EnFuse Conference

-
                                        ChjrIfVUUAAjW_t.jpg (600×240)                                                                                                                     

Excited for another conference!  EnFuse!

caesars-exterior-multi-2009.jpg (250×188)
Pretty geeked for this conference as I have been slowly transitioning to focus more and more on the DFIR side of the world.   I will post a post-con blog once I am back.  

Enfuse is a three-day security and digital investigations conference where specialists, executives, and experts break new ground for the year ahead. It's a global event. It's a community. It's where problems get solved. Attend Enfuse to take your work—and your career—to a whole new level. Learn more about the change from CEIC to Enfuse in our"


 Going to try something different on this new blog. Every time I blog (which for now is rare) I will post a useful Hunting Command. 

Simple but effective - find all established connections on a certain port

netstat -na | find "443" | find /i "established"



Comments

Post a Comment

Popular posts from this blog

CyberArk Automation

-
Image
Tonight we are working on some CyberArk automation inside of VsCode.   The building and provisioning of safes can become cumbersome when you're enrolling several hundred users a week. With the help of an amazing PowerShell module by PSPETE  we can make quick work of this. Revision 1.0 of this script will do the following. 1.) Create Users Safe 2.) Add users network account to safe with customizable permissions 3.) Add a local CyberArk support account group with customizable permissions 4.) Add Vault Admin group for more support options with customizable permissions 5.) Add Users (new) Privileged account into their newly created safe. 6.) Run a Reconcile on the account to bring into CyberArk management. .   I will upload everything to  https://github.com/atomixgray/cyberark/  after a little more testing. Revision 2.0 will include an option for bulk uploading users via a CSV file.
Read more

Hack Week | #100DaysofCode

-
Image
At my 9 to 5 each quarter we are given a week to focus on a technology or an area that we want to level up on. This Hack Week I chose Python. I will be posting some of my projects along the way. For the first project I built a simple Tip calculator . This project helps you get a better understanding of Data Types and how to manipulate Strings. https://replit.com/@atomixgray/tip-calculator-start Rock, Paper, Scissors! The main goal of the next project is to get you familiar with Random and using Modules. This was a fun one. https://replit.com/@atomixgray/rock-paper-scissors-start Next up is For loops. What a challenging and fun project. Password Generator https://replit.com/@atomixgray/password-generator-start We are now at “Day 7” and building a Hangman Game . This touches on For & While Loops, IF/ELSE, List, Strings, Range, Modules. “Day 8” brings on another fun challenge creating a Cipher shift code! This challenge teaches you more on functions using ...
Read more

CyberArk Cred Automation

-
Image
Today we are back in the lab and working on a "Credential Grab". The PowerShell module once again brought to you by PSPete. (Full Screen to view - sorry) The script itself is pretty basic but can save you a bit of time each day. 1.) Prompts for the account password you wish to "grab" 2.) Ask for Server you'd like to connect to: 3.) Using Pete's module it reaches out using CyberArk's RESTAPI: 4.) Connects to desired safe grabs password: 5.) Password is copied to your clipboard: 6.) RPD session is opened: 7.) Simply Paste your password and you're logged in: https://lnkd.in/e_rms2D Module installation Copy the CredentialRetriever folder to your "Powershell Modules" directory. Get-Module -ListAvailable CredentialRetriever Import the module: I mport-Module CredentialRetriever Now that we have the module installed we can start our custom script found here . (work in progress) The script itself is pretty basic. Launc...
Read more