Misconfiguration with real stories from recent engagements and practical takeaways for developers, security teams, and organizations of all sizes.
In this episode:
- Hardcoded Active Directory credentials and API keys discovered in a public GitHub repo during a healthcare pen test
- Default credentials (admin/1234) found on a clinical research app storing PHI
- A rogue Apache basic auth panel that survived from dev into production
- How verbose error handling and stack traces hand attackers a roadmap to your app
- Why dev-to-production is the most dangerous transition in your app's lifecycle
- The shift-left mindset and DevSecOps — empowering devs to ship secure code
- How CIS lockdown guides can dramatically improve your security posture overnight
Resources mentioned:
- OWASP Top 10: OWASP Top Ten Web Application Security Risks | OWASP Foundation
- CIS Benchmarks: https://www.cisecurity.org/cis-benchmarks
- Ep. 182 – OWASP Top 10 Part 1: https://youtu.be/BwYJ-kZ3XaY
Need a web application pen test? Reach out: Offensive Security - SecurIT360
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Hosts Brad Causey and Spencer Alessi break down the 2026 Verizon Data Breach Investigations Report, focusing on the findings that actually matter for IT and security teams.
The biggest surprise: vulnerability exploitation has overtaken stolen credentials as the top initial access vector, accounting for 31% of attacks, while credential abuse dropped to just 13%. This completely flips the script on years of "identity is the new perimeter" thinking.
Topics covered include:
- Vulnerability explosion and remediation crisis: Why there are too many vulnerabilities and not enough time for patching, with only 26% of CISA KEV vulnerabilities fully remediated (down from 38%)
- The patching time paradox: Median remediation time increased from 32 days to 43 days despite organizations initially getting faster at patching from 2022-2024
- Web application sprawl: How the push to cloud and SaaS has created massive attack surfaces organizations don't own and can't patch
- The top 4 initial access vectors: Vulnerability exploitation, phishing, credential abuse, and pretexting
- Ransomware economics shifting: 48% of breaches involved ransomware, but 69% of victims didn't pay and median payments dropped to $139,875
- Mobile phishing success: Mobile-centric phishing had 40% higher success rates than email phishing as users get better at spotting email threats
- Social engineering evolution: The human element appeared in 62% of breaches, with pretexting requiring different countermeasures than traditional phishing
- Shadow AI explosion: 45% of employees are regular AI users on corporate devices (up from 15%), with 67% using non-corporate accounts
- AI data exfiltration: Shadow AI is now the third most common non-malicious insider risk, with source code being the top data type leaked
- MCP and IDE extension risks: Real-world examples including PocketOS having their entire production database deleted by Claude connected to a railway CLI MCP
Brad and Spencer emphasize that while the threat landscape is shifting dramatically, the fundamentals still matter. Organizations need to get comfortable with not being able to patch everything and focus on what matters most.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
We're re-releasing one of our most practical episodes this week — originally published November 2025, and still one of the best roadmap conversations we've had on the show.
Brad and Spencer share no-fluff advice for breaking into cybersecurity, whether you're switching careers, starting from scratch, or leveling up from a general IT role. They cover what employers actually look for, the fastest paths in, and what to skip.
If you're exploring a cybersecurity career, or know someone who is, this one's for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Brad and Spencer break down Google Threat Intelligence Group's latest report on how adversaries are weaponizing AI across the entire attack lifecycle.
The big takeaway isn't that AI has magically replaced attackers, but that it's making certain workflows faster, more scalable, and more repeatable. More importantly, AI platforms, agent skills, integrations, and dependencies are now becoming targets themselves.
Topics covered include:
- AI for vulnerability discovery and exploit development: Google's first confirmed case of a zero-day exploit developed entirely with AI, including intentional prompts like "You are currently a network security expert specializing in embedded devices"
- Claude skills weaponization: A distilled knowledge base of over 85,000 real-world vulnerability cases integrated into AI research workflows
- Automation and scaled research: APT45 sending thousands of repetitive prompts to recursively analyze CVEs and validate proof-of-concept exploits
- AI-powered obfuscation techniques: Dynamic modification, evasive payload generation, and decoy logic using Gemini API for just-in-time VBScript obfuscation
- Autonomous attack orchestration: Moving beyond content generation into sophisticated malware command automation, including PromptSpy navigating Android UI for persistence
- AI-enhanced reconnaissance: Generating detailed organizational hierarchies and third-party relationships for high-value targets in finance, security, and HR departments
- Information operations and deepfakes: Taking legitimate journalist videos, editing in fabricated content, and adding AI-generated voiceovers
- Attacking AI dependencies: TeamPCP (UNC6780) targeting AI environments as initial access vectors, including March 2026 supply chain attacks on Trivy, Checkmarx, and LiteLLM
- The Mini Shai-Hulud worm: May 2026 attacks targeting AI infrastructure and dependencies
- Defensive fundamentals: Why inventory, zero trust principles, and behavioral monitoring matter more than ever
Brad and Spencer emphasize that while the threat landscape is evolving rapidly, doubling down on foundational security practices remains the most effective defense strategy.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 180, hosts Brad Causey and Spencer Alessi tackle a critical but often overlooked issue in cybersecurity: the echo chambers that can undermine critical thinking and effective security programs.
Inspired by recent experiences at the ILTA Evolve conference, Spencer and Brad explore how cybersecurity professionals, from practitioners to executives, can fall into bubbles where everyone reinforces the same ideas without questioning underlying assumptions.
Topics covered include:
- What cybersecurity echo chambers look like: conferences where everyone "reaffirms what they already knew" instead of challenging assumptions
- The AI hype cycle as a prime example: why the industry's multi-million-dollar conferences around "the new thing" miss the point that fundamental security principles still apply
- Social media's role in amplifying bias: how anecdotes from single engagements get generalized into "every organization is terrible at X" without considering nuance
- Conference culture and groupthink: when entire events operate in lockstep without anyone asking critical questions
- The danger of not having your own opinion: how IT and security leaders without formed opinions become vulnerable to the best sales pitch rather than the best solution
- Vendor influence on thought leadership: understanding financial and emotional motivations behind industry messaging
- Strategies to combat echo chambers: doing your own research, questioning everything, admitting when you don't know something
- The power of diverse perspectives: why opinions from people outside your expertise can be the most valuable
- Acknowledging bias and being wrong: how intellectual humility breaks down echo chambers
- Building a network of trusted advisors: asking people you trust what they think, even if they're not domain experts
While technical skills are crucial, nothing ruins a cybersecurity organization like bad culture, and echo chambers are a subcategory of that cultural problem. Whether you're navigating conferences, evaluating vendors, or building your security program, this episode offers practical guidance for maintaining critical thinking in an industry that can be driven more by hype than substance.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 179 of the Cyber Threat Perspective podcast, host Brad Causey and web app pen tester Jordan Natter kick off a multi-part series on the OWASP Top 10, the newly updated list of the most common and critical web application security risks, with a fresh version released in 2025.
Before diving in, Brad sets the record straight on something that's been bugging him for 20 years: the OWASP Top 10 is an awareness document, not a compliance framework, not a pen test checklist, and not a comprehensive defense guide. If your vendor claims they "comply with the OWASP Top 10," that's a red flag — you can't comply with an awareness document.
Part 1 focuses entirely on A01: Broken Access Control — the most dangerous and most common category on the list — and the conversation goes deep with real-world stories from active engagements.
Topics covered include:
- What OWASP actually is — and why the Top 10 is both invaluable and widely misunderstood
- Broken Access Control — what it means, why it tops the list, and how it manifests in real applications
- JWT validation failures — a healthcare application where improper JWT handling allowed unauthorized access to admin functionality
- MFA bypass via broken access control — a university application where MFA codes weren't properly scoped, enabling account takeover
- CORS misconfigurations — how Cross-Origin Resource Sharing policies fail in modern Node and React applications, including a real story of bypassing CORS by allowing AWS resources
- Insecure Direct Object References (IDOR) — why IDOR isn't just about changing integer IDs, including a university app where changing a student ID number led to staff-level privilege escalation
- S3 bucket IDOR — how a modern web application exposed PHI by returning GUIDs in JSON responses that could be enumerated directly
- Hidden functionality as false security — why hiding admin URLs from the navigation bar is obscurity, not security, and how Jordan accessed an entire admin PDF panel as an unauthenticated user just by copying a URL
OWASP Top 10: https://owasp.org/Top10/2025/0x00_2025-Introduction/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 178 of the Cyber Threat Perspective podcast, hosts Spencer and Tyler take a practitioner-first look at the internal security controls that genuinely make attackers' lives difficult, drawing directly from their experience conducting hundreds of internal penetration tests every year.
This isn't a vendor comparison or a theoretical framework. It's an honest account of what works, what gets misconfigured, and what separates organizations that slow attackers down from those that don't.
Topics covered include:
- Application Control — ThreatLocker and Magic Sword — why app control is probably the single most effective endpoint control against attackers, how the learning period works, why jumping straight to enforcement mode is a mistake, and why executive buy-in is as critical as the technical implementation
- WDAC vs. traditional App Locker — the differences, what closed-book enforcement actually means for attackers, and the two schools of thought on allow-list vs. block-list approaches
- Strong identity controls — MFA beyond RDP including SMB, WinRM, and HTTP via products like Silverfort, why push notification MFA falls short, and why number matching matters
- Protected Users Group — one of the most powerful and underused Active Directory controls, with a real-world story of how it nearly matched a full third-party identity product in effectiveness during a law firm pen test
- Least privilege and admin tiering — why Help Desk is one of the most targeted groups for social engineering, how over-permissioned service accounts hand attackers domain admin in minutes, and the real cost of control path vulnerabilities
- Network segmentation and zero trust — why domain controllers don't need internet access, how segmentation limits attacker recon, and where products like Zscaler fit in
- EDR baselining and UEBA — why plugging in an EDR tool and expecting it to work isn't enough, the case for getting back to behavior-based detection, and why catching recon activity matters more than catching execution
- Deception — honeypots, canaries, and fake assets — why deception is underrated, why high-fidelity low-false-positive alerts change the game, and what it actually feels like as a pen tester to trip on a well-placed decoy without knowing it
Also mentioned: Spencer and Brad's Tools of the Trade workshop at ILTA Evolve — Denver, end of April.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 177 of the Cyber Threat Perspective podcast, host Brad Causey and virtual CISO Daniel Perkins take a clear-eyed look at Claude Mythos — Anthropic's AI model that's generating serious buzz in the cybersecurity world for its ability to analyze source code, identify vulnerabilities at scale, build working exploits, and surface flaws that have sat undetected for decades.
The cybersecurity community is reacting. Brad and Daniel think a more measured response is warranted.
This episode breaks down what Mythos actually is, what it actually did, and what it actually means for your security program — without the hype or the hand-waving.
