#DFIR #knowledgedrop

Awesome blogpost on how to dump shm on Linux:

https://isc.sans.edu/diary/How+to+collect+memoryonly+filesystems+on+Linux+systems/32432/

#memoryforensics #RAM #memoryanalysis

#dfir #knowledgedrop

Interesting observation:

Hard-coded RAM relocations (i.e. not ASLR) are actually way less common in modern day (64 bit) programs than you think. Most jumps etc. are relative and not hard-coded e.g. in the .reloc table.

I ran some velo tests and only one program on my standard Windows 10 installation with browsers had hard coded relocations: velociraptor itself.

#RAM #memory #relocation #velociraptor

PS: before someone complains: yes, 32 bit programs have Base of Data relocations, but that's for backwards compatibility when I'm correctly informed.

Recently having some #Sharepoint #cve202553770 cases.

Hint for analysts: also check for Visual Basic and C# not just PowerShell.

#DFIR #incidentresponse #knowledgedrop

Apparently, Microsoft broke the API a bit when retiring some of its parts

https://techcommunity.microsoft.com/blog/microsoft-entra-blog/action-required-msonline-and-azuread-powershell-retirement---2025-info-and-resou/4364991

The Microsoft Extractor Suite broke.

➡️ Workaround:

You can get up to 50.000 events via the Azure Web Portal. So filter for a username or a small timeframe.

⚠️ Note: you cannot download everything via the Web Portal, after 50.000 events, it'll just stop.

#DFIR #Azure #Cloud #knowledgedrop

Interesting defense against attacks:

Move your SSH authorized_keys to a different location and set the rights to 0444. Then an attacker needs root rights to place an SSH backdoor.

https://isc.sans.edu/diary/31986

#DFIR #knowledgedrop #hardening

#DFIR #threatintel #Knowledgedrop

Attackers are still actively exploiting firewall "../" vulnerabilities. Be aware and patch your firewalls!

Most organizations do not have multi-factor authentication (MFA) enabled for their Azure service principals.

Why?

You need a special license for every single application you want to enable MFA for.

#cloud #azure #knowledgedrop #pentesting

Watch out with your Azure Automation Account / Runbooks.

• they often include hard-coded credentials
• their output is not protected. So attackers can see your results
• they can use Shared Resources (i.e. credentials or certificates)
• Hybrid Worker and Azure Arc allow access to your on-premise infrastructure

Dangerous stuff if not managed correctly!

#cloud #azure #knowledgedrop #dfir #pentesting #privilegeescalation

How to reconstruct OneDrive?

OneDriveExplorer (by @Beercow) can reconstruct OneDrive from <UserCid>.dat or SQLite databases etc.

Check it out:
https://github.com/Beercow/OneDriveExplorer

#DFIR #artifact #azure #onedrive #knowledgedrop

Today a pentester asked me if attackers really use brute force.

Yes, they do, especially in cloud environments. That's why multi factor authentication (MFA) is so important there.

#knowledgedrop #purpleteam #cloud