PowerHuntShares.v2: New Sample HTML Report
Here is a sample report for those who wanted it. Enjoy!
raw.githubusercontent.com/NetSPI/PowerHu… @NetSPI

The PowerHuntShares v2 update now includes: interesting files, password extraction, and LLM fingerprinting! Check it out & give me some feedback! netspi.com/blog/technical…

Big thanks to @TheHackerValley for having me on yesterday! It's always fun to talk about ransomware and LLMs. Here's a link if you missed it: linkedin.com/events/7122229…

I will say that EDR has made great strides in the last few years though.

Another meme from the team. I wish it wasn't true, but out-of-the-box detection rules aren't enough.

Ignorance is not bliss in an age of ransomware:

Here's another one from the @NetSPI BAS team:

One more because it's Friday :)

Here are a few more links focused on .net framework app domain hijacking and .net core startup hooks:

.NET Framework App Domain Hijacking
youtube.com/watch?v=BIJ2L_…
rapid7.com/blog/post/2023…

.NET Core Startup Hooks
rastamouse.me/net-startup-ho…
github.com/dotnet/runtime…

@NetSPI knows your pain is real.

Here is another one from @NetSPI's memetron 3000!

More memetastic fun from the @NetSPI crew.

I found a few Breach & Attack Simulation (BAS) related memes from the @NetSPI team in a forgotten drawer, I'll share them throughout the month since I've been told that it's memetober.

@icreatelife @MagicStarke #MidjourneyAI “an expansive jungle land scape made of plastic, glass, and origami materials in a whimsical style;a light breeze moving lighted specs of dust through the air; the whole land scape is covered in a thin layer of blue and white snow”

[Script] Create-FakeSensitiveData is a quick and dirty #PowerShell script that can generate fake PII, PHI, PCI, and Password data, and output it to a data table, csv file, or directly to a #SQLServer database.
github.com/NetSPI/PowerSh…

#PowerShellAllTheThings #NetSPI

I'm excited to announce #netspi is looking for a new Breach and Attack Simulation product manager to join our team! Reach out if you're interested: appone.com/MainInfoReq.as…

(11/11)

(10/11)

(9/11)

(8/11)

(7/11)

(6/11)

(5/11)

(4/11)

(3/11)

(2/11)

I generated a few #netspi origami space monkey's using #midjourney this weekend. Here are the results. (1/11)

Protected Users Security Group
If you haven't been using them, you should.
learn.microsoft.com/en-us/windows-…

[BLOG] Attacking and Remediating Excessive Network Share Permissions in Active Directory Environments
netspi.com/blog/technical… #NetSPI #PowerShellAllTheThings

@austin_altmann

Need a way to measure your log, detection, and alert coverage for common malicious behavior?
We've been working hard on that problem for you @NetSPI !
Check out some of the updates to our Breach and Attack Simulation services and platform:
netspi.com/news/press-rel…

For those who missed it, here's a video of the "Building Ransomware Detections" presentation I gave @Secure360 last week. #NetSPI
youtube.com/watch?v=xUhzWS…

@bigendiansmalls

[BLOG] Kerberos Bronze Bit Attack
blog.netspi.com/cve-2020-17049…
This is some great work by Jake Karnes that details how to bypass restrictions related to the “sensitive and cannot be delegated” setting (among other things). Worth the read!

[SCRIPT] Get-BadPrivilege is a small PowerShell script that wraps PoshPrivilege to identify potentially dangerous privilege assignments based on @vysecurity's Red Team Tip #423. raw.githubusercontent.com/NetSPI/PowerSh…. #PowerShellAllTheThings @NetSPI

@bigendiansmalls

[SCRIPT]Here is a PowerShell script to list supported protocol handlers in Windows and quickly generate test emails to see which ones are allowed through the email stack. It may be useful for phishing dev/prevention. #NetSPI #BlueTeam github.com/NetSPI/PowerSh…

I came across this PowerShell memory editor by Tobias Heilig while Github spelunking today. It has some pretty fun search/update features that could be useful. github.com/off-world/PSMe…

Evil SQL Client Update: I added a payload that uses Casey Smith’s AppDomain hijacking technique to run under c:\windows\system32\ EXEs that import mscoree.dll. Just another detective control testing option. :)
Details can be found at: github.com/NetSPI/ESC/blo… @NetSPI

Example screenshot:

[BLOG] Evil SQL Client: MSBuild All the Things
This is a .net SQL client with SQL Server discovery, access, and data exfiltration options.
blog.netspi.com/evil-sql-clien… #hackSQL @NetSPI

I finally got my upgraded PowerUpSQL space monkey stickers! They brought some color into my gray MN day. :) Thanks @stickermule!

