Hide and Seek
In this article, I give you an example of how malware is hiding through packer techniques to prevent getting caught on your systems. For that, I have recorded a small ‘adventure’ for you that I took last night.
Read moreCategory Archives: Main Articles
You can be hacked with two lines of JavaScript
I bet many company and consumer users out there can be hacked from remote with only a couple lines of JavaScript. In this post I use two lines to start arbitrary programs. You will be surprised how easy this is.
Read moreDeep Dive: Forensics via MDATP Live Response
In this post, I am digging deep into hidden possibilities with MDATP Live Response.
Read morePim Me Now !
PimMeNow is a small PowerShell GUI Tool that handles Azure AD Privileged Identity Management (PIM) connects to multiple tenants.
Read moreBlock it.
There have been times, were there was no answer, when the question was raised: “how can I block access to certain internet domains in the modern workplace scenario?” – Those times are over.
Read moreThreat Hunting with MTP: The Sixth Sense
Let’s assume you just learned about this new vulnerability in in VLC. Attackers can exploit it by sending .mkv files to your users via Email. Pretty easy – pretty dangerous.
Read moreGo, hack yourself! – Ignite 2019 Edition
In spring 2019 I have written a post on how you can hack yourself to better understand the Microsoft Tools that help you defend modern attacks. Since then, several month and one MS Ignite have been past, in other words: things have changed.
Read moreMDATP: talking to the User
Sometimes isolating or blocking user actions (like downloads) is too restrictive – instead you just want to warn or ‘educate’ him. At the same time, I don’t know too many ITpros that enjoy talking to their end-users (I think we all should, but this is another story). Today we will look into a flow-automation of Microsoft Defender Advanced Threat Protection (MDATP) alerts.
Read moreMicrosoft Defender ATP Streaming API
In the past, we could consume the MDATP API ‘on demand’ (pull) by PowerShell for example.
We could even do advanced hunting queries via the API.
However, pulling the data out of MDATP might bring in some delay in one or the other scenario and the information from the advanced hunting results are limited to the last 30 days.
With the brand new ‘Streaming API’, Microsoft is offering a new approach to make data from MDATP available outside of the portal.
Read moreThe New Unified Identity SecOps Experience
The new Unifed Identity SecOps Experience brings together information from Azure ATP, Microsoft Cloud App Security (MCAS) and Azure AD Identity Protection.
In this blog post, we will look into the new UI and evaluate which value it has. However – as always-, I am trying to add a little ‘spice’ and therefore we will build in some Mimikatz action. Be exicted :-).
Read more