Microsoft Resources

An attack which is able to bypass Windows authentication, even in the presence of BitLocker full disk encryption, and thus allows an attacker to access a user’s data or install software. On systems effected this attack therefore bypasses all of the protections offered by BitLocker. ...READ MORE

The unfortunate reality for most enterprises, is that it often does not take long from an attacker to go from domain user to domain admin. The question on defenders’ minds is “how does this happen?”. The attack frequently starts with a spear-phishing email to one or more users enabling the attacker to get their code running on a computer inside the target network. Once the attacker has their code running inside the enterprise, the first step is performing reconnaissance to discover useful resources to escalate permissions, persist, and of course, plunder information (often the “crown jewels” of an organization)....READ MORE

The primary techniques for dumping credentials from Active Directory involve interacting with LSASS on a live DC, grabbing a copy of the AD datafile (ntds.dit), or tricking a Domain Controller into replicating password data to the attacker (“I’m a Domain Controller!”). The methods covered here require elevated rights since they involve connecting to the Domain Controller to dump credentials....READ MORE

The attack started, as many do, with a spear-phish email which was opened and code executed (in this case leveraging a Microsoft Word exploit). It is noted that the internet proxy blocked seven (7) out of nine (9) of the attacks. It only takes one success though for the attacker to gain a foothold inside the network. Note that there was a second wave which adjusted to the internet proxy configuration and was far more successful the second time around. Always expect that the attacker will quickly learn more about your environment than what you have documented.....READ MORE

In all fairness to Microsoft, this type of behavior has become commonplace amongst tech companies across the world—but that doesn't mean we should sit idly by. Additionally, some of these features can cost you battery life and performance, so I'll show you how to disable them all below....READ MORE

Microsoft introduced Active Directory in 1999 when the world was very different. Virtually all systems and applications were Windows-based. They were all on-premises as well with their data centers and applications all being hosted internally............READ MORE

IT organizations aren’t choosing AD by default. It needs to make economic sense as well as be a technological fit. The true TCO of Active Directory is much greater than just purchasing software and throwing some old hardware at it. Authentication services in modern organizations are a 100% uptime service.........READ MORE

The worm functionality attempts to infect unpatched Windows machines in the local network. At the same time, it also executes massive scanning on Internet IP addresses to find and infect other vulnerable computers. This activity results in large SMB traffic from the infected host, which can be observed by SecOps personnel, as shown below.........READ MORE