Recent enhancements for Microsoft Power Platform governance

An emerging trend in digital transformation efforts has been the rise of low-code development platforms. Of course, these low-code platforms must be grounded in best-of-breed governance capabilities which include security and compliance features. Without strong governance, the full benefits of...

Recent enhancements for Microsoft Power Platform governance

An emerging trend in digital transformation efforts has been the rise of low-code development platforms. Of course, these low-code platforms must be grounded in best-of-breed governance capabilities which include security and compliance features. Without strong governance, the full benefits of...

Tritium - Password Spraying Framework

A tool to enumerate and spray valid Active Directory accounts through Kerberos Pre-Authentication. Background Although many Kerberos password spraying tools currently exist on the market, I found it difficult to find tools with the following built-in functionality: The ability to prevent users fr...

Using the Manager Attribute in Active Directory (AD) for Password Resets

Creating workflows around verifying password resets can be challenging for organizations, especially since many have shifted work due to the COVID-19 global pandemic. With the numbers of cyberattacks against businesses exploding and compromised credentials often being the culprit, companies have ...

Using the Manager Attribute in Active Directory (AD) for Password Resets

Creating workflows around verifying password resets can be challenging for organizations, especially since many have shifted work due to the COVID-19 global pandemic. With the numbers of cyberattacks against businesses exploding and compromised credentials often being the culprit, companies have ...

Nefilim Ransomware Gang Hits Jackpot with Ghost Account

A Nefilim ransomware attack that locked up more than 100 systems stemmed from the compromise of an unmonitored account belonging to an employee who had died three months previously, researchers said. Nefilim a.k.a. Nemty is a ransomware strain that emerged in 2020, with its operators adopting the...

Exploit for Improper Privilege Management in Microsoft

内网渗透学习笔记 作者：chriskali Github：chriskaliX 近期，拜读了腾讯蓝军-红蓝对抗之Windows内网渗透，学到了不少知识点。打算拆分章节进行整理以及复现，主要记录自己缺失的知识点。这是一个大杂烩文章，主线是跟着jumbo师傅的思路，碰到感兴趣的，我会继续扩展。可能有点凌乱，希望大家见谅。 0x01 环境搭建 这一步略过，简单介绍一下测试的环境 |主机名|IP地址|角色|系统| |:-:|:-:|:-:|:-:| |DC|10.10.10.10|DC|DNS|Winserver 2012| |John|10.10.10.11|normal|win7|...

SVR Attacks on Microsoft 365

FireEye is reporting the current known tactics that the SVR used to compromise Microsoft 365 cloud data as part of its SolarWinds operation: Mandiant has observed UNC2452 and other threat actors moving laterally to the Microsoft 365 cloud using a combination of four primary techniques: Steal the...

The story of ZeroLogon

This is the story of a vulnerability that was brought about by the incorrect use of an encryption technique. After it was discovered by researchers, the vulnerability was patched and that should have been the end of the story. Unfortunately the patch caused problems of its own, which made it very...

Azure Active Directory empowers frontline workers with simplified and secure access

Howdy folks, The past year has shown us all just how critical frontline workers are to our communities and our economy. They’re the people behind the counter, in the call centers, in hospital ICUs, on the supermarket floor—doing the critical work that makes the difference in feeding our families,...

Azure Active Directory empowers frontline workers with simplified and secure access

Howdy folks, The past year has shown us all just how critical frontline workers are to our communities and our economy. They’re the people behind the counter, in the call centers, in hospital ICUs, on the supermarket floor—doing the critical work that makes the difference in feeding our families,...

CVE-2021-1677

Azure Active Directory Pod Identity Spoofing Vulnerability...

CVE-2021-1677

Azure Active Directory Pod Identity Spoofing Vulnerability...

Spoofing

Azure Active Directory Pod Identity Spoofing Vulnerability...

CVE-2021-1677 Azure Active Directory Pod Identity Spoofing Vulnerability

...

CVE-2021-1677

CVE-2021-1677 is described as an Azure Active Directory Pod Identity spoofing vulnerability affecting Azure Kubernetes Service. The connected documents indicate the issue arises from improper handling in the Pod Identity IMDS flow, enabling a malicious pod to obtain another pod’s credentials/toke...

CVE-2021-1677 Azure Active Directory Pod Identity Spoofing Vulnerability

...

Azure Active Directory Pod Identity Spoofing Vulnerability

...

January 12, 2021—KB4598285 (Monthly Rollup)

None None...

Azure AD. Attack of the Default Config

Uncloaking dangerous and default configurations within Azure. TL; DR There are several default configurations within the admin portal of Azure. The main affected area is Azure Active Directory Azure AD which is the primary area that controls user authentication, group memberships and privileges...