ITSEC Newsletter 2023-08-17

Red team is best team

Author

Henrik Falk
August 17, 2023

LAPS 2.0 Internals

This year, LAPS 2.0 was released by Microsoft, and thankfully it now comes built-in to Windows. This time it comes ready for use with Active Directory, as well as being supported in Azure AD aka Entra ID. In this post, we’ll look at how LAPS 2.0 for Active Directory works under the hood, so you can make those fresh recommendations to your clients, and prepare yourself for the inevitable question... “But we just deployed LAPS.. what does LAPS 2.0 do differently?!”.

blog.xpnsec.com/lapsv2-internals

"This year, LAPS 2.0 was released by Microsoft, and thankfully it now comes built-in to Windows. This time it comes ready for use with Active Directory, as well as being supported in Azure AD aka Entra ID. In this post, we’ll expand on a Twitter thread that I posted on how LAPS 2.0 for Active Directory works under the hood, so you can make those fresh recommendations to your clients, and prepare yourself for the inevitable question: “But we just deployed LAPS.. what does LAPS 2.0 do differently?!”."

Hacking With Your Nemesis

In the first post in this series, On (Structured) Data, we talked about the gap area of offensive structured data and ended with the…

posts.specterops.io/hacking-with-your-nemesis-7861f75fcab4

"Our goal with Nemesis was to create a centralized data processing platform that ingests data produced during offensive security assessments, an idea we’ve been talking about for over seven years, and something we’ve been actively working on for the past twelve months. This goes beyond the existing log aggregation approaches that are out there. We’re aiming to demonstrate an approach of unifying all offensive data from a number of sources into a single processing and analytic platform."

Knocking on Hell’s Gate - EDR Evasion Through Direct Syscalls

Introduction - Educational Malware Development I

labs.en1gma.co/malwaredevelopment/evasion/security/2023/08/14/syscalls.html

"This post will cover some important malware development techniques that are crucial to understand as a basis for more sophisticated techniques. We will dive deep into the Hell’s Gate dynamic syscall ID extractor technique and use C++ to accomplish our goals. This technique is not new, but certainly important to understand as a foundational technique."