Ian
banner
ark0x00.bsky.social
Ian
@ark0x00.bsky.social
Threat Hunt Analyst @ BlueVoyant | Former Military | Old Punk and Snowboarding Junky | Simracer
Reposted by Ian
If you're an IT admin here's a few things you can check before your next internal pentest...

- credentials in unattend.xml files purged
- local admin rights for regular users removed
- edr installed on EVERY host

🧵 1/2
March 19, 2025 at 2:12 PM
Reposted by Ian
They're called public records for a reason. Starting today, WIRED will *stop paywalling* articles that are primarily based on public records obtained through the Freedom of Information Act, becoming the first publication to partner with @freedom.press to offer this for our new coverage.
Wired is dropping paywalls for FOIA-based reporting. Others should follow
As the administration does its best to hide public records from the public, Wired magazine is stepping up to help stem the secrecy
freedom.press
March 18, 2025 at 1:11 PM
Reposted by Ian
March 12, 2025 at 2:29 AM
Reposted by Ian
#100DaysOfKQL

Day 69 - Potential Terminal Server or TermService Tampering via RDPWrap

The virus I have caught up to my family yesterday and it was not possible for me to post a query. Hopefully we'll get through it soon.

#MissedStreak

github.com/SecurityAura...
github.com
March 12, 2025 at 2:08 AM
Reposted by Ian
If you're going to @bsidessd.bsky.social, come say hi.
March 10, 2025 at 11:51 AM
Reposted by Ian
Joe Brinkley aka The Blind Hacker podcasters.spotify.c...
Joe Brinkley aka The Blind Hacker by Phillip Wylie Show
Summary In this episode, Joe Brinkley, also known as the blind hacker, joins Phillip Wylie to discuss his hacker origin story and offer advice for breaking into offensive security and pen testing. They also explore the commoditization of pen testing, the evolution of the industry, and the challenges of testing complex environments. Joe shares his insights on the different generations of hackers and the role of automation and AI in pen testing. He also talks about his work with the Mentor Village and offers resources for those interested in starting their own cybersecurity brand or company. Takeaways Joe Brinkley, also known as the blind hacker, shares his hacker origin story and offers advice for breaking into offensive security and pen testing. The commoditization of pen testing has led to a shift in the industry, with companies seeking budget-friendly alternatives and rotating vendors frequently. Automation and AI play a significant role in pen testing, allowing for faster and more efficient testing, but human expertise is still crucial for in-depth analysis and finding vulnerabilities that automated tools may miss. The industry is currently in the sixth or seventh generation of hackers, with increased access to education and tools, but also more complex environments to test. Joe Brinkley is actively involved in the Mentor Village, offering mentoring, education, and resources to those interested in cybersecurity. He encourages individuals to build their own cybersecurity brand and consider starting their own cybersecurity company, emphasizing the importance of branding and networking in the industry. Sound Bites "I don't care who you go to, learn something." "Long-term security is the value we provide" "People are looking for a budget-friendly alternative because compliance and insurance now require yearly security activities." Resources https://www.linkedin.com/in/brinkleyjoseph/ https://x.com/TheBlindHacker https://x.com/deadpixelsec https://deadpixelsec.com/ Chapters 00:00 Introduction and Background 06:24 Advice for Breaking into Offensive Security 10:39 The Commoditization of Pentesting 15:53 The Impact of Compliance and Cyber Insurance 22:03 Challenges Faced by Practitioners in Limited Time Windows 25:33 The Evolution of Hackers and Accessibility of Education and Tools 30:36 The Role of Automation, Orchestration, and AI in Modern Pentesting 36:23 Building Cybersecurity Brands and the Mentor Village 41:14 Conclusion 41:52 Phillip Wylie Show Outro Video.mp4
podcasters.spotify.com
March 12, 2025 at 4:04 PM
Reposted by Ian
If you wish to inspect an on-device (binary) policy file, you'll need WDACTools: github.com/mattifestati...

