mandrake @hsOpenMind

@Rainmaker1973 @xdownloaderbot download this

Places to find TTPs to test: - thedfirreport.com - unit42.paloaltonetworks.com - microsoft.com/en-us/security… - cloud.google.com/blog/topics/th…

spencer @techspence

2 days ago

x.com/i/article/2076…

3 5 51 12K 67

@noninono371092 @xdownloaderbot download this

Today, we’re releasing rCTF v2, an open-source platform for hosting cybersecurity capture-the-flag competitions.

keyboard_arrow_left Previous keyboard_arrow_right Next

@pabpereza @xdown download this

ACTIVE DIRECTORY PDCe DEAD - WHAT TO DO? This is to augment the earlier post (link at the bottom). Why? Because someone reached out after the original post and indicated Product Support killed an AD that should know better by restoring both DCs! In an all dead scenario only restore the PDCe! Then start with Step 5 - Check to make sure the FSMO Roles are there - Check SYSVOL and NETLOGON are shared - Check the AD Event Logs for any further issues - Create a new TEST GPO -- Check SYSVOL for the new GUID If we still have DCs up with the PDCe dead then the following: 1.Evaluate SYSVOL Version Number 2.Check all DCs 3.DC with the _latest_ Version SEIZE the FSMO ROLES! 4.Do _NOT_ under any conditions restore the original PDCe 5.Verify successful FSMO Role seating across all DCs a.# Check FSMO b.Get-ADForest | Format-Table SchemaMaster,DomainNamingMaster c.Get-ADDomain | Format-Table PDCEmulator,RIDMaster,InfrastructureMaster 6.Verified? a.Clean Active Directory of the Defunct PDCe i.Delete the AD Object in Sites ii.Clean DNS Records in all folders iii.Run a quick NTDSUtil Metadata clean-up check b.Mount the Windows Server installer .ISO i.Ours uses AutoUnattend.XML to make things really quick c.Install the OS i.Network ii.Roles iii.DCPromo d.FSMO Roles i.Transfer FSMO Roles to the newly stood up VM 1.NOTE: Replication NEEDS TO BE 100%!!!! 2.Check GPMC and run the Report! ii.NOTE: We always have the Roles on the _same_ DC along with Time e.Verify Replication i.Make sure everything is happy f.Set Up Time i.W32tm steps to configure /Reliable:YES g.Done If it looks like the technician is flipping the mouse around looking for things, thus it LOOKS LIKE they don't know what they are doing STOP THEM and ESCALATE!!! FIX TRUST ISSUES 1.Log on as local admin after a reboot 1.$Domain = "MyDomain.LAN" 2.$NETBIOS = "MyDomain" 3.$DomainAdmin = "MyDomainAdmin" 4.Test-ComputerSecureChannel -Credential "$($NETBIOS)\$($DomainAdmin)" -Repair 5.Test-ComputerSecureChannel 1.Should be TRUE = Fixed 2.Log off 3.Log on with a domain user 1.Should be fine THE EARLIER POST: x.com/MPECSInc/statu…

keyboard_arrow_left Previous keyboard_arrow_right Next

Philip Elder @MPECSInc

a day ago

ACTIVE DIRECTORY: QUICK AND EASY DEAD DC RECOVERY If we catch it quick enough we can run a restore via Veeam. The catch being image based backups that get restored can cause USN Rollback if the restore point is too far back, this could be hours, or trust related issues as

0 7 37 4K 34

BloodHound MCP: Automating Active Directory Analysis with AI Read: hackingarticles.in/bloodhound-mcp…

keyboard_arrow_left Previous keyboard_arrow_right Next

@anyelamarillo @xdownloaderbot download this

Understand Active Directory Group Policy security settings learn.microsoft.com/en-us/training…

ACTIVE DIRECTORY MIGRATION: FSMO, TIME, AND DNS! We are in the midst of a migration. STAGE 1: DNS on DCs Changed vNIC DNS setup on DCs and servers, and in DHCP, as follows: - DNS0: OldDC0 - PDCe - DNS1: OldDC1 - DNS2: NewDC0 - DNS3: NewDC1 Now, the DCs have DNS0 pointing to SELF then DNS1 to PDCe and DNS2+ pointing to the other DCs. STAGE 2: PDCe DNS on Servers/DHCP Once FSMO and Time are migrated to the new PDCe we swap DNS0 and DNS1 so that DNS0 points to the new PDCe and same for DHCP client systems. IMPORTANT Throughout the process one should keep the DNS settings updated, and verified making sure that all server operating systems and client machines receive the correct PDCe as DNS0. IPConfig /all or Get-DNSClientServerAddress DNS POWERSHELL The attached snips show the lines as they would be entered in the PowerShell console. Set DNS on "Ethernet" $AliasName = "Ethernet" $DNS0 = "10.5.5.3" $DNS1 = "10.5.5.2" $DNS2 = "10.5.5.4" $DNS3 = "10.5.5.5" Set-DnsClientServerAddress -InterfaceAlias $AliasName -ServerAddresses $DNS0,$DNS1,$DNS2,$DNS3 IPConfig /RegisterDNS PING $NewGateway STAGE 3: Move PDCe Time Setup There's no Group Policy needed for this setup. Once the PDCe and the rest of the DCs are set up it just works and has been since the year 2,000 AD. ;-) # TODO w32tm to set new DomHier # PDCe Canada w32tm /config /syncfromflags:manual "/manualpeerlist:0.ca.pool.ntp.org,0x1 1.ca.pool.ntp.org,0x1 2.ca.pool.ntp.org,0x1 3.ca.pool.ntp.org,0x1" /reliable:yes w32tm /config /update net stop w32time net start w32time w32tm /resync /force w32tm /query /source W32tm /query /status /verbose # ToDo Secondary DCs w32tm /config /syncfromflags:domhier /reliable:no /update net stop w32time net start w32time w32tm /resync /force w32tm /query /source W32tm /query /status /verbose FSMO POWERSHELL # ? FSMO Roles Transferred ? # Check FSMO Get-ADForest | FT SchemaMaster,DomainNamingMaster Get-ADDomain | FT PDCEmulator,RIDMaster,InfrastructureMaster # Transfer and Check $VMName = "NewPDCe" Move-ADDirectoryServerOperationMasterRole -Identity $VMName -OperationMasterRole 0,1,2,3,4 -confirm:$false Get-ADForest | FT SchemaMaster,DomainNamingMaster Get-ADDomain | FT PDCEmulator,RIDMaster,InfrastructureMaster * Always, Always, ALWAYS verify DNS, FSMO, and Time when migrating to new DCs!

