Detecting DCSync and DCShadow Network Traffic

This blog post on detecting Mimikatz' DCSync and DCShadow network traffic, accompanies SANS webinar "Detecting DCSync and DCShadow Network Traffic". Intro Mimikatz provides two commands to interact with a Windows Domain Controller and extract or alter data from the Active Directory database. These two commands are dcsync and dcshadow. The dcsync command can be used, … Continue reading Detecting DCSync and DCShadow Network Traffic →

Painless Cuckoo Sandbox Installation

TLDR: As part of our SANS SEC599 development efforts, we updated (fixed + added some new features) an existing Cuckoo Auto Install script by Buguroo Security to automate Cuckoo sandbox installation (& VM import). Download it from our Github here. Intro As a blue team member, you often have a need to analyze a piece … Continue reading Painless Cuckoo Sandbox Installation →

Windows Credential Guard & Mimikatz

Here at NVISO, we are proud to have contributed to the new SANS course “SEC599: Defeating Advanced Adversaries - Implementing Kill Chain Defenses”. This six-day training focuses on implementing effective security controls to prevent, detect and respond to cyber attacks. One of the defenses covered in SEC599 is Credential Guard. Obtaining and using credentials and … Continue reading Windows Credential Guard & Mimikatz →