Topics covered include:
- What Mythos really is — a purpose-built code analysis model, not a hacker-in-a-box or AI overlord, and why that distinction matters
- The BSD vulnerability reality check — it cost $20,000 to find a 20-year-old DOS flaw in software almost nobody uses, and what that tells us about the real-world economics of AI-driven vulnerability discovery
- Speed, not net-new — why Mythos hasn't introduced anything fundamentally new to the threat landscape, just compressed the timeline dramatically
- Vulnerability chaining — how Mythos could change triage by identifying how low and medium severity CVEs combine into critical attack paths
- The vibe coding problem — why organizations that have never written code before are now writing a lot of it, and why that's where Mythos becomes genuinely important
- What this means for pen testing — why AI finding code flaws doesn't replace the human-driven validation of security programs, business logic testing, and misconfiguration discovery
- The shift to continuous vulnerability management — why monthly or quarterly scanning cycles won't be sufficient once Mythos capabilities proliferate, and how to make the move to continuous without going big bang
- The Mythos-Ready framework — a look at the CSA guidance document, what's useful, what needs to be scaled to your organization, and why inventory and attack surface should come before governance for most teams
- Supply chain and third-party risk — how Mythos changes the questions you should be asking your software vendors
The bottom line from Brad and Daniel: be responsive, not reactive. Tighten your patching SLAs, understand your attack surface, document your decisions, and execute the fundamentals well. The organizations that do that won't be caught flat-footed when this becomes mainstream.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 176 of the Cyber Threat Perspective podcast, Brad and Spencer break down some of the most repeated cybersecurity best practices in the industry and explain why, despite sounding solid on paper, they consistently fall short in real IT environments.
This isn't about dismissing good security principles. It's about closing the gap between advice that looks great in a framework and controls that actually hold up against how attackers operate.
Topics covered include:
- "Just enable MFA everywhere" — why focusing only on RDP leaves SMB, WinRM, service accounts, and legacy protocols wide open
- "EDR will catch it" — the danger of over-relying on a single control, including a little-known CrowdStrike behavior where it self-disables on domain controllers at 90% resource utilization — often completely unnoticed
- "Patch everything immediately" — why blind speed creates its own operational risk, and how to build a prioritized, high-risk patching process that actually works
- "Least privilege everywhere" — why removing permissions without providing alternatives drives workarounds, shared accounts, and exceptions that undo the whole point
- "Follow the framework and you're secure" — why compliance is a starting point, not a finish line, and what most standards actually require vs. what actually reduces risk
- Focusing on attack paths over checklists — why thinking like an attacker leads to better security decisions than ticking boxes
Brad and Spencer close with what actually works: context-driven decisions, management buy-in, clear communication when making sweeping changes, and validating every control through internal penetration testing. As Spencer notes, most clients don't have full confidence in their EDR and SOC after a pentest — and that's exactly why trust but verify matters.
Also mentioned: Spencer and Brad's upcoming Tools of the Trade workshop at the ILTA Evolve conference in Denver.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 175, Spencer and Tyler break down NetTools — a free, self-contained Active Directory management and troubleshooting tool that’s become a go-to for their internal penetration testing engagements.
They start with the backstory: years of relying on AD Explorer from Microsoft Sysinternals, and the growing need to evade EDR detections. At one point, that meant manually obfuscating binaries with a hex editor. NetTools eliminates that friction entirely — no installation, no dependencies, no signatures to fight.
Topics covered include:
- Why NetTools replaced AD Explorer and how EDR pressure forced the shift
- Group Policy enumeration, including how to spot dangerous GPO permissions like authenticated users with write access to server OUs
- LDAP Search & Browser for querying AD, identifying risky data (like passwords in descriptions), and exploring object relationships
- Assigned Trustees & Permissions Reporter for fast, visual identification of misconfigurations
- How to run NetTools from non-domain-joined machines using saved credential profiles
- Password checker functionality for targeted validation without spraying the environment
For pentesters, it’s a faster way to get visibility into AD risk. For IT admins, it’s a practical way to audit and harden your environment.
NetTools combines the functionality of multiple tools into one portable utility. Learn more at nettools.net. Credit to creator Gary Reynolds.
NetTools | The Swiss army knife of AD troubleshooting
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In Episode 174, host Brad Causey is joined by guest Jordan Natter for a practical, tool-focused conversation on web application penetration testing. Together they break down the essential tools and Burp Suite Pro extensions that make up a modern web app pen testing toolkit.
Topics covered include:
- Burp Suite Pro vs. OWASP ZAP — comparing capabilities, extensions, and use cases
- CSP Auditor — identifying unsafe Content Security Policy directives
- JSON Web Token (JWT) extension — surfacing and tampering with JWTs in HTTP history
- Retire.js — flagging outdated JavaScript libraries with known vulnerabilities
- CyberChef & JWT.io — encoding, decoding, and debugging tokens
- Postman & Swagger — API testing and documentation workflows
- SQLMap — powerful SQL injection discovery (and why you should never run it in production)
- Proxy Forge — evading cloud-based WAFs and testing geo-blocking
- GraphQL Hunter — enumerating and testing GraphQL instances
Have a tool or extension you swear by? Drop it in the comments — Brad and Jordan want to hear from you!
Burp Suite is an integrated platform for attacking web applications. http://portswigger.net/burp/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
How do you find insecure permissions in Active Directory before they turn into attack paths?
In this episode, we take a practical look at how to identify insecure Active Directory permissions using ADeleg, a free security tool trusted by penetration testers.
Misconfigured delegation and overly permissive access rights are a common source of risk in Active Directory environments. These gaps can create hidden attack paths—but many teams don’t know where to look or how to interpret what they’re seeing.
In this episode, we cover:
- How to identify insecure permissions in Active Directory
- What to look for in high-risk users and groups like Domain Users, Everyone, and Authenticated Users
- How these misconfigurations translate into real-world attack paths
- How to use ADeleg to analyze delegated permissions and uncover hidden risk
We also include a reference to ADeleginator, a related tool that can help automate parts of this process using PowerShell. While this episode focuses on hands-on analysis with ADeleg, ADeleginator is a useful companion for scaling this work.
Tools referenced:
ADeleg: https://github.com/mtth-bfft/adeleg
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Hey folks! Greetings from the Offensive Security group at SecurIT360. Brad & Spencer are on this episode of The Cyber Threat Perspective to break down The Biggest Security Blind Spots in Mid-Size Companies.
In this episode, we expose the most common (and dangerous) gaps that leave mid-sized organizations wide open: poor asset inventory, flat networks, flat identities, overconfidence in security tools, credential reuse, and the emerging risks with AI.
If any of these hit home, go to offsec.blog/pentesting, fill out the form on our website, and see if we’re a fit for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Pentesting is quickly evolving with the integration of AI, fundamentally changing how cybersecurity professionals approach their work. In this episode, Spencer and Brad discuss the real shifts they’re seeing in the industry and what the future may look like.
- The pivotal changes in AI that have impacted pentesting over the past year
- The emergence of agents, orchestration, and single-pane-of-glass platforms for streamlined operations
- How AI is enabling rapid tool creation, customization, and administrative efficiency
- The effect of AI on skillsets, closing the gap between junior and senior pentesters
- Why human expertise remains irreplaceable despite advancements in AI-driven tools
Tune in to hear straight-forward perspectives on the future of pentesting and actionable insights for professionals looking to stay ahead.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we break down the biggest insights from the CrowdStrike 2026 Global Threat Report and what they actually mean for IT leaders, security teams, and executives. From attackers abusing trusted identities and bypassing security tools to exploiting edge infrastructure and leveraging AI to move faster than ever, the modern threat landscape is shifting in ways many organizations aren’t prepared for.
https://www.crowdstrike.com/en-us/global-threat-report/
https://mhaggis.github.io/ClickGrab/
Episode 164: Offensive Security in the Age of AI - What Has...
Episode 155: How We Use AI Offensively - Offensive Security Blog - SecurIT360
Episode 146: What Are The Security Implications of AI -...
Episode 144: How Cyber Threat Actors Are Using AI -...
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we’re digging into malicious browser extensions...the quiet, often overlooked attack vector living inside nearly every organization. While we focus on patching servers, hardening Active Directory, and deploying EDR, attackers are increasingly abusing the browser as their initial foothold. We’ll break down how these extensions work, why they’re so dangerous, and what IT leaders can realistically do about it.
Check out these resources:
Annex - Enterprise Software Extension Security & Management
https://crxaminer.tech/
https://x.com/tuckner
https://x.com/IceSolst
brad@securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
Brad and Jordan talk bout web app pen testing, why you might need it, and why other forms of app sec might not be good enough.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
You've got Tyler & Brad and In this episode, we break down the early versions of Transport Layer Security (TLS) — TLS 1.0 and TLS 1.1 — and explain why these once-standard encryption protocols are now considered insecure. We’ll cover when they were released, how modern attacks and cryptographic weaknesses caught up with them, and why today’s internet relies on newer, more secure protocols like TLS 1.2 and TLS 1.3.
We’ll also discuss how even “secure” protocols can become vulnerable when weak ciphers are enabled, using Sweet32 as a real-world example of cipher-level risk.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we explore why many organizations invest in penetration testing yet see little improvement in their actual security posture. We discuss the common pitfalls of treating pentests as one-time events, how attackers operate very differently from scoped assessments, and why remediation—not the report—is what determines real safety. If you’ve ever wondered why “passing” a pentest didn’t translate into stronger defenses, this episode is for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, Brad and Jordan talk about API pen testing, how it works, and what you can expect if you want to procure one. They discuss pitfalls, common findings, and ways to streamline the process.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we take a step back from the AI hype and focus on what has actually changed in offensive security. AI isn’t replacing attackers or inventing brand-new techniques, but it is dramatically reducing friction across the attack lifecycle. We break down the myths, explain where AI is already impacting real-world attacks, and walk through how defenders need to adapt if they want to keep up.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we dissect the dangerous trend of organizations ceding control of their security strategy to vendors, exploring the pitfalls of vendor lock-in, overspending, and the illusion of comprehensive protection. We'll provide actionable steps to reclaim your security posture and build an independent strategy tailored to your specific needs.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, Brad and Spencer from SecurIT360's Offensive Security group delve into the crucial reconnaissance phase attackers undertake before launching an attack. They discuss the real-world impact of seemingly harmless data leaks, how attackers chain them together to build a profile of your organization, and common misconceptions about what data is truly "sensitive" from an external attacker's perspective. Learn how organizations can realistically assess their external attack surface beyond automated scanning and discover creative OSINT techniques defenders can use to mimic attacker reconnaissance.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode Brad and Spencer discuss the rapid technology shift that's happening in cybersecurity, hybrid pentesting models and the overall evolution of pen testing as we head into 2026.
Need a pentest before the end of the year?
Learn how here...
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we're discussing the pros and mostly the cons of notifying your SOC/MSSP before your penetration test. Spencer and Brad delve into the details of why it matters and share their experience from hundreds of penetration tests.