keyboard_arrow_left Previous keyboard_arrow_right Next

Microsoft Defender for Office 365 (8) Threat Explorer & Real-Time Detection cyberboo.substack.com/p/microsoft-de… (9) Automated Investigation & Response (AIR) cyberboo.substack.com/p/microsoft-de… (10) Attack Simulation Training cyberboo.substack.com/p/microsoft-de… (11) SecOps Guide -IR with MDO cyberboo.substack.com/p/microsoft-de…

@falsapelirroja ...a esperar cobrar la quincena ganada con el sudor de sus nalgas.

32 ransomware groups abuse AnyDesk for persistence, per the Ransomware Tool Matrix. Longest row in the RMM table. The setup is one piped command: echo Admin#123 | AnyDesk.exe --set-password 2 gifts for defenders: 1. Password lands in plaintext in the echo command line 2. --set-password survives any rename Sigma rule: AnyDesk Piped Password Via CLI Hunt the flag + echo pipe 🔎

This is one of the most dangerous vulnerabilities in web security—and it's also one of the least understood. Most tutorials jump straight into payloads and exploitation, leaving one important question unanswered: Why does Insecure Deserialization lead to Remote Code Execution in the first place? In this video, I start from the fundamentals and build up step by step so you understand what's actually happening behind the scenes instead of just memorizing payloads. You'll learn: • What serialization and deserialization actually are • Why insecure deserialization happens • How attackers craft malicious objects • How deserialization leads to command execution • Practical exploitation concepts Whether you're getting started with Bug Bounty, Web Application Penetration Testing, or Cyber Security, I hope this video helps you build a stronger foundation for understanding this vulnerability. Watch the full video here: youtu.be/3hVLbemEhMg

@init1security Wow! Thank you for sharing

@precisox @xdownloaderbot download this

🚀 Nuevo proyecto para la comunidad de Ciberseguridad Después de completar al 100% la ruta de Red Teaming en TryHackMe, decidí empezar un proyecto que tenía pendiente hace tiempo. A partir de ahora voy a publicar en mi blog la resolución y análisis de todas las rutas de TryHackMe y Hack The Box. No van a ser simples writeups. La idea es documentar el proceso, explicar la metodología, las herramientas utilizadas, el razonamiento detrás de cada paso y las lecciones aprendidas para que sirvan como material de estudio. ✅ Red Teaming (THM): 100% completada. 📝 Próximo paso: empezar a documentarla desde el primer módulo hasta el último. El objetivo es construir una biblioteca de contenido en español que pueda ayudar tanto a quienes recién empiezan como a quienes buscan profundizar en Pentesting, Red Teaming, Blue Team, Cloud Security y AI Security. Si estás siguiendo un camino en ciberseguridad, espero que este contenido te resulte útil. #CyberSecurity #TryHackMe #HackTheBox #RedTeam #Pentesting #EthicalHacking #Writeup #InfoSec #Learning #BugBounty

ACTIVE DIRECTORY AND GROUP POLICY GEMS - Software Restriction Policies - Item Level Targeting - GPO Scope Filter via WMI * Great for targeting a single OS - GP mandated Windows Firewall _LOGGING_ * I hate it when someone asks, "Have you turned the Windows Firewall OFF?" - Mandatory UAC on the Secure Desktop for All - GP Scoped by Security Group Membership * Remember to give Authenticated Users READ - GP Scoped by OU membership *** Familiar with CSS? GP + OU structure = same same GP + OU TIP: A properly structure OU and Group Policy Object setup will _NEVER_ require a BLOCK INHERITENCE! DEFINITIONS GP = Group Policy OU = Organizational Unit CSS = Cascading Style Sheets

spencer @techspence

6 days ago

Active Directory security features a lot of people still don’t know about, despite being around forever: - LAPS - Fine-grained password policy - Managed Service Accounts - Authentication Policies & Silos

12 13 175 16K 114

How to Set Up a Home Hacking Lab for Beginners (Free and Legal) (2026) hackersonlineclub.com/home-hacking-l… #infosec #security #tutorial

@0xMovez @xdownloaderbot download this