With this, you can run ConvertTo-WDACCodeIntegrityPolicy to get a stripped-down human-readable XML policy.
GitHub - mattifestation/WDACTools: A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies
A PowerShell module to facilitate building, configuring, deploying, and auditing Windows Defender Application Control (WDAC) policies - mattifestation/WDACTools
github.com
March 12, 2025 at 1:19 PM
Reposted by Ian
#100DaysOfKQL

Day 45 - Potentially Renamed Binaries

A bit different today where I'm giving you the base KQL recipe to accomplish something and provide an example.

Credit goes to @falconforceteam.bsky.social FalconFriday which helped me get set_has_element() right.

github.com/SecurityAura...
github.com
February 15, 2025 at 3:11 AM
Reposted by Ian
Today at 5pm in the Javits Center I'll be talking about Forging modern security with Microsoft Security Copilot. I hope you can join!

aitour.microsoft.com/en-US/sessio...

#MSAITour
Forging modern security with Microsoft Security Copilot
Discover how Microsoft Security Copilot modernizes security operations and defense intelligence through Generative AI and Microsoft’s Threat Intelligence. A fusion of innovation, vigilance, and adapta...
aitour.microsoft.com
January 30, 2025 at 7:33 PM
Reposted by Ian
Incoming blog
November 30, 2024 at 6:40 PM
Reposted by Ian
learned “cd” before I learned about CDs
November 30, 2024 at 1:02 AM
Reposted by Ian
Use exposure management data in #XDR to find all domain controllers and check if #MDI is installed.
AzSentinelQueries/Defender XDR/DefenderForIdentityInventory.md at master · f-bader/AzSentinelQueries
Repository with Sentinel Analytics Rules, Hunting Queries and helpful external data sources. - f-bader/AzSentinelQueries
buff.ly
November 29, 2024 at 6:30 PM
Reposted by Ian
Reversing C++ structures can be tricky. Binary Ninja makes it easier. I wrote up a walkthrough to clean up those pesky vtables. @binary.ninja

www.seandeaton.com/gotta-re-em-...

#binaryninja #reverseengineering #ghidra #ida
Gotta RE 'em All: Reversing C++ Virtual Function Tables with Binary Ninja
C++ can be frustrating to reverse engineer. Explore how to reverse engineer those with Binary Ninja.
www.seandeaton.com
November 27, 2024 at 1:48 PM
Happy Turkey Day to all who celebrate. Enjoy the time off and stop thinking about threat hunting for a few hours, lol. Maybe I am telling myself this more than you... hmm
November 28, 2024 at 8:41 PM
Lake Tahoe this past weekend. 3.5 days of no code, no threat intel, no clients.

Was amazing
November 25, 2024 at 3:54 AM
Looks like @iracing.bsky.social and the final GT Sprint split will be a no-go for me this morning. Taken out on the formation lap by someone warming their tires. Didn't realize how sensitive the Mustang GT3 can be. LOL

Wish I had some pictures.
November 24, 2024 at 5:49 PM
Reposted by Ian
📢 Exciting news from #BsidesRoc! Our
Call for Papers (CFP) and Call for Trainings (CFT) are now open! 🎉 Submit your
proposals by January 12, 2025, and keep an eye out for responses in early
February. Head over to bsidesroc.com to submit today!
Security B-Sides Rochester
Security B-Sides Rochester, or BSidesROC, is an open, non-profit hacker conference in Rochester, NY. It provides a place for people to learn about hacking, infosec, and all kinds of different technolo...
bsidesroc.com
November 19, 2024 at 9:38 PM
Reposted by Ian
Interesting discovery while researching potential ESXi detections. If you execute a command over ssh (e.g ssh [email protected] "echo 123") that isn't logged to /var/log/shell.log but rather /var/log/auth.log as "User 'root' running command echo 123".

Make sure your detections look at both log files!
November 23, 2024 at 11:24 PM
The latest detection I've been working on is USB network card install's for some reason. I mean, DeviceEvents and UsbDriveMounted are working fine but returns a ton of virtual devices etc...

Parsing additional fields works to bring decent results but, I'm still trying to find value out of it.
November 23, 2024 at 8:46 PM
So I just picked a trusted InfoSec fellow and followed all they follow. That’s a good start right?
November 23, 2024 at 8:17 PM