Get your 2025 External Pentest done before time runs out! https://www.securit360.com/external-penetration-testing-services-sa/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://spenceralessi.com
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we’re sharing practical, no-fluff advice for getting into cybersecurity, whether you're switching careers, just starting out, or leveling up your IT skills. We’ll cover what actually matters to employers, what to avoid, and the fastest paths into the industry. If you’re looking for a clear roadmap into cybersecurity, this episode is for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode Brad and Jordan sit down to discuss how she was caught and reported on a penetration test engagement. We deep dive into the details and why it's a net positive.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode Brad and Jordan sit down to discuss common web application security findings we've seen this year.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode Spencer and Tyler discuss post-exploitation tactics that still work in 2025. The guys discuss everything from credential access techniques to defense evasion, lateral movement and even exfiltration.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we're taking a deep dive into how the Offensive Security group at SecurIT360 is strategically leveraging and utilizing artificial intelligence technologies in offensive security operations. We'll explore the innovative ways this team is harnessing the power of AI to enhance their penetration testing capabilities, automate security assessments, and identify vulnerabilities more efficiently.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
This episode is all about pentesting on a budget for IT Admins. This episode is inspired by the PDQ Live stream held on October 23rd, 2025, where Spencer shared tips, tactics, tools and advice for IT admins wanting to better defend and protect their environments.
All tools, checklists, guides and resources can be found here: https://go.spenceralessi.com/budget
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode, we dig into how to move from “we think we’re secure” to “we can prove it.” We’ll lay out a practical loop for validating controls, gathering evidence, and tracking results that leadership understands. If you’ve ever wondered how to demonstrate security value beyond dashboards and audits, this is your playbook.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal pentesting here.
In this episode of The Cyber Threat Perspective, we highlight the pentest findings that, frankly, have no business showing up in 2025. From accounts with weak passwords and no MFA to plaintext credentials on file shares, we break down the common misconfigurations and oversights that attackers still abuse, despite years of seeing the same issues over and over again. If you're an IT admin or security leader, this episode is your checklist of what to fix yesterday.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Spencer and Brad dig into a question that comes up all the time: what exactly is offensive security? Hint: it’s not just “pentesting.” Offensive security covers a whole spectrum of activities, including, penetration testing, red teaming, purple teaming, adversary emulation, and more. We’ll break down what each of these means, how they’re different, and how we do things at SecurIT360. By the end, you’ll have a clearer picture of how offensive security fits into a bigger security strategy and why it’s more than just finding vulnerabilities.
👉Find vulnerabilities that matter, learn about how we do assume breach internal pentesting here.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we’re digging into a super awesome Active Directory security tool called PingCastle. We’ll cover what it is, why it matters for Active Directory security, and how IT and security teams can leverage it to get ahead of adversaries. PingCastle is a staple tool on our internal pentesting toolbelt. In this episode, you will find out why.
👉Find vulnerabilities that matter, learn about how we do assume breach internal pentesting here.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
https://offsec.blog/budget
In this episode, we’re tackling an often-overlooked opportunity: using pentest results to secure more budget for security initiatives. Too many organizations run a pentest, file the report away, and move on without leveraging it for strategic value. We’ll break down how to translate findings into business language, influence leadership, and turn vulnerabilities into funding for better defenses.
Click here to see if you're a fit for our style of internal pentesting.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Brad and Spencer sit down with an experienced information security and risk manager to explore how they build and manage their security stack, choose the right tools, and win support from their team and leadership. We dig into the balance between technical defenses and business-driven risk management, from budgeting and vendor selection to measuring success and preparing for emerging threats. Whether you’re a hands-on practitioner or a security leader, you’ll walk away with practical insights on building stronger defenses and aligning security with business goals.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
This is the webinar I gave in August 2025 on the topic of common Windows misconfigurations I see during internal pentests. Make sure you grab your free gifts!
Learn how we do internal pentesting differently...
https://securit360.com/free-gifts
https://links.spenceralessi.com/creds
https://go.spenceralessi.com/windows-slides
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we’re digging into one of the most overlooked parts of a penetration test, when it actually makes sense to not fix a finding. Not every vulnerability deserves equal treatment, and sometimes accepting the risk is the most mature decision a business can make. We’ll cover how to recognize those situations, avoid common pitfalls, and document your choices so they stand up to scrutiny.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we’re exploring the broader security implications of artificial intelligence. AI is transforming everything—from how we defend our networks to how attackers exploit them. We’ll break down the risks, the opportunities, and what security teams need to be thinking about right now as AI becomes embedded in both our tools and becomes a part of our daily life.
Spencer's next webinar 8/28 12pm Eastern
Topic: Securing Windows, Common Misconfigurations That Give Attackers The Advantage
https://go.spenceralessi.com/windows
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we're diving into what to do the minute incident response arrives. That first moment matters—a lot. Whether it's a ransomware attack, unauthorized access, or data exfiltration, how you act in minute one can either help or hinder the investigation. We’ll cover the do’s, don’ts, and common mistakes we see, so you’re ready when the heat is on.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we're diving into one of the most pressing trends in cybersecurity: how threat actors are using AI. From deepfake scams and AI-generated phishing emails to automated malware and voice cloning, attackers are leveraging artificial intelligence to scale their operations and sharpen their tactics. We’ll break down real-world examples, tools like WormGPT, and what this means for defenders going forward.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we break down a question that often gets overlooked: When should you not do a penetration test? Not every organization needs a pentest right away, and choosing the wrong assessment can waste time, money, and effort. We’ll walk through the differences between pentests, vulnerability scans, and risk assessments — and when each one is the right move.
Learn how we do internal pentesting differently...
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we're diving into one of the most overlooked yet dangerous components of Active Directory: Certificate Services. What was designed to build trust and secure authentication is now being exploited by attackers to silently escalate privileges and persist in your environment. We’ll break down how AD CS works, how it gets abused, and what defenders need to do to lock it down.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
It’s easy to overlook small misconfigurations on Windows endpoints, but those little mistakes can create big opportunities for attackers. In this episode, we break down the most common Windows security missteps we see in real-world environments, from missing the basics to reused local admin passwords. If you’re a sysadmin, IT admin, or just responsible for keeping Windows machines secure, this one's for you.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we dive into the unique cybersecurity challenges faced by the financial services sector, from high-value targets and strict compliance requirements to the constant threat of phishing and ransomware. We’ll break down common attack paths, what makes financial orgs so attractive to threat actors, and most importantly, what IT and security teams can do to stay ahead. Whether you're on the red team, blue team, or in leadership, this episode will help you strengthen your security posture in one of the most targeted industries on the planet.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we dive into the unique cybersecurity challenges faced by the financial services sector, from high-value targets and strict compliance requirements to the constant threat of phishing and ransomware. Whether you're on the red team, blue team, or in leadership, this episode will help you strengthen your security posture in one of the most targeted industries on the planet.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
(Replay) In this episode, Spencer and Brad discuss the ever popular and highly debated topic of evasion. In this podcast we talk about evasion from the context of evading defense controls, not necessarily EDR specific evasion techniques. Our hope with this episode is to shed light on this topic and help defenders understand various methods of evasion and this topic more in general.
Resources
- (Jun 1, 2021)Evadere Classifications - detection & response focus
- Defense Evasion, Tactic TA0005 - Enterprise | MITRE ATT&CK® - controls focus
- (Mar 22, 2024) Atomics on a Friday - Evade or Bypass - edr focus
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we break down the 7 critical questions every security leader should ask after a penetration test. A pentest isn’t just about checking a box, it’s an opportunity to assess your defenses, measure progress, and refine your strategy. We discuss how to go beyond the report, extract real value from the assessment, and ensure findings lead to meaningful action across your organization. Whether you’re a CISO, IT director, or team lead, this episode will help you make every pentest count.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we highlight the pentest findings that, frankly, have no business showing up in 2025. From accounts with weak passwords and no MFA to plaintext credentials on file shares, we break down the common misconfigurations and oversights that attackers still abuse, despite years of seeing the same issues over and over again. If you're an IT admin or security leader, this episode is your checklist of what to fix yesterday.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we dive into why a “A day in the life of an External Penetration Tester." What do we actually do, and how do the things we do affect the overall engagement? What's important? We answer all of these questions and more in this week's episode.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
(REPLAY) This is a recording of a webinar aimed at IT professionals, system administrators, and cybersecurity professionals eager to bolster their defenses against cyber threats. In this session, "How to Harden Active Directory to Prevent Cyber Attacks," our expert speakers will discuss comprehensive strategies and best practices for securing your Active Directory environment.
Download the slides here.
Key Takeaways:
-
Understanding AD Vulnerabilities: Learn about the most common security weaknesses in Active Directory (AD) and how attackers exploit these gaps.
-
Best Practices in Configuration: Discover how to properly configure Active Directory settings for maximum security to deter potential breaches.
-
Advanced Security Measures: Explore advanced techniques and tools for monitoring, detecting, and responding to suspicious activities within your network.
-
Case Studies: Hear real-world examples of Active Directory attacks and what lessons can be learned from them.
-
Interactive Q&A: Have your specific questions answered during our live Q&A session with the experts.
Whether you want to enhance your security posture or start from scratch, this webinar will provide you with the knowledge and tools necessary to protect your systems more effectively.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we dive into why a “we couldn’t get in” result on a pentest isn’t always the victory it seems—and why it can be a great sign if interpreted correctly. We break down the real defensive controls that prevented compromise, explore what might still be hiding under the surface, and share why even a clean report shouldn’t mean letting your guard down.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we tackle the crucial first step in cybersecurity: preventing initial compromise. We'll dissect common attack vectors like phishing and exploitation and explore layered defenses ranging from MFA and patch management to DMZs and WAFs. Get actionable guidance to integrate these controls into your security program and safeguard your organization against the risk of that initial foothold.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we break down how attackers steal credentials and hijack sessions to gain unauthorized access to systems and data. From phishing to cookie stealing to session token theft, we’ll explore the most common techniques and how to defend against them. Whether you're an IT admin or security pro, you’ll walk away with practical tips to help protect your users and your organization.
Learn how we do internal pentesting differently...
Recommended Conditional Access Policies to protect against account compromise: https://x.com/techspence/status/1919815226158932119
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode Spencer and Brad review the M-Trends 2025 Report. M-Trends 2025 is Mandiant's annual report that shares frontline learnings from its global incident-response engagements—over 450 000 hours of investigations in 2024—providing sanitized, data-driven analysis of evolving attacker tactics, dwell times, industry and regional trends, and practical recommendations to help organizations improve their defenses.
M-Trends 2025: Data, Insights, and Recommendations From the Frontlines | Google Cloud Blog
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this replay, Spencer and Brad dive into lateral movement, discussing various techniques like RDP, RATs, Impacket tools, PsExec, PTH, PTT, and PowerShell Remoting. They explain how attackers use these methods to gain unauthorized access, evade detection, and enable malicious activities. They also discuss precursors to lateral movement and strategies to restrict it, such as least privilege access, network segmentation, and monitoring. The podcast emphasizes the importance of understanding lateral movement and implementing comprehensive security measures to mitigate these threats.
Resources
- https://www.reddit.com/r/cybersecurity/comments/1ellylu/what_lateral_attacks_have_you_been_seeing/
- The DFIR Report
- Lateral Movement, Tactic TA0008 - Enterprise | MITRE ATT&CK®
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Spencer's Twitter: https://x.com/techspence
Spencer's LinkedIn: https://linkedin.com/in/SpencerAlessi
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Tyler and Brad discuss DMARC and how the latest version of the PCI framework requires phishing protection. You'll also learn about DMARC, DKIM, and SPF and how to elevate them to help protect your organization from attacks like Business Email Compromise (BEC).
