237 matches found
June 8, 2021—KB5003667 (Monthly Rollup)
None None...
June 8, 2021—KB5003695 (Security-only update)
None None...
June 8, 2021—KB5003697 (Monthly Rollup)
None None...
June 8, 2021—KB5003671 (Monthly Rollup)
None None...
June 8, 2021—KB5003696 (Security-only update)
None None...
June 8, 2021—KB5003681 (Security-only update)
None None...
CVE-2021-1675
Windows Print Spooler Remote Code Execution Vulnerability Recent assessments: kevthehermit at June 30, 2021 1:53pm UTC reported: Vulnerability This was originally classified as a Local Priv Escalation, however recent POC code has been released that enabled a domain authenticated user to remotely...
Detecting Post-Compromise Threat Activity Using the CHIRP IOC Detection Tool
Summary Updated April 15, 2021: The U.S. Government attributes this activity to the Russian Foreign Intelligence Service SVR. Additional information may be found in astatement from the White House. For more information on SolarWinds-related activity, go to...
APT-Hunter - Threat Hunting Tool For Windows Event Logs Which Made By Purple Team Mindset To Provide Detect APT Movements Hidden In The Sea Of Windows Event Logs To Decrease The Time To Uncover Suspicious Activity
APT-Hunter is Threat Hunting tool for windows event logs which made by purple team mindset to provide detect APT movements hidden in the sea of windows event logs to decrease the time to uncover suspicious activity . this tool will make a good use of the windows event logs collected and make sure...
The dynamic duo: How to build a red and blue team to strengthen your cybersecurity, Part 2
The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the first post of our new Voice of the Community blog series, Microsoft Product Marketing Manager Natalia Godyla talks with Jake Williams, Founder of...
The dynamic duo: How to build a red and blue team to strengthen your cybersecurity, Part 2
The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the first post of our new Voice of the Community blog series, Microsoft Product Marketing Manager Natalia Godyla talks with Jake Williams, Founder of...
3 Ways to Hunt for the ZeroLogon Vulnerability on Your Windows Servers
Vulnerability assessment and patch management can be painful time-consuming processes. From the Security team looking at vulnerability reports and prioritizing the riskiest ones for their environment to the IT or Infrastructure team determining exactly which machines need to be patched and...
Querying Windows Event Logs for Faster Investigation and Response
With this week’s release on the VMware Carbon Black Cloud, users can now remotely inspect Windows devices’ event logs to pull back information that could be helpful during an investigation or response scenario. This new capability comes as part of an update to the Live Query functionality provide...
DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs
DeepBlueCLI - a PowerShell Module for Threat Hunting via Windows Event Logs Eric Conrad, Backshore Communications, LLC deepblue at backshore dot net Twitter: @ericconrad http://ericconrad.com Sample evtx files are in the .\evtx directory Usage: .\DeepBlue.ps1 See the Set-ExecutionPolicy Readme if...
Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software
Title: Windows TCPIP Finger Command - C2 Channel and Bypassing Security Software Author: John Page aka hyp3rlinx Date: 2020-09-16 Website: hyp3rlinx.altervista.org Source: http://hyp3rlinx.altervista.org/advisories/WindowsTCPIPFingerCommandC2ChannelandBypassingSecuritySoftware.txt...
Target Device running on VMware going into hung state with Event - Too many retries Initiate reconnect
Please consider below scenarios and symptoms: VMware6.7 hosts the Target devices. VMXNet3 is attached to the Target devices. Intermittently the Target Devices go into a hung state. Review of the Wireshark trace shows that the Target Device is constantly reconnecting with the Citrix Provisioning...
Audix - A PowerShell Tool To Quickly Configure The Windows Event Audit Policies For Security Monitoring
Audix will allow for the SIMPLE configuration of Windows Event Audit Policies. Window's Audit Policies are restricted by default. This means that for Incident Responders, Blue Teamers, CISO's & people looking to monitor their environment through use of Windows Event Logs, must configure the audit...
"Description cannot be found" error in event logs in Event Viewer in Windows Server 2012 R2 or Windows Server 2012
"Description cannot be found" error in event logs in Event Viewer in Windows Server 2012 R2 or Windows Server 2012 Introduction This article describes an issue in which the "Description cannot be found" error message is displayed in the event logs in Windows 8.1, Windows RT 8.1, Windows Server 20...
OSSEM - Open Source Security Events Metadata
The Open Source Security Events Metadata OSSEM is a community-led project that focuses primarily on the documentation and standardization of security event logs from diverse data sources and operating systems. Security events are documented in a dictionary format and can be used as a reference fo...
Storefront | Unable To Join Secondary Storefront Server To Server Group.
ERROR: Unable to join server in existing server group. Add server failed - Add of server XYZ to server group failed. In event logs we could see 'access is denied' exception while running the command : 'Add-DSCertificateToDSStore'...