BloodHound data collection, aka Sharphound, is quite a complex beast.
When giving BloodHound workshops, the part where I get the most questions is always data collection.
How is the BloodHound data collected? What methods do what? Who am I talking to? How do I fly under the radar? Continue reading “DogWhisperer’s SharpHound Cheat Sheet”
Tag: Active Directory
Doing it Server-Side with CypherDog 4.0
Arrroooo… Bloodhound Crew!! Heard the news? CypherDog 4.0 is out and it’s full of new features…
Continue reading “Doing it Server-Side with CypherDog 4.0”
Continue readingDog Whisperer Update
With the current situation, it’s not easy to find the right angle to start this blog post, so I won’t even try… but with Troopers cancelled, my Bloodhound workshop went down the drain, and I didn’t get a chance to meet or catch up with all of you and share my latest BloodHound adventures. So I decided to write a quick post to share all this…
Continue reading “Dog Whisperer Update”
Continue readingBlue Hands On Bloodhound
Hi there,
SadProcessor here, happy to be back on the Insinuator to share with you some of my latest BloodHound adventures and experiments…
TL;DR Well too bad for you… Continue reading “Blue Hands On Bloodhound”
Continue readingA Follow-Up on the Heisec Webinar on Emotet & Some Active Directory Security Sources
Some weeks ago, Heinrich and I had the pleasure to participate in the heisec-Webinar “Emotet bei Heise – Lernen aus unseren Fehlern”. We really enjoyed the webinar and the (alas, due to the format: too short) discussions and we hope we could contribute to understand how to make Active Directory implementations out there a bit safer in the future.
Continue readingDirectoryRanger 1.5.0 Is Available
The next major release of DirectoryRanger is now available for customers, and for everyone who would like to try it ;-). Current attacks show that quite often the topic of Active Directory Security is not on the security agenda, but it should be, and this was the reason for us to build the tool and, of course, to maintain and improve it. So what are the major new features released with DirectoryRanger 1.5.0? Here we go:
Continue reading “DirectoryRanger 1.5.0 Is Available”
Continue readingEmotet im Active Directory: Es kann jeden treffen – aber Jeder kann es dem Angreifer schwer machen!
Heise berichtet aktuell öffentlich über die Emotet-Infektion im eigenen Haus, bei dessen Aufklärung ERNW unterstützte. Damit liefert Heise Informationen zum Verlauf aktueller Angriffe, aber insbesondere auch wertvolle Einsichten zu Vorbeugung, Erkennung, Analyse und Gegenmaßnahmen aus eigener Erfahrung, wie sie nur selten der Öffentlichkeit preisgegeben werden.
Ein Team aus Incident-Response Spezialisten der ERNW Research unterstützte Heise bei der Analyse und Rekonstruktion des Vorfalls und analysierte die Schadsoftware, um deren Ausbreitungswege nachzuvollziehen und IoCs (Indicators of Compromise) zu extrahieren. Hierdurch konnten effektive Gegenmaßnahmen entwickelt und gemeinsam mit Heise erfolgreich umgesetzt werden.
Im Zuge dessen unterstützten Active-Directory-Spezialisten der ERNW Heise bei der Konzeption und dem Wiederaufbau eines neuen Active Directory. Im heisec-Webinar am 3. Juli berichtet Heise über den Incident und die wichtigsten Erkenntnisse daraus. Dabei sein werden zwei unserer Active Directory-Security-Spezialisten. Sie werden Konzepte und Verfahren für ein sicheres, resilientes und trotzdem betreibbares Active Directory vorstellen und den Teilnehmern mit Tipps für Containment nach einer Infektion und in gemeinsamer Diskussion zur Verfügung stehen.
Bei Interesse an diesem Thema beachten Sie auch die vielen Vorträge internationaler Active Directory-Security-Spezialisten des Active Directory Security Tracks auf der diesjährigen Troopers (so wie unsere eigenen Beiträge dazu, wie etwa hier und hier) und unsere Workshops zu Active Directory-Sicherheit und Inicdent Response.
Wir wünschen allen Lesern ein schönes verlängertes und hoffentlich Incident-freies Pfingstwochenende!
Friedwart Kuhn & Andreas Dewald.
Continue readingTroopers & Chill…
As promised in my previous post, I am back for an overview of the Troopers19 – Active Directory related talks… Videos have been published and it’s popcorn time… So if you are into stories about Kingdoms and Crown Jewels, grab your loved one [or a drink…] and turn the lights down low, ’cause tonight it’s “Troopers & Chill…”
Continue reading “Troopers & Chill…”
Continue reading2019 – Year Of The Blue Dog…
Back from Holidays, you started the year well motivated to make the world a safer place.
However, sitting at your desk today you realize nothing really changed since last year, and you are surfing the web, feeling a bit blue, trying to avoid that pile of emails waiting for you and wondering how you could gain some visibility on your domain in order to better defend it.
No worries, emails can wait a bit longer. All you need is some fresh air and something cool to keep your defensive mind motivated for the year, and I might have just what you need; so put on your shoes and let me take you on a 15 minute Cypher walk with a cool blue dog…
Continue reading “2019 – Year Of The Blue Dog…”
Continue reading#TR19 Active Directory Security Track
As some of you might recall we’ve introduced a dedicated “Active Directory Security Track” at last year’s Troopers. For Troopers19 we’ve expanded it to two days (as the SAP Security Track was discontinued), and in the following I’ll provide a list of talks in the track.
Continue reading “#TR19 Active Directory Security Track”
Continue reading