Tag Archives: Security

AI & Security: Introduction (Part 1)

Posted on by Leave a comment

In this blog series I am diving into the topic of Large Language Models and how they can help and harm security. Help and harm? At least in my age, everybody has learned nothing new comes without both of these aspects, you never get only the good without the evil. From a defenders perspective this means, you can embrace the good and have to find mitigations for the bad.

But before coming to that point, in this post, we will take a look at the basics. My goal for this article is to summarise the most important facts about LLMs in a most simple way.

Read more

Jumphost Security

Posted on by One comment

Let’s go quickly through an example in which an attacker has code execution on a Windows 10 box and opens a proxy channel to an attacker machine. The attacker then uses ‘proxychains’ which ingests all network output from defined tools on the attacker machine into the proxy tunnel to the Windows 10 box.

With that, we will be able to start an RDP session on the attacker machine, proxy it through the Win10 machine to the local Domain Controller.

The result of that is a Domain Controller that only sees an RDP connection coming from the Win10 box and no MSTSC process on this Win10 box. Please, read the last sentence again. This makes the detection of the attacker steps harder

Read more

MDE Hunting 101

Posted on by One comment

People that start working with Defender for Endpoint (MDE) often ask the question “where should I start when I see an alert in MDE?”. There is lot of valuable information available in the portal to help judge if an alert is a real incident or a false positive. Additionally, you can query the raw telemetry via KQL. But there is still lot of room for interpretation. So, what should you do to get started? And what is even more important: how do I keep the overview?

Read more