SmokescreenTech

I've been watching decoys I setup on the internet with the intention to share interesting stuff I see to my fellow infosec peeps here. Hopefully some weird stuff too. Here's stuff I see on SSH in the last 10 days

#activedefense brings graphical thinking to defense, a tool attackers have been using for a long time. Attackers: If you have X control, I'll do Y Active Defenders: If you do Y, then I'll do Z. An element of surprise is sometimes enough to beat an adversary.

A 4-point abstraction to MITRE Shield techniques for #activedefense approach: 1. Deceive - Feed false data 2. Standardise - Define operational guidelines 3. Analyse - Bubble-up anomalies with higher fidelity 4. Control - Scale-up/down restrictions. Makes my life simpler.

(1/10) I've been trying to better understand the funnel of fidelity and this is my attempt to abstract some of the challenges I've encountered. Credit to this post: posts.specterops.io/introduc… @specterops

Happy 2021. Some #activedefense measures for #appsec folks to consider: 1. A post-auth hidden parameter like "admin=1" in all requests to trap parameter tampering. 2. A decoy page on /admin/login to trap enumeration of admin pages 3. A decoy API endpoint like /users Enjoy!

Anyone who knows me, knows I am absolutely fascinated with challenges in Active Directory Security. This piece marries my two favorite topics currently: #activedefense and #activedirectory :) