redteam - Lares Labs

redteam

A collection of 14 posts

activedirectory

Common ADCS Vulnerabilities: Logging, Exploitation, and Investigation - Part 2

In part 2, we investigate different scenarios and how to identify malicious users from a defensive standpoint.

Common ADCS Vulnerabilities: Logging, Exploitation, and Investigation - Part 1

In a two-part series, we look at Active Directory Certificate Services (ADCS), how to stand up a lab environment and logging from a defensive standpoint.

Offensive Sysadmin Suite, aka Adversary Kit

penetrationtesting Featured

Offensive Sysadmin Suite, aka Adversary Kit

The Offensive Sysadmin Suite provides a comprehensive set of tools presented in PowerShell and C#. This post dives into the functions of each.

The Phantom Menace: Exposing hidden risks through ACLs in Active Directory

The Phantom Menace: Exposing hidden risks through ACLs in Active Directory

The abuse of misconfigured Access Control Lists is nothing new. However, it is still one of the main ways of lateral movement and privilege escalation within an active directory domain.

Introducing Scraping Kit

penetrationtesting Featured

Introducing Scraping Kit

Scraping Kit comprises several tools for scraping services for keywords, useful for the initial enumeration of Domain Controllers or if you have popped a user's desktop with access to their Outlook client.

penetrationtesting

Outlook 365 for the PWN

While macros with PowerShell are a dying art and fewer and fewer red teams use them, threat actors still get away with targeting less mature clients using these techniques.

penetrationtesting

Living Off The Land - Built-In Pwning

Living off the land in the context of cybersecurity involves using existing tools, utilities, or scripts found on a target system. This post will dive into some of the useful built-in modules.

redteam Featured

Top 5 Insider Threat Findings

Throughout 2022, the Lares Red Team has tracked several emerging trends when assisting clients with insider threat engagements. This blog post elaborates on the five most impactful findings in environments.

penetrationtesting

Push Fatigue: We’re tired too.

More and more organizations are enrolling users in Multi-Factor Authentication (hereafter referred to as MFA), wherein a secondary form of authentication occurs following a user inputting their credentials into a service to ensure a user is who they say they are.

Multiple Paths to Compromise An Environment

Every stage of an attack starts with reconnaissance, from an external attacker's perspective, profiling a company's exterior footprint or an insider threat and identifying what systems to go after. A wealth of information can be gathered during the reconnaissance phase of an assessment. I've written about the OSINT techniques that

The Lowdown on Lateral Movement

What Is Lateral Movement ? Lateral movement is a broad MITRE ATT&CK category, consisting of nine distinct techniques and numerous sub techniques. Due to its breadth and linkages between other areas of the ATT&CK framework, lateral movement becomes an increasingly interesting category, presenting numerous challenges to defenders. The category

Introducing Sysmon Config Pusher

When providing various services to clients, including Purple, Blue, and Red Team engagements, the Lares team often recommends Sysmon to close detection gaps. Indeed, Sysmon is an incredible and freely available tool that enhances visibility across Windows systems and provides rich data and telemetry from which to build alerting, detections

Social Profiling – OSINT for Red/Blue

One of the areas that I love when it comes to red/purple engagements is profiling organizations on LinkedIn and GitHub, looking for crucial information that can lead to more juicy enumeration.