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode of The Cyber Threat Perspective, we explore the strategic integration of deception technology like canaries and honeypots into your cybersecurity defenses. Discover how these tools allow you to detect threat actors earlier in their attack sequence, disrupt malicious activities, and mitigate potential damage to your organization. Join us for actionable insights and defensive advice to enhance your organization's security posture.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
Threat reports can be goldmines for defenders — but only if we know how to extract and apply what matters. A good analysis can mean catching an attack early or missing it entirely. There's no shortage of threat intel out there. The real challenge is making sense of it without getting overwhelmed. In this episode we discuss:
- What makes up a threat report
- Goals of analyzing threat reports
- How to analyze the pieces that matter
- Actionable tips you can use today
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Brad and Sam discuss the most common security issues found on external penetration tests, how to find them yourself, and how to address them.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
This episode focuses on SaaS (Software as a Service) Supply Chain Attacks. We discuss what SaaS applications are most at risk, what the real danger of saas supply chain attacks are and most importantly how to defend and detect these attacks.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
Dive into the quirky underworld of digital misdirection in this episode, where we explore the art of typosquatting. Discover how a simple mistyped URL can turn into a gateway for cyber trickery, as we break down the many forms of typosquatting—from subtle misspellings that mimic trusted sites to more elaborate schemes designed to deceive. Learn why these small errors are so effective in luring unsuspecting users and get insider tips on how to protect yourself from falling into these cleverly crafted traps. Whether you're a digital native or just curious about the hidden risks of the internet, this episode equips you with the knowledge and defenses you need to navigate online spaces with confidence.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we discuss whose job is harder. The red team or the blue team? We discuss the roles and responsibilities of many red and blue teamers, the challenges both those teams face, and then we share some advice for handling and overcoming those challenges.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
Unlock the secrets of effective attack surface monitoring in this replay of The Cyber Threat Perspective. Brad and Spencer dive into essential practices, tools, and methodologies to keep your systems secure.
- Define and understand attack surface and attack vectors
- Distinguish between physical and digital attack surfaces
- Explore DIY vs. commercial tools for attack surface monitoring
- Learn from bug bounty industry methodologies and resources
- Emphasize the importance of continuous monitoring and asset management
Check out our show notes for additional resources, and don't forget to like, share, and subscribe!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we discuss several insecure protocols that are found within Active Directory environments. When these protocols are enabled, they could be abused by an attacker to perform a number of attacks, including privilege escalation and lateral movement.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Chelsea (ChatGTP) interviews Brad about web application penetration testing. Listen in to learn how the process works from start to finish!
Resources
- https://owasp.org/
- https://nvd.nist.gov/vuln-metrics/cvss
- https://chatgpt.com/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Spencer and Brad discuss the ever popular and highly debated topic of evasion. In this podcast we talk about evasion from the context of evading defense controls, not necessarily EDR specific evasion techniques. Our hope with this episode is to shed light on this topic and help defenders understand various methods of evasion and this topic more in general.
Resources
- (Jun 1, 2021)Evadere Classifications - detection & response focus
- Defense Evasion, Tactic TA0005 - Enterprise | MITRE ATT&CK® - controls focus
- (Mar 22, 2024) Atomics on a Friday - Evade or Bypass - edr focus
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, Spencer and Tyler discuss key things that they as pentesters wish all organizations knew about pentesting and the pentest process. They go through the entire lifecycle of a pentest and discuss definitions, processes, misconceptions and much more. By the end of this episode, we hope you have a better understanding of everything that goes into the pentesting process including things that are not typically visible to clients.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
In this episode, we draw parallels between natural disasters and navigating today’s cybersecurity landscape. From the importance of preparation and layered defenses to the critical need for constant monitoring and resilience, we uncover valuable lessons that nature’s challenges can teach us about protecting systems and data. Whether you’re an IT professional, a business owner, or just someone passionate about cybersecurity, this episode will inspire you to think differently about your defenses—and stay one step ahead.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://x.com/cyberthreatpov
Follow Spencer on social ⬇
Spencer's Links: https://go.spenceralessi.com/links
Work with Us: https://securit360.com | Find vulnerabilities that matter, learn about how we do internal assume breach pentesting here.
Join us for this replay of episode 78 - an enthralling journey into the heart of cybersecurity operations with “Tales from the Trenches,” an exclusive podcast presented by Brad Causey, Vice President of Offensive Security at SecurIT360.
Dive deep into the high-stakes world of offensive security as Brad shares his firsthand experiences from a career spent on the front lines of digital defense.
Engage with real-life stories illustrating offensive cybersecurity's intense challenges and triumphant victories. Brad's narrative will transport you to the core of high-pressure operations, where strategic decisions can impact the security posture of entire organizations.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Welcome to this replay on The Cyber Threat Perspective! In this episode, Brad and Spencer dive into the mechanics and recent developments of email spoofing, shedding light on how attackers are bypassing advanced email protections.
In this episode, we cover:
- The fundamentals of email spoofing and why it's a significant threat.
- Insight into the recent echo spoofing campaign exploiting Proofpoint's misconfiguration.
- The role of SPF, DKIM, and DMARC in combating email spoofing.
- How threat actors are using Microsoft 365 to bypass email protections.
- Mitigation strategies and the latest updates from Proofpoint and Microsoft to address these vulnerabilities.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode of The Cyber Threat Perspective, Nathan and Spencer discuss crucial strategies for Windows and Active Directory hardening, emphasizing the importance of community collaboration and the value of using CIS benchmarks for security compliance.
In this episode, we cover:
- Implementing multi-factor authentication for domain admins
- The benefits and importance of using CIS benchmarks for Windows 10 and 11
- Advantages of having a consistent standard in an active directory environment
- Assurance and verification tools available in the benchmarks
- Simulated environment testing and active community participation for benchmark improvement
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we’re discussing what a seasoned CISO is focused on going into 2025. Mike Whitt is a Cheif Information Security Officer in the financial sector with over 20 years of experience building teams, security programs, and leading organizations to a more secure posture.
https://www.linkedin.com/in/mike-whitt-a4b4802/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we’re peeling back the layers of the question so many organizations ask: Why do penetration tests cost so much? But here’s the real twist—are they actually expensive, or are we measuring their value the wrong way?
By the end of this episode, you’ll understand not just the cost of a penetration test, but its value as an investment in protecting your business. We’ll dive into real-world examples, break down the factors that drive pentest pricing, and explore how it compares to the costs of incidents like data breaches, ransomware, and PR disasters. Let’s get started.
https://www.morganlewis.com/blogs/sourcingatmorganlewis/2024/03/study-finds-average-cost-of-data-breaches-continued-to-rise-in-2023
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we’re diving into one of the most enduring cybersecurity challenges—weak passwords. We’ll explore how poor password practices and identity management pitfalls leave organizations vulnerable to compromise. From understanding the most common mistakes to implementing effective defenses, we’re breaking down what it takes to fortify your systems against attackers exploiting the weakest link.
Sources
- https://www.verizon.com/about/news/2023-data-breach-investigations-report?utm_source=chatgpt.com
- https://blog.1password.com/challenges-of-shadow-it/
- https://www.microsoft.com/en-us/security/security-insider/intelligence-reports/microsoft-digital-defense-report-2024?msockid=2e875ee0e1fe64d22f854aa6e0746523
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we discuss the broad concept of risk, what it is, and how to manage it. This episode is a great way to begin understanding how to develop an overall risk management strategy at your organization or understand how a risk management program might work for you.
You find out more about what Rob and his team can do here:
https://www.securit360.com/services/managed-services-consulting/
Reach him directly here:
rob@securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we discuss the challenge of translating penetration test findings into practical and effective security improvements, and we delve into the three major bottlenecks to improving security and give recommendations for overcoming them.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we're talking about a significant development in the cyber threat landscape. There has been a surge in activity from a group known as Midnight Blizzard, also known as APT29. They're a sophisticated Russian state-sponsored group, and their primary targets are governments, diplomats, NGOs, and IT service providers, mainly in the US and Europe. What's really alarming is their recent shift in tactics. They're now using malicious RDP files in their spear-phishing campaigns, which is a new approach for them.This indicates they are evolving their methods, becoming even more dangerous. RDP is commonly used in corporate environments for remote access to resources, so many organizations have it enabled and may not be blocking RDP files, making them an ideal attack vector.
Amazon identified internet domains abused by APT29 | AWS Security Blog: https://aws.amazon.com/blogs/security/amazon-identified-internet-domains-abused-by-apt29/
Foreign Threat Actor Conducting Large-Scale Spear-Phishing Campaign with RDP Attachments | CISA: https://www.cisa.gov/news-events/cybersecurity-alerts-advisories/aa24-329a
Midnight Blizzard conducts large-scale spear-phishing campaign using RDP files _ Microsoft Security Blog.pdf: The URL for this source was not provided.
Rogue RDP – Revisiting Initial Access Methods - Black Hills Information Security: https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
Rogue RDP: Bring Your Own Server | Mike Felch | 1-Hour: https://www.youtube.com/watch?v=y1Y-t7fDwXU
Warning: Government-themed Phishing with RDP Attachments | CCB Safeonweb: https://www.safeonweb.be/en/news/warning-government-themed-phishing-rdp-attachments
Rogue RDP Attack Detection: UAC-0215 Leverages RDP Configuration Files to Gain Remote Access to Ukrainian Public Sector Computers - SOC Prime: https://socprime.com/blog/rogue-rdp-attack-detection-uac-0215-leverages-rdp-configuration-files-to-gain-remote-access-to-ukrainian-public-sector-computers/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we dive deep into the newly released Microsoft Digital Defense Report 2024, which offers a comprehensive look at the latest trends in the global cybersecurity landscape. From evolving cyber threats and attack strategies to Microsoft's analysis of the most vulnerable sectors, we break down the key findings and what they mean for businesses, governments, and cybersecurity professionals. Join us as we discuss how threat actors are leveraging new technologies, the role of AI in defense strategies, and what steps organizations can take to bolster their cyber resilience. Whether you're an IT professional or just passionate about cybersecurity, this episode will give you critical insights into defending against tomorrow's threats, today.
Microsoft Digital Defense Report 2024
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode replay, Spencer and Darrius break down the complexities of credential protection, discussing everything from user education and tools to threat modeling and guardrails. Plus, we delve into the world of protecting credentials within scripts and code. This is a must-listen for all IT admins, CISOs and any other IT/Security professional.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Brad discuss a recent Trend Micro research project and associated white paper "Red Team Tools in the Hands of Cybercriminals and Nation States". Spencer and Brad dig into what red teaming is, what red team tools (often referred to as offensive security tools) are and why they are used. They also cover the abuse of red team tools, the speed of exploitation after public release and supply chain attacks against red team tools.
