Tag Archives: InfoSec

Jumphost Security

Posted on by One comment

Let’s go quickly through an example in which an attacker has code execution on a Windows 10 box and opens a proxy channel to an attacker machine. The attacker then uses ‘proxychains’ which ingests all network output from defined tools on the attacker machine into the proxy tunnel to the Windows 10 box.

With that, we will be able to start an RDP session on the attacker machine, proxy it through the Win10 machine to the local Domain Controller.

The result of that is a Domain Controller that only sees an RDP connection coming from the Win10 box and no MSTSC process on this Win10 box. Please, read the last sentence again. This makes the detection of the attacker steps harder

Read more

Manage office atp alerts like a boss

Posted on by 2 comments

Let’s face it: Sometimes you get false positives in Office ATP phishing Emails. Either this is caused by the system or you have scheduled a phishing simulation from a third party provider that cannot be properly whitelisted. I have created a PowerShell script that connects to the Office 365 Management API and grabs all the needed information from the investigations and from the alerts and displays it in ONE Excel table.

Read more