Technology
7MS #499: Desperately Seeking a Super SIEM for SMBs - Part 6
2021-12-16
Download
Right click and do "save link as"
Today we have some cool updates on this SIEM-focused series we've been doing for a while. Specifically, I want to share that one of these solutions can now detect three early (and important!) warning signs that bad things are happening in your environment:
-
ASREPRoasting
-
WDigest flag getting flipped (reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1)
-
Restricted admin mode getting enabled (reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f) - see n00py's blog for more info
More Episodes
7MS #453: Interview with Marcello Salvati
2021-02-04
2021-02-04
7MS #451: Deep Freeze
2021-01-22
2021-01-22
7MS #450: DIY Pentest Dropbox Tips - part 4
2021-01-15
2021-01-15
7MS #449: DIY Pentest Dropbox Tips - Part 3
2021-01-07
2021-01-07
7MS #445: Certified Red Team Professional
2020-12-09
2020-12-09
7MS #441: SharpGPOAbuse
2020-11-15
2020-11-15
7MS #436: Cleaning Up Your Cloud Clutter
2020-10-07
2020-10-07
Get this podcast on your
phone, FREE