From Defense to Offense: The Misuse of Red Teaming Tools by Cybercriminals | Trend Micro (US)
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this replay episode, Spencer is joined by Daniel Perkins, a Senior Information Security Officer at SecurIT360 to discuss the intricacies of vulnerability management, the important prerequisites to vulnerability management, and best practices, and provide actionable strategies to level up your vulnerability management program.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Spencer discuss Spencer's upcoming in-person workshop at Cyber SC. The Hardening Active Directory to Prevent Cyber Attacks Workshop is aimed at IT professionals, system administrators, and cybersecurity professionals eager to learn how to bolster their defenses against cyber threats. In this workshop, we will discuss comprehensive strategies and best practices for securing Active Directory.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Tyler share what they love and hate about the current state of penetration testing, they discuss current and future trends, and what it means to be a true cybersecurity partner. We hope you enjoy this episode!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Tyler and Brad talk about various security issues found on recent penetration tests. They outline the how and why, and talk about mitigation strategies to help you beat these issues in your environment.
ResourcesBlog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Brad dive into lateral movement, discussing various techniques like RDP, RATs, Impacket tools, PsExec, PTH, PTT, and PowerShell Remoting. They explain how attackers use these methods to gain unauthorized access, evade detection, and enable malicious activities. They also discuss precursors to lateral movement and strategies to restrict it, such as least privilege access, network segmentation, and monitoring. The podcast emphasizes the importance of understanding lateral movement and implementing comprehensive security measures to mitigate these threats.
Resources
- https://www.reddit.com/r/cybersecurity/comments/1ellylu/what_lateral_attacks_have_you_been_seeing/
- The DFIR Report
- Lateral Movement, Tactic TA0008 - Enterprise | MITRE ATT&CK®
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In our "DNS Security" podcast, we delve into DNS's critical role in how the internet works, exploring its vulnerabilities and attacks like DNS spoofing, cache poisoning, and DDoS. We discuss DNSSEC and its components, including public and private keys, and examine practical solutions such as DNS and content filtering. The episode also highlights the advantages of cloud-based DNS services, like those offered by Cloudflare.
Finally, we share best practices and resources for securing DNS infrastructure, addressing challenges like scalability and false positives. Join us for a concise yet comprehensive exploration of DNS security's complexities and solutions.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
Let's talk about cyber risk classification in this episode of The Cyber Threat Perspective.
Brad and Tyler provide a high-level overview of various types of cyber risk encountered in penetration testing.
-Reputational Risk
-Financial Risk
-Operational Risk
-Direct Risk
-Indirect Risk
-Lateral Risk
-Strategic Risk
-Compliance Risk
https://offsec.blog
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode Brad and Spencer discuss Attack Surface Monitoring, what it is, and why it's important for defending against cyber-attacks. They give into the difference between attack vectors and attack surface and share a high-level overview on how to go about monitoring your own attack surface. Finally, they share tools and techniques for attack surface monitoring, many of which are key concepts taken from the world of bug bounty.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, Spencer has Sam Killingsworth on the show to talk about getting into cybersecurity, specifically penetration testing, coming from a first responder background. Sam is currently a full-time Firefighter/EMT and part-time penetration tester here at SecurIT360. Sam shares his background and experiences of learning cybersecurity and pentesting and how he has used the skills from his full-time job to help him be a better pentester.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, Spencer and Brad dive into the complex maze of 3rd party email providers, filtering and spoofing. Email spoofing is a technique used by cybercriminals to disguise the sender's address in an email message, making it appear as though the email originated from a different source. This can be used for a variety of malicious purposes, such as phishing attacks, fraudulent activities, or spreading malware.
DMARC Rundown - Offensive Security Blog - SecurIT360
“EchoSpoofing” — A Massive Phishing Campaign Exploiting...
Spoof intelligence insight - Microsoft Defender for Office 365
How attackers bypass third-party mail filtering to Office 365
Spoofing Microsoft 365 Like It’s 1995 - Black Hills Information Security
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, Spencer is joined by Joey Vandergrift (SecurIT360's VP of Security Operations) and Mark Brophy (SecurIT360's DFIR practice lead). Together they discuss how CrowdStrike, a leading EDR product, caused one of the largest global IT outages in history.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, Spencer and Brad dive into the deep underworld of infostealer malware. They discuss what infostealers are, how they are used and what they are used for. They will dig into how the information obtained from infostealers can help cyber threat actors compromise large and small organizations, cloud providers and more but also how the infostealer data and logs can be used by authorities for good.
Resources
- 10,000 Victims a Day: Infostealer Garden of Low-Hanging Fruit
- https://x.com/vxunderground/status/1757467533202862344
- Infostealer malware logs used to identify child abuse website members
- https://cybernews.com/cybercrime/disney-slack-data-breach-unreleased-projects/
- https://x.com/arekfurt/status/1800181869256024083
- https://x.com/ddd1ms/status/1755256762997850279
- https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion?linkId=10091118
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
Discover the vulnerabilities lurking within medical devices and how ethical hacking can safeguard patient care. Join Brad, VP of Offensive Security at SecurIT360, as he unpacks the risks and protections against cyber threats in healthcare tech.
-
Unveiling the risks of wireless communication vulnerabilities in insulin pumps and glucose monitors that could be exploited through advanced hacking techniques.
-
Demonstrating the use of tools like ESP32, Hashcat, and attack scenarios to reveal how medical devices can be manipulated, compromising patient safety.
-
An in-depth analysis of a common air purifier APK, exposing undocumented features and firmware flaws with far-reaching security implications.
-
Real-world examples highlighting the importance of pen testing medical devices, including the potential for increased medication dosing due to infusion pump flaws.
-
A deep dive into the broad-reaching impact of exploited vulnerabilities, from chaos in hospitals to privacy breaches through interconnected devices and mobile apps.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, Spencer and Brad discuss the OpenSSH "regreSSHion" vulnerability. This is being tracked as CVE-2024-6409 & CVE-2024-6387. A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead to sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.
Links:
- https://nvd.nist.gov/vuln/detail/CVE-2024-6409
- https://nvd.nist.gov/vuln/detail/CVE-2024-6387
- https://www.qualys.com/2024/07/01/cve-2024-6387/regresshion.txt?ref=thestack.technology
- https://www.infosecurity-magazine.com/news/chinese-state-exploits/
- https://x.com/fofabot/status/1810622161192919350
- https://justpaste.it/do235
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, Spencer and Tyler discuss two of their current favorite tools: OneDriveEnum for enumerating user accounts in Microsoft 365 and AD Miner for visualizing attack paths in Active Directory. We hope you enjoy and get value from this episode!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, we discuss the latest trends and techniques for enumerating Microsoft 365. We break down how attackers may identify M365 tenants, how they discover and validate accounts and what you as an IT admin can do to protect your organization in-light of this. Topics covered: Credential Stuffing, Brute Force Attacks, Password Spraying, Prompt Bombing, Session Hijacking, Adversary-in-the-Middle (AiTM) Attacks, OAuth Phishing, Legacy Authentication Protocols, App Passwords, Conditional Access Policies
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
In this episode, we discuss the latest trends and techniques for enumerating Microsoft 365. We break down how attackers may identify M365 tenants, how they discover and validate accounts and what you as an IT admin can do to protect your organization in-light of this.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Text us feedback!
This is a recording of a webinar aimed at IT professionals, system administrators, and cybersecurity professionals eager to bolster their defenses against cyber threats. In this session, "How to Harden Active Directory to Prevent Cyber Attacks," our expert speakers will discuss comprehensive strategies and best practices for securing your Active Directory environment.
Key Takeaways:
-
Understanding AD Vulnerabilities: Learn about the most common security weaknesses in Active Directory (AD) and how attackers exploit these gaps.
-
Best Practices in Configuration: Discover how to properly configure Active Directory settings for maximum security to deter potential breaches.
-
Advanced Security Measures: Explore advanced techniques and tools for monitoring, detecting, and responding to suspicious activities within your network.
-
Case Studies: Hear real-world examples of Active Directory attacks and what lessons can be learned from them.
-
Interactive Q&A: Have your specific questions answered during our live Q&A session with the experts.
Whether you want to enhance your security posture or start from scratch, this webinar will provide you with the knowledge and tools necessary to protect your systems more effectively.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Send us a Text Message.
In this episode, Alex Boyd joins Spencer and Brad. Alex is a shareholder in Polsinelli's national Technology Transactions and Data Privacy practice, shares crucial insights for CTOs, IT Directors, CISOs, Security Managers when responding to security incidents. Discover common misconceptions about breaches and the mistakes organizations make in regulatory compliance. Gain valuable advice on selecting cyber insurance policies and navigating the legal landscape of regulatory investigations, licensing agreements and terms of service.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Send us a Text Message.
In this episode, Brad and Spencer discuss the preparation stage of defending against ransomware. As we know, the time to have a plan is before you enter the woods and cybersecurity is no different.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Send us a Text Message.
In this episode, Brad and Spencer discuss the preparation stage of defending against ransomware. As we know, the time to have a plan is before you enter the woods and cybersecurity is no different.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Send us a Text Message.
In this episode, Spencer and Darrius share their expertise on navigating the world of cybersecurity training and certification. With decades of experience and numerous certifications, they provide valuable insights, tips, and personal stories to help listeners stay ahead of emerging threats and advance their careers in cybersecurity. Whether you're a beginner or a veteran in the field, this episode offers practical advice to enhance your skills and succeed in this ever-changing industry. Tune in to gain insider knowledge and expert guidance from professionals dedicated to protecting digital environments and combating cyber threats.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Send us a Text Message.
In this episode, Spencer and Brad discuss the highly respected 2024 Verizon Data Breach Investigations Report (DBIR), a data-driven analysis of cyberattacks and data breaches from around the world. Tune in to discover the latest global trends and patterns in cybersecurity, as well as key insights for security professionals and executives. Don't miss out on this essential resource that has been shaping the industry for the past 15 years.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer chats with Mark Brophy (of SecurIT360) to discuss his background and experience with coaching a collegiate cyber defense team and how many of those lessons learned from defending against expert red team operators translate to securing organizations in today's modern thread landscape. Another must-listen to episode for all defenders, it admins, cisos, it directors, or anyone else in charge of managing, maintaining and/or securing computers and networks.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Darrius break down the complexities of credential protection, discussing everything from user education and tools to threat modeling and guardrails. Plus, we delve into the world of protecting credentials within scripts and code. This is a must-listen for all IT admins, CISOs and any other IT/Security professional.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Get into the dynamic world of penetration testing with Episode 88 of The Cyber Threat Perspective.
Hosts Brad and Tyler discuss how to plan for penetration testing from both a budgeting and success perspective.
• How to budget for penetration testing - by evaluating risk and compliance needs.
• Discussion on the ways to ensure you're getting value and quality in your penetration testing.
• How to avoid pit-falls before, during and after penetration testing.
• The role of communication in delivering effective pen testing services and client relationships.
• How to establish a proper cadence of offensive security work.
https://OffSec.blog
https://SecurIT360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Tyler dive into the common challenges, struggles and obstacles a pentester may face in their career and they offer advice for dealing with and overcoming those hurdles. Thank you for listening! We hope this episode brings you value! 🙏
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss the XZ backdoor fiasco and share their perspective on what to be thinking about as a defender and what the long-term impact of this event may be.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Darrius discuss DarkGPT, which is an OSINT assistant based on GPT-4-200K (recommended use) designed to perform queries on leaked databases, thus providing an artificial intelligence assistant that can be useful in your traditional OSINT processes.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Discover the vulnerabilities lurking within medical devices and how ethical hacking can safeguard patient care. Join Brad, VP of Offensive Security at SecurIT360, as he unpacks the risks and protections against cyber threats in healthcare tech.
