Andrew Harris - Ciberesponce

Disabling Windows Defender (and what MSFT does without your consent afterwards...)

There are many articles out there on how to do this. Sadly, many are still incorrect and you may go crazy trying to figure out why you just can't seem to disable Windows Defender (now Microsoft Defender). First I'll share very quickly how to triage this. If you just want

Lab creation - Part 2

Part 1 of this blog provided a (very high) framework on how to build a lab, in multiple parts, so it builds on top of each other in each stage. Now with enough info to be dangerous, here's the second part. After doing this for a while, a perfect example

New Sunburst & Golden SAML Video

After 6 months from RSA, I'm pleased to announce I was able to add cheap video graphics to the video but add actual narration! So, for the first time, you can see and hear what is happening while you watch the same TTPs the adversary executed to jump from on-premises

DevOps

Developing a Infrastructure-as-Code (IaC) cybersecurity lab (Part 1)

Build a cybersecurity lab using latest and greatest from terraform, ansible and packer.

Containment

Detecting Lateral Movement with Windows Event IDs

How can you use PowerShell and Event IDs to detect the most important events you need to be aware of and respond to?

Incident Response

So, what the heck happened with Solar Winds and why is MFA not a silver bullet?

If you can't tell, I'm a huge fan of knowing exactly what is going on with authentication since most attacks you see today, lead to post-compromise activity thanks to the weaknesses in this layer. What do I mean? Well, if you read my blog on why SmartCards aren't doing anything

Getting Started

97 Things Every Informational Security Professional Should Know

Happy to have contributed to the great book Christina Morillo led with O'Reilly Media, 97 Things Every Informational Security Professional Should Know. I had a few chapters, including sharing one of my favorite methodologies I learned while in the Dept of Defense, the Observe-Orient-Decide-Act (OODA) loop. It's funny--I tried bringing

Identity

A primer on SAML, Golden SAML, Sunburst

How the adversary steamrolled customers on-premises, and their cloud, bypassing MFA, and the facts on how we got here and why Microsoft was an enabler of the whole thing

Identity

Introducing CrowdStrike Falcon Identity Protection; A solution that protects your Identity from post-exploit activity in Hybrid, Multi-Cloud environments

CrowdStrike recently announced its Falcon Identity Protection, which can not just detect Identity attacks, it can also prevent them. Furthermore, unlike either Microsoft Defender for Identity (MDI) or Azure Active Directory (AAD) Identity Protection — even when combined, Microsoft still can’t apply MFA to on-premises authentication flows. Falcon Identity Protection

Strategic

Chinese Ambitions with TikTok

Since I first posted this, 18 Sept 2020, the Chinese PLA have since posted this video online, showing them carrying out a nuclear attack against the United States. China reportedly uses Hollywood clips to show simulated attack on US baseThe Chinese military's publicity team has released an action-packed video of

Offensive Security

Harvested Credentials in Kali

One of the biggest points of confusion I hear is that Azure Advanced Threat Protection is only applicable to Windows. That is not true. I also hear that “credential theft” is a Windows problem. Also, not true! Here I’ll show how you can extend the Azure ATP Security Alert

Security Hygiene

Azure ATP Advanced Audit Policies

IMPORTANT NOTE: Microsoft Defender for Identity (MDI) is UNABLE to protect your on-premises assets, unless they are replicated to Azure AD. This strategy means, for the most important accounts on-premises (i.e. Domain Admins, privileged service accounts), which Microsoft also recommends are not replicated to Azure AD, you are forced

Strategic

CISO Matrix

There is bias in every decision? Too much in any direction is not a good thing. I’ve supported a lot of cyber operations, product procurements, product deployments. I’ve consulted some of the largest Fortune companies in the world, some of the biggest Governments, non-profits, research centers, and so

Incident Response

Iceberg Affect

How well do you pull the strings on the IOCs during an investigation? In cybersecurity, especially in the Digital Forensics Incident Response (DFIR) space, the “Iceberg Effect” plays a detrimental role in the execution phase of response and recovery. This often leaves analysis incomplete which directly translates to insufficient response

Identity

Smartcards and Pass-the-Hash

Why is this a really bad combination, unless you make a critical change to a policy you probably didn't know about... Also, don't be fooled, SmartCard is only feasible for interactive logons--at CrowdStrike, we fixed that and added MFA to programmatic/non-interactive logons. Another post will be made here, which

Azure

Securing Azure Storage

A customer recently asked me “how do I discover Azure Storage accounts that are open?” First off, we need to define what “open” means. Does this mean “route-able from the Internet” or “anonymous access”? From there, we can share how to answer that question, both from the portal as well

DevOps

ARM and DSC Tips

I’m new to Azure Resource Management (ARM) and Desired State Configuration (DSC), albeit not new to JSON nor PowerShell. I recently had the task to migrate our Azure Security labs to a pure Azure-based environment which meant learn ARM and DSC really quick. I had to setup VMs, build

Incident Response

A necessary component to any Cyber Incident Response: Containment

Incident Response and ContainmentAnyone who does Incident Response (IR), or any Digital Forensics Incident Response (DFIR) process knows that collecting Indicators of Compromise (IOC) is only half the story. Eventually, you’ll need to recover the environment, which inherently means you best have confidence in the IOCs and have a