[SCRIPT] Get-GPRegistryPolicy.ps1
Parses Registery.pol files on a provided DC. Handy for quickly grabbing things like SNMP community strings.
Uses functions by Zia Jalali.
github.com/NetSPI/PowerSh…
#powershellallthethings #NetSPI

You can provide least privilege SQL logins full registry access using the registry hack below:
github.com/NetSPI/PowerUp…
#HackSQL #sqlsecurity

[BLOG] Analyzing DNS TXT Records to Fingerprint Online Service Providers (includes a PowerShell script)
blog.netspi.com/analyzing-dns-…
#NetSPI #OSINT

Here are a few TSQL example scripts for identifying insecure use of global temp tables in SQL Server as an unprivileged login. Mileage will vary, but sometimes it can result in sensitive data access and privilege escalation. #HackSQL #sqlsecurity #netspi
github.com/NetSPI/PowerUp…

If you're a sticker addict like me, come by the #NetSPI booth @WWHackinFest to get one of our new sticker sheets, or hunt down @kfosaaen @BSidesPDX

For those of you looking for the #NetSPI "Hack Responsibly" desktop background, I uploaded it to github.com/NetSPI/PowerUp…

[Script] Get-SSLCertInfo is a basic PowerShell function that can be used to scrape SSL certificate information using IP Ranges, domain lists, etc.
raw.githubusercontent.com/NetSPI/PowerSh…
#PowerShellAllTheThings #NetSPI

[Script] This PS function can be used to convert a CSV into PowerShell code that creates a data table that mirrors the CSV’s structure and content. Can be handy for quickly creating hard coded data sets.
raw.githubusercontent.com/NetSPI/PowerSh…
#powershellallthethings #netspi

Here's a TSQL OAP based download cradle for SQL Server, for those looking for a more dynamic payload execution option. :)
raw.githubusercontent.com/NetSPI/PowerUp…
#HackSQL #NetSPI

Here is a basic PowerShell script for subdomain enumeration via CTFR that supports automatic IP/owner lookups. Additional features in help.
github.com/NetSPI/PowerSh…
#PowershellAllTheThings #NetSPI

More stickers are in for our annual Vegas adventure!
Come by the #NetSPI booth at #BlackHat2019 to get yours, or hunt @kfosaaen,@kevin_robertson, or me down at #DEFCON :)

Below are the PowerUpSQL presentation slides from BlackHat USA Arsenal.
The video is a webinar style presentation that introduces the tool and walks through all the demos.
Slides: bit.ly/2OxbGYy
Video/Webinar: youtu.be/UX_tBJQtqW0
@BlackHatEvents #bhusa

Stickers for Vegas have arrived! The monkey is back by popular demand :)

Finally got around to adding Get-SQLPersistTriggerDDL to PowerUpSQL.
Original blog: bit.ly/2OAB1BI

The NetSPI team is getting ready for @defcon - James Houston made us some awesome badges - fun and profit TBD :)

I just added Get-SQLInstanceBroadcast to PowerUpSQL. Now you can find SQL Servers on your local LAN without having to scan as much. Thanks for the tip @nikhil_mitt !

I finally jumped on the sticker band wagon - can't wait for @DerbyCon !

I forgot to include this in the blog, but I also added a PowerUpSQL function for executing OS commands via CLR assemblies.

@_videoman_ showing us the horrible things people have done with SHA1 hashes @thotcon

Watching @kfosaaen talk about abusing skype @thotcon - Good stuff!

@c0ncealed @SlideShare Yes :) the awesome crew @sqlpowershell recorded a previous session: youtu.be/npoORzfP7rw

@kfosaaen @DerbyCon showing us how to target federated Skype users

@joshcorman @obscuresec - Incredibles? youtube.com/watch?v=A8I9pY…

Making progress :)