-
Unveiling the risks of wireless communication vulnerabilities in insulin pumps and glucose monitors that could be exploited through advanced hacking techniques.
-
Demonstrating the use of tools like ESP32, Hashcat, and attack scenarios to reveal how medical devices can be manipulated, compromising patient safety.
-
An in-depth analysis of a common air purifier APK, exposing undocumented features and firmware flaws with far-reaching security implications.
-
Real-world examples highlighting the importance of pen testing medical devices, including the potential for increased medication dosing due to infusion pump flaws.
-
A deep dive into the broad-reaching impact of exploited vulnerabilities, from chaos in hospitals to privacy breaches through interconnected devices and mobile apps.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brand and Spencer dive into Defense in Depth. What is it, what does that mean, what are some actionable and practical steps you can take to implement a defense in depth strategy, how does threat modeling and incident response tabletop exercises fit into it and so much more. Do not miss this episode
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we dive into the world of digital forensics and incident response. Spencer, Mark and Andrew discuss the various roles you might see on a DFIR team, the psychology of IR and the stages of incident response, the challenges of responding to cloud compromises, what comes after after the breach and so much more.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Tyler discuss common misconceptions about penetration testing and provide clarity on its purpose and importance in cybersecurity. Join us as we explore the realities behind this vital security assessment, debunking myths and offering insights into its role in safeguarding organizations and data.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Brad deep dive into several tools that IT Admins can use to identify critical issues within Active Directory environments, without breaking the bank. There's a misconception that security can only be achieved by spending large sums of money. That simply isn't the case. Listen to this episode to learn how.
https://pingcastle.com/
https://github.com/mtth-bfft/adeleg
https://github.com/techspence/ScriptSentry
https://github.com/TrimarcJake/Locksmith
https://github.com/BloodHoundAD/BloodHound
https://github.com/EvotecIT/GPOZaurr
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Our expert hosts unpack the intricacies of bug bounty programs, exploring how they've become a pivotal element in the cybersecurity world and also how they fail. Whether you're a cybersecurity professional, an aspiring ethical hacker, or simply curious about the mechanisms that protect our online spaces, this episode comprehensively explores the bug bounty ecosystem.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Join us for an enthralling journey into the heart of cybersecurity operations with “Tales from the Trenches,” an exclusive podcast presented by Brad Causey, Vice President of Offensive Security at SecurIT360. Dive deep into the high-stakes world of offensive security as Brad shares his firsthand experiences from a career spent on the front lines of digital defense.
Engage with real-life stories illustrating offensive cybersecurity's intense challenges and triumphant victories. Brad's narrative will transport you to the core of high-pressure operations, where strategic decisions can impact the security posture of entire organizations. Learn from a seasoned expert who has navigated complex cyber threats; he will shed light on sophisticated tactics, techniques, and procedures that define modern offensive security strategies.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In our "DNS Security" podcast, we delve into DNS's critical role in how the internet works, exploring its vulnerabilities and attacks like DNS spoofing, cache poisoning, and DDoS. We discuss DNSSEC and its components, including public and private keys, and examine practical solutions such as DNS and content filtering. The episode also highlights the advantages of cloud-based DNS services, like those offered by Cloudflare.
Finally, we share best practices and resources for securing DNS infrastructure, addressing challenges like scalability and false positives. Join us for a concise yet comprehensive exploration of DNS security's complexities and solutions.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we dive into the world of Windows and Active Directory and we explore strategies and best practices to secure these systems. This episode will provide you with actionable advice for securing your organization against cyber attacks. We discuss topics such as least privilege, tiered admin model, CIS benchmarks, and much more.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In today's rapidly evolving cybersecurity landscape, where organizations of all verticals and industries are more and more being targeted, organizations must adopt a proactive approach to securing their systems and data. Penetration testing is an essential component of identifying vulnerabilities and weaknesses. However, many organizations fail to extract maximum value from their penetration tests, treating them as isolated events rather than continuous learning opportunities.
This session aims to shed light on the concept of "Assume Breach" and explore how organizations can extract the most value from their penetration tests. By embracing the assumption that systems and users at some point will become compromised, organizations can develop a comprehensive security strategy that goes beyond a checklist approach.
The session will feature real-world case studies and practical examples to illustrate successful Assume Breach penetration tests. Attendees will gain insights into developing a robust security strategy, optimizing resources, and aligning penetration tests with broader organizational goals.
Whether you are a security professional, an IT admin, an MSP, or a business leader, this session will provide valuable insights to enhance your understanding of penetration testing as a continuous improvement process and empower you to strengthen your customer's security posture.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we discuss soft skills and mental health for security professionals.
Soft Skills
- self-awareness
- Gumption (initiative & resourcefulness)
- Autodidactic (self-educate)
- Empathy
- Patience
- Determination
- Communication - This is one to hit heavily
- Written & Spoken
- read the room
- Creativity (BS-ing)
- Attention to detail
- Curiosity
Mental Health
- do you truly enjoy/love what you do?
- work-life balance
- change the definition of "success"
- give yourself a break/don't be so hard on yourself
- schedule time to yourself for escapism
- find a hobby
- don't force inspiration because you can't
- when you're feeling inspired capitalize on it
- stand on the shoulders of giants
- 24-hour exams
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we discuss password spraying, a favorite technique among attackers who are trying to compromise organizations. Spencer and Tyler discuss external and internal password spraying, why it is so effective, how password spraying works, and what to look out for on your network.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer is joined by Daniel Perkins, a Senior Information Security Officer at SecurIT360 to discuss the intricacies of vulnerability management, the important prerequisites to vulnerability management, and best practices, and provide actionable strategies to level up your vulnerability management program.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Zach Sims (Information Security Officer at SecurIT360) provides valuable insights into offensive security services from the perspective of a security leader. This episode explores the significance of these services in today's digital landscape. Listeners gain a concise understanding of the CISO's role, the alignment of offensive security goals with cybersecurity strategy, and the challenges faced in implementation. The discussion also delves into how CISOs balance the need for offensive and defensive security assessments, offering a compact yet informative overview of key aspects of the world of information security.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This is part two of Future Trends in Pentesting. Spencer and Darrius, members of SecurIT360's offensive security team discuss up and coming techniques, tools and tactics that they see on the horizon for 2024 and beyond.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Darrius discuss future trends in penetration testing. We plan for this to be a multi-part series and in this part listen to Brad and Darrius delve into why keeping pace with current and future trends is important, evolving threats, the cloud and much more!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode of "The Cyber Threat Perspective," Tyler and Brad, members of SecurIT360's offensive security team, take us through the evolution of various penetration testing TTPs. Specifically, using the external penetration test process as an example and analyzing other processes and why/how they changed.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Tyler go "behind the hack" and discuss what life is like behind the keyboard of an external pentest. They discuss various parts of an external penetration test such as planning and preparation, execution, and post-exploitation as well as common challenges throughout the way.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This week we are replaying one of our earliest episodes. In this episode, Brad and Spencer discuss the THREE primary ways we gain initial access on penetration tests and how to stop us! The moral of this story is that these are attack vectors we see adversaries using day in and day out to compromise organizations. We hope this episode helps you track down and close those gaps in your own environments.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Darrius discuss a common divide found among companies between the Security Team and the development teams. These are two teams that are ultimately trying to benefit the company, and by working together both are able to succeed.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This is the November 2023 Cyber Threat Recap. Every day our Cyber Threat Intelligence team is tracking, researching, and analyzing threats, vulnerabilities, exploits, and techniques with the purpose of keeping you up-to-date on what's relevant and important in the industry. So you can be more prepared today than you were yesterday to protect your organization.
Okta Breach/1Password
- Okta says its support system was breached using stolen credentials
- 1Password Detects Suspicious Activity Following Okta Support Breach
- Hackers Stole Access Tokens from Okta’s Support Unit – Krebs on Security
Octo Tempest
- https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/
Trends
- https://www.simplilearn.com/top-cybersecurity-trends-article
- The 10 Biggest Cyber Security Trends In 2024 Everyone Must Be Ready For Now
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this very special Halloween episode, prepared to be scared. Brad and Spencer discuss the common and not so common locations that we find credentials during penetration tests. This includes plaintext credentials and other types of credential material like API keys.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Darrius go "behind the hack" and discuss what life is like behind the keyboard of a web application penetration tester. They discuss various parts of a web app penetration test such as planning and preparation, execution, and post-exploitation as well as common challenges throughout the way.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Spencer go "behind the hack" and discuss what life is like behind the keyboard of an internal penetration tester. They discuss various parts of an internal penetration test such as planning and preparation, execution, post-exploitation as well as common challenges throughout the way.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode we discuss what makes a great penetration test report. The report is THE crucial deliverable of a penetration test. It's the culmination of all the effort that went into testing. It not only provides insights into an organization's security posture but also serves as a roadmap for addressing vulnerabilities and improving overall security.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we explore the various tactics used by malicious actors to manipulate individuals and organizations, and provide practical tips to safeguard against these attacks. From educating your team members to implementing strong security measures, join us to learn how to effectively protect yourself and your organization from social engineering threats.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Darrius discuss unpopular Cybersecurity opinions, which are referred to as "hot takes." This discussion was inspired from a tweet by John Breth (@JBizzle703) which as of recording has close to 4 million views.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Darrius and Spencer discuss Offensive Security TTPs and tools that look promising, that we're excited for, or are trending.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, we're talking about How To Identify and Mitigate Insecure Windows Services. This is a very common issue we see on internal pentests. So much so that day 1 of our internal pentests revolves around evaluating the security and configuration of the endpoint to identify these issues. But this is only the tip of the ice burg.
https://offsec.blog/hidden-danger-how-to-identify-and-mitigate-insecure-windows-services/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode we talk all about Active Directory Certificate Services and a free tool designed to help find and fix AD CS misconfigurations called Locksmith. Jake Hildreth (Mastodon: @horse@infosec.exchange) the creator of Locksmith together with Sam Erde (Twitter: @SamErde) and myself (who are contributors to the project) chat about the inception of Locksmith and some of the awesome features, such as remediation snippets.
