Blog

PPID Spoofing: It’s Really this Easy to Fake Your Parent

1 New Blog Series on Common Malware Tactics and Tricks This will be the first post in a series of blogs covering some common malware tactics and tricks. The following list is of topics that will be discussed in these blogs. However, feel free to reach out if there is topic that is not on...

JavaScript Essentials for Beginning Pentesters

JavaScript is heavily used in almost all modern web applications. Knowing how to format a .js file, set breakpoints, and alter a script’s logic on the fly can be very helpful when working with web applications. To start, let’s navigate to a website and view the application’s resources. For our example, we are using the...

Walking the Tightrope: Maximizing Information Gathering while Avoiding Detection for Red Teams

Analyze the balance between gaining useful information and avoiding detection, detailing recon techniques that can be employed without compromising stealth. Rob Joyce, who at the time was Head of the NSA’s Tailored Access Operations group, had this great quote from a 2016 USENIX talk: “We put the time in to know that network. We put...

Cybersecurity Policy Enforcement: Strategies for Success

Introduction Your organization has invested significant effort in formally documenting its approach toward cybersecurity to enhance accountability and awareness of security processes; however, operationalizing and enforcing this policy library can appear challenging. Failure to consistently enforce cybersecurity policies generally leads to a degradation of the environment, as individuals come to understand that they will not...

Learning Sysmon – Videos 1-10

Watch “Learning Sysmon,” a new video series hosted by Research Team Lead Carlos Perez on YouTube now!

Windows LAPS: Closing a Gap for Cloud-Native Device Management

1 TLDR; Microsoft is releasing an Azure AD integrated, built-in LAPS agent to Windows 10 and Windows 11 that can be controlled by Intune. 1.1      Problem Statement Migrating Windows endpoints to Intune-only management left gaps in controllable settings. An alternative for traditional Local Administrator Password Solution (LAPS) in an on-premises domain has been a primary...