Technology
7MS #499: Desperately Seeking a Super SIEM for SMBs - Part 6
2021-12-16
Download
Right click and do "save link as"
Today we have some cool updates on this SIEM-focused series we've been doing for a while. Specifically, I want to share that one of these solutions can now detect three early (and important!) warning signs that bad things are happening in your environment:
-
ASREPRoasting
-
WDigest flag getting flipped (reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1)
-
Restricted admin mode getting enabled (reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f) - see n00py's blog for more info
More Episodes
7MS #506: Tales of Pentest Pwnage - Part 32
2022-02-03
2022-02-03
7MS #503: First Impressions of Brute Ratel
2022-01-12
2022-01-12
7MS #502: Building a Pentest Lab in Azure
2022-01-05
2022-01-05
7MS #501: Tales of Pentest Pwnage - Part 31
2021-12-29
2021-12-29
7MS #500: Interview with John Strand
2021-12-22
2021-12-22
7MS #496: Tales of Pentest Pwnage - Part 30
2021-11-24
2021-11-24
7MS #493: 7MOIST - Part 2
2021-11-04
2021-11-04
7MS #492: Tales of Pentest Pwnage - Part 29
2021-10-28
2021-10-28
7MS #489: Ping Castle
2021-10-06
2021-10-06
Get this podcast on your
phone, FREE