Invoke-Locksmith today!
https://github.com/TrimarcJake/Locksmith
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Spencer talk about how vulnerabilities are assigned severity ratings, why they are important, how they are not perfect and why you should not rely on severity ratings alone to determine risk.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Spencer discuss the role EDR and Antivirus plays in a modern security stack, the overreliance on EDR, and how that's a dangerous game.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode we're talking about misconfigured and dangerous logon scripts. Spencer and Brad discuss 4 common examples, based on real-world engagements, of how logon scripts can be misconfigured and how they can allow for all sorts of bad things. Do you know what's hiding in your logon scripts?
https://github.com/techspence/ScriptSentry
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This episode concludes our miniseries all about PowerShell. In this episode, we're going to discuss How to Defend and Mitigate PowerShell Attacks. Definitely check out our previous episodes: How Attackers Use PowerShell, and Security Automation with PowerShell.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Tyler discuss the most important things you must do before you have an external penetration test. Everything from understanding goals and objectives to asset management to dark web searches. Listen in as Tyler shares how the SecurIT360 external pentest process may be different from other pentests you've received in the past.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Spencer and Darrius continue their series of episodes all about PowerShell. In this episode, they discuss using PowerShell for automation and orchestration. Stay tuned for the next episode where we talk about defending against PowerShell abuse.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss how cyber adversaries harness the power of PowerShell to orchestrate their malicious activities. Stay tuned for the next episode where we talk about defending and mitigating PowerShell attacks.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer discuss the nuances around scoping offensive security engagements. Scoping an offensive security engagement involves defining boundaries, objectives, and limitations before starting. It includes objectives, rules, scope boundaries, legal considerations, timeframe, reporting, approval, and sign-off. Scoping is important for clarity, risk management, compliance, stakeholder involvement, and setting expectations.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Darrius talk about Authentication and what issues they routinely see while performing penetration tests. They walk about MFA, Passwords, Conditional Access, and other solutions that, done right, will improve your external security posture.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer, Darrius and Tyler get together for a round-table discussion on sharpening your sword as a pentester. They discuss what they do to keep improving, upping their skill and honing their craft. Spoiler, it's not just the technical aspects of pentesting that are important to work on.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss and explore Active Directory security risks from a hacker's point of view. They discuss various techniques and tools that attackers use to attack Active Directory and how you can reduce your organization's risk by finding these vulnerabilities and misconfigurations and fixing them.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Tyler and Brad talk about the most common external penetration test findings. We see these findings over and over again and want you to know what to do about them and how they may impact you.
Check it out!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Darrius and Brad talk about the need for coding skills in the offensive security world. There's some fun with regard to which languages are important too. Check it out!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode John Hammond joins us on the show! We talk about John's background and how he got interested in computers, how he approaches learning a new topic, if you have to create content to grow your career and so much more. There's a whole lot of fun and smiles and joy in this episode, check it out!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
OSINT - Open Source Intelligence: is the process of collecting and analyzing publicly available information in order to achieve some goal or facilitate some kind of action. OSINT can and is used for all sorts of things and it's applicable to virtually every industry. OSINT like many other things, can be used for good and it can be used for evil. But it's what you don't know about OSINT that can really hurt you...
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad, Spencer and Tyler discuss the major differences and pros and cons of Security Assessments and Penetration Tests. In the end they are both very different types of assessments and require different skill sets to perform. If you're in charge of IT or Security at your organization, this is a must-listen episode!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
It's no secret law firms have become prime targets for attackers due to the sensitive information they handle and the clients they do business with. In this episode Brad and Spencer discuss common tactics used by attackers to breach law firms' defenses and provide practical tips on how to detect and prevent these types of attacks.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This is part 2 of a 2 part series where Spencer, Darrius and Tyler talk about pentesting certifications and where they fall on a tier list. For those unfamiliar, we're ranking the popular pentesting certifications from best to worst. This is a must listen/watch episode, check it out and be sure to let us know in the comments what YOU think of these certifications and if we had any bad takes!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This is part 1 of a 2 part series where Spencer, Darrius and Tyler talk about pentesting certifications and where they fall on a tier list. For those unfamiliar, we're ranking the popular pentesting certifications from best to worst. This is a must listen/watch episode, check it out and be sure to let us know in the comments what YOU think of these certifications and if we had any bad takes!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Darrius continue the Offensive Security Testing series and discuss Wireless Penetration Testing. Wireless Pentesting is often overlooked, but could be the blind spot that allows an attacker onto your network. Listen to this episode for key insights and considerations related to wireless networks and pentesting.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer discuss the differences between a Penetration Test, Purple Team Exercise and a Red Team Engagement. The goal of this episode is to help educate and inform on the differences between a pentest, a purple team and a red team, what the goals of each may be, and how they help an organization improve security and resilience.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Spencer and Tyler discuss Tyler's journey from working at Home Depot to getting a job as a Penetration Tester. They also share first-hand advice for those that are looking to break into this exciting field.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Darrius and Brad look at the current state of web application penetration testing, why it is how it is, and what you can do if you want to break into the field.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Darrius talk about some of the buzz around recent changes in privacy regulation/law and how it may impact other market verticals such as banking, law firms, and retail.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer shares his affinity for PingCastle. If you are in IT, if you're a sysadmin or network admin or have any kind of responsibility for the security of your environment. I encourage you to have a look at PingCastle. Not only can it be used to find VERY severe vulnerabilities, but you can use it to track progress over time and show leadership you're doing the work. We also talk about some of my favorite ways to use this tool on penetration tests.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer discuss some of the more, interesting, pentest engagements they've been on. The goal of this episode is to reflect on some of the significant vulnerabilities and "cool" attacks we've performed on pentests, yes, but it's also an important reminder that if we don't remember history we are bound to repeat it. Yes we are total nerds and no we're not going to apologize for that ;)
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Spencer discuss the newly released information surrounded the 2022 LastPass data breach. They discuss potential controls that may have prevented the incident and recommendations for protecting your own organization against this kind of threat.
https://support.lastpass.com/download/lastpass-blog-security
https://support.lastpass.com/help/what-data-was-accessed
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer vulnerabilities that are not detected by vulnerability scanning tools such as Nessus and explored several methods that can be used to identify them. While vulnerability scanning is important and effective at identifying known vulnerabilities, they are not so good at detecting unknown or complex vulnerabilities. To address this gap, we discussed several complementary methods that can be used, such as penetration testing, red teaming, fuzzing, and source code review, to identify vulnerabilities and weaknesses that may not be apparent from a vulnerability scan. By incorporating these additional methods into a comprehensive security testing strategy, organizations can gain a better understanding of their security posture and take steps to address vulnerabilities before they can be exploited by attackers.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Brad and Darrius discuss recent and upcoming changes made to the BurpSuite line of products. If you're a web application penetration tester or just interested in web application security, check this out, it's a game-changer.
PortSwigger Post: https://portswigger.net/blog/burp-suite-roadmap-update-january-2023
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer discuss all the bad advice that's been given over the years regarding passwords and they provide insights into why the current state of passwords are the way they are. Chances are you're like us and you've made each and every one of these password mistakes before. If you want to know what to not do when it comes to passwords, this episode is exactly what you need.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss a variety of things you can and should be doing to secure your cloud environments. While the majority of these quick wins pertain to Microsoft 365 and Azure, the same concepts can be applied to AWS, Okta, Duo and others. Take the time to know your environment and secure it well. We hope this episode helps give you ideas on how to further secure your cloud infrastructure.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer, Darrius and Brad answer the question: "What do I need to do before I have someone pentest my network or my web app or my environment?" Spencer talks about important considerations before internal pentests, Darrius talks about the critical components to focus on before a web app or even an API pentest and Brad wraps it up with two foundational security components to ensure you have in place before an external pentest.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss some seriously free and relatively "easy" quick wins for hardening your Active Directory and internal environment. We go from talking about weak passwords to discussing nested group membership and a whole lot more. This episode is jam packed with advice, that's free and easy to implement. We hope you enjoy and get value from it!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Tyler continue the Offensive Security Testing series and discuss External Penetration Testing. We discuss all things external pentesting including what is an external pentest, what is PTES, how external pentests work operationally, pros and cons of different types of external pentests and so much more. Stay until the end of the podcast because Tyler shares war stories and talks about things that can get your organization compromised and how to prevent that.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss the most recent LastPass Breach. We talk all about what happened, what it means to you and I as well as what it means for firms who use LastPass on an enterprise level. At the end we discuss some thoughts and opinions around with LastPass versus finding a new password vault product and some things to pay attention to if you're in the later boat.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode we've got the whole Offensive Security team at SecurIT360 on the podcast to talk about exciting moments of 2022 and what everyone is exited for as we move into 2023 and beyond. Thank you for listening and/or watching! If you enjoy our podcast we'd love to know what specifically you enjoy so we can make more of that type of content. Merry Christmas and Happy New Year!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Darrius discuss an amazing new AI chatbot that has taken the internet by storm and captivated the infosec community. Listen to this episode to learn what ChatGPT is, how it can be used (and abused) and what the possible implications are (good and bad) of such an amazing piece of technology.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
CTF, or Capture The Flag, is a great way to expand your learning and understanding of various information security topics. It can also be great fun and a great way to meet people in the industry. In this episode Spencer and Darrius talk about the benefit of using CTFs to keep your pentesting skills sharp over the holiday "break."
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/@cyberthreatpov
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode, Darrius and Brad talk about Portswigger's Burp Suite, how they use it, and why it's important. They also offer a sneak-peak into what's coming in 2023!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Spencer and Brad talk about the hidden dangers of not properly protecting Microsoft WSUS Servers. That's Windows Server Update Service for those not in the know. Attackers often use legitimate functionality to gain ground and WSUS is no different.
Nettitude blog discussing SharpWSUS: Introducing SharpWSUS - Nettitude Labs
Spencer's fork of SharpWSUS: GitHub - techspence/SharpWSUS: SharpWSUS is a c# tool for abusing Microsoft Windows Server Update Services for Lateral Movement
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad is joined by Matt Tesauro to talk all things OWASP, API Hacking and DevSec. Matt Tesauro is a Distinguished Engineer at NoName Labs, a member of the OWASP Global Board of Directors and Founder of 10Security, the creators of DefectDojo.
Matt Tesauro is a DevSecOps and AppSec guru with specialization in creating security programs, leveraging automation to maximize team velocity and training emerging and senior professionals. When not writing automation code in Go, Matt is pushing for DevSecOps everywhere via his involvement in open-source projects, presentations, trainings and new technology innovation.
Twitter: https://twitter.com/matt_tesauro
LinkedIn: https://www.linkedin.com/in/matttesauro/
DefectDojo: https://www.defectdojo.org/
DefectDojo on Github: https://github.com/DefectDojo/django-DefectDojo
DefectDojo commercial support: https://www.defectdojo.com/
API Security: https://www.slideshare.net/mtesauro/hacking-and-defending-apis-red-and-blue-make-purplepdf
API Security Tools: https://owasp.org/www-community/api_security_tools (always looking for additions!)
OWASP:
Become an OWASP Member: https://owasp.org/membership/
Find a local chapter: https://owasp.org/chapters/
Find a cool project: https://owasp.org/projects/
OWASP Cheat Sheets: https://cheatsheetseries.owasp.org/
OWASP Web Security Testing Guide: https://owasp.org/www-project-web-security-testing-guide/
OWASP Mobile Application Security: https://owasp.org/www-project-mobile-app-security/
OWASP API Security Top 10: https://owasp.org/www-project-api-security/
OWASP Dependency-Check: https://jeremylong.github.io/DependencyCheck/
OWASP Dependency-Track: https://dependencytrack.org/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Are you looking for your first job in penetration testing? Perhaps you're looking to advance and up your skills or maybe you're a manager looking to hire a penetration tester to your team. In this episode Brad, Spencer and Darrius talk about which pentesting certs to get and why.
This is part 3 of a multi-episode series where the Offsec group at SecurIT360 dives into the details of various Offensive Security Tests, what they mean, what to expect, war stories and much more!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This is part 2 of a multi-episode series where the Offsec group at SecurIT360 dives into the details of various Offensive Security Tests, what they mean, what to expect, war stories and much more!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Coming at you LIVE from LegalSec22 in San Antonio Texas. In this episode Brad and Spencer discuss common security challenges that are unique to law firms and provide insights on ways to begin solving those challenges.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This is part 1 of a multi-episode series where the Offsec group at SecurIT360 dives into the details of various Offensive Security Tests, what they mean, what to expect, war stories and much more!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Web application risks are not new, but they are different because how they have fully proliferated all aspects of modern computing. Everything lives on HTTP or HTTPS or some webservice. Tune into this episode to learn about some of the most common risks we see with web applications in the modern landscape.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
There's essentially a 0% unemployment rate in cybersecurity. It's a very hot field, great job security, great pay and great mission. But, with that comes a high level of competition for individuals seeking cybersecurity jobs. So on today's episode, Brad and Spencer talk with Misty Stacy, Managing Partner at Trusted Cyber Talent, who is on the forefront of helping cybersecurity professionals find their first or next cybersecurity job.
Looking for help getting a job in Cyber? Check out https://testedcybertalent.com or reach out to Misty at https://www.linkedin.com/in/mistystacy
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer discuss the THREE primary ways we gain initial access on penetration tests and how to stop us! The moral of this story is that these are attack vectors we see adversaries using day in and day out to compromise organizations. We hope this episode helps you track down and close those gaps in your own environments.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Uber was hacked * Microsoft Teams stores auth tokens as cleartext in Windows, Linux, Macs * Ransomware Developers Turn to Intermittent Encryption to Evade Detection
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this episode Brad and Spencer talk about what mature, proactive organizations are doing to harden and secure their environments, with the end goal of forcing attackers to make more noise which hopefully leads to quicker detection and ejection from your network. These are things that get us caught and slow us down on penetration tests and they are things that will absolutely do the same to real threat actors.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:
- New EvilProxy Phishing Service Allowing Cybercriminals to Bypass 2-Factor Security
- New Linux Malware Evades Detection Using Multi-stage Deployment
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Are you sure you're getting what you paid for when it comes to external penetration tests? In this podcast Brad and Spencer discuss 5 things that you as a consumer of penetration tests can do to get more value from them. Some of these are easy wins, some of them require work, all of them will make your external pentests better.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Roasting 0ktapus: The phishing campaign going after Okta identity credentials * Advanced BEC Scam Campaign Targeting Executives on O365 * The Rise of LNK Files (T1547.009) and Ways To Detect Them
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
It's an unfortunate truth that we see these common high risk findings time and time again on internal pentests. We find these issues on super-maximum secured environments as well in less hardened environments. The end result though is the same. Tune in to learn more about these common high risk findings and most importantly, how to mitigate them for free!
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Hackers Breach LastPass Developer System to Steal Source Code * You Can’t Audit Me: APT29 Continues Targeting Microsoft 365 | Mandiant * The GitLab 2022 Global DevSecOps Survey
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In order to stay relevant and up-to-date with new techniques and tools, it requires a certain amount of focus day after day, week after week, year after year. That focus being constant improvement. If we, as pentesters, don’t get better, we can’t help businesses defend better.
So that’s what this podcast is about. Constant improvement and showing that off to the world. We are going to talk about WHY you would want to show off your skills as a pentester as well as 7 awesome ways to do just that, show off your skills as a pentester.
Read the associated blog post here: https://offsec.blog/7-awesome-ways-to-show-off-your-skills-as-a-pentester/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Cleartext Shenanigans: Gifting User Passwords to Adversaries With NPPSPY * Realtek SDK Vulnerability Exposes Routers + InfoSec Handlers Diary Blog - SANS Internet Storm Center + CVE-2022-27255 - Realtek eCos SDK SIP ALG buffer overflow * Clop Ransomware Gang Breaches Water Utility, Just Not the Right One + https://twitter.com/malwrhunterteam/status/1559244860636413952?s=20&t=ixiTRaQ9aflHzI37D_VlwQ + https://twitter.com/UK_Daniel_Card/status/1559252446320500741?s=20&t=ixiTRaQ9aflHzI37D_VlwQ
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This podcast is a discussion about 4 Common Pentesting Mistakes that we oursleves have made and have seen other pentesters make. Hopefully, the dialog around these mistakes and how we go about solving them, helps you not make them yourself or to realize them and recover from them quickly.
Read the associated blog post here: https://offsec.blog/its-a-trap-avoid-these-4-common-pentesting-mistakes/
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* BumbleBee Roasts Its Way to Domain Admin * SMS & Voice Phishing Attacks + https://www.twilio.com/blog/august-2022-social-engineering-attack + https://blog.cloudflare.com/2022-07-sms-phishing-attacks/ + https://blog.talosintelligence.com/2022/08/recent-cyber-attack.html
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
Brad and Spencer discuss a common finding on internal penetration tests.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Large-Scale AiTM Attack targeting enterprise users of Microsoft email services * Deception at a scale * Initial Access Brokers Are Key to Rise in Ransomware Attacks
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
This podcast is a discussion about the 2022 Verizon Data Breach Investigations Report and some of our key takeaways.
From the Executive Summary of the DBIR: As introduced in the 2018 report, the DBIR provides “a place for security practitioners to look for data-driven, real-world views on what commonly befalls companies with regard to cybercrime.” For this, our 15th anniversary installment, we continue in that same tradition by providing insight into what threats your organization is likely to face today, along with the occasional look back at previous reports and how the threat landscape has changed over the intervening years.
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* IPFS The New Hotbed of Phishing * How Threat Actors Are Adapting to a Post-Macro World * Palo Alto 2022 Incident Response Threat Report * Fewer Ransomware Victims Pay As Medium Ransom Falls in Q2 2022
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review: * Microsoft resumes default blocking of Office macros after updating docs + https://docs.microsoft.com/en-us/deployoffice/security/internet-macros-blocked + A potentially dangerous macro has been blocked * BlackCat ransomware attacks not merely a byproduct of bad luck * 'AIG' Threat Group Launches With Unique Business Model
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:* Microsoft DOES plan to work on blocking internet macros by default in Office, their pause is apparently temporary * The DFIR Report - SELECT XMRig FROM SQLServer * Hive ransomware gets upgrades in Rust * From cookie theft to BEC: Attackers use AiTM phishing sites as entry point to further financial fraud
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Microsoft Rolls Back Decision to Block Office Macros By Default 😢 * Possible APT29/Ransomware Groups Use of Brute Ratel C4 + When Pentest Tools Go Brutal: Red-Teaming Tool Being Abused by Malicious Actors + Reversing Malware Also How is APT 29 Successful with This Phishing Technique * Raspberry Robin/QNAPWorm + Raspberry Robin gets the worm early + Microsoft finds Raspberry Robin worm in hundreds of Windows networks + New Raspberry Robin worm uses Windows Installer to drop malware * Cloud Misconfig Exposes 3TB of Sensitive Airport Data in Amazon S3 Bucket * Prevention Takes Priority Over Response
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review* Rise of LNK (Shortcut files) Malware * LockBit 3.0 Released Now With Bug Bounty Program * CISA Says PwnKit Exploited in the Wild
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:* New NTLM Relaying Attack via DFSCoerce * Ransomware Potential for OneDrive & SharePoint Files * Keeping PowerShell: Security Measures to Use and Embrace
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:* The rise of BlackCat (ALPHV) ransomware + Microsoft Analysis of BlackCat + AdvIntel Analysis of BlackCat + Ransomware Group Debuts Searchable Victim Data * LockBit 2.0: How This RaaS Operates and How to Protect Against It * Translating Saitama's DNS tunneling messages - SANS Internet Storm Center * Public Travis CI Logs (Still) Expose Users to Cyber Attacks
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:* A DFIR Report with no Ransomware and no Cobalt Strike * Path Traversal & MOTW Bypass - DIAGCAB Windows Zero-day aka "Dogwalk" * Linux version of Black Basta ransomware targets VMware ESXi servers * TA570 Qakbot (Qbot) tries CVE-2022-30190 (Follina) exploit (ms-msdt)
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:* Microsoft Diagnostics Tool Remote Code Execution Zero Day * New Windows Search zero-day added to Microsoft protocol nightmare * Vendor Refuses to Remove Backdoor Account That Can... * Over 3.6 million exposed MySQL servers on IPv4 and IPv6 |... * APTs Overwhelmingly Share Known Vulnerabilities Rather Than Attack O-Days
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
The sky IS NOT falling with this one. Is it important? Yes. Does it highlight an area that's under-researched and likely contains additional attack vectors and techniques? Absolutely.
Resources
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190
https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
https://www.huntress.com/blog/microsoft-office-remote-code-execution-follina-msdt-bug
https://github.com/NVISOsecurity/nviso-cti/blob/master/advisories/29052022%20-%20msdt-0-day.md
John Hammond's Excellent CVE-2022-30190 Video
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
In This Weeks Review* PDF Malware Is Not Dead Yet * Detecting & Preventing Rogue Azure Subscriptions * Python and PHP Library Updated with 'Extra' Features by a "Security Researcher" * 2022 Verizon Data Breach Investigations Report * Zoom: Remote Code Execution with XMPP * Exploit released for critical VMware auth bypass bug
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In This Weeks Review* Gootloader & Gootkit Analysis by DFIR Report and Red Canary * Authenticated PetitPotam Lives On (CVE-2022-26925) * The Hunter Becomes the Hunted: Evicting the Adversary * Spoofing SaaS Vanity URLS for Social Engineering Attacks
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In This Weeks Review* Threat Actor using Windows Event Logs for "fileless" Malware * CVE-2022-1388 - F5 BIG-IP PoC Released * CVE-2021-22600 - Privilege Escalation Bug In The Linux Kernel * CVE-2022-26925 - A Windows LSA Spoofing Vulnerability (PetitPotam) * CVE-2022–26923 - Another ADCS Domain Privilege Escalation
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
In this week's review:
- Detecting SharpHound using Decoys
- UNC3524: Eye Spy on Your Email | Mandiant
- The New Initial Access Trend: ZIPs, ISOs & LNKs
- Unauthenticated RCE in F5 BIG-IP CVE-2022-1388
Blog: https://offsec.blog/
Youtube: https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw
Twitter: https://twitter.com/cyberthreatpov
Work with Us: https://securit360.com
There exists a universal no-fix local privilege escalation in Windows domain environments where LDAP signing is not enforced (the default settings). Thanks to the research and open source tools of several researchers, it's now trivial to elevate to SYSTEM on most Windows Operating Systems.
Resources:
https://github.com/Dec0ne/KrbRelayUp
https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
https://github.com/cube0x0/KrbRelay
https://github.com/Dec0ne/KrbRelayUp
Social:
https://twitter.com/cyberthreatpov
https://www.youtube.com/channel/UCCWmudG_CTNAFBaV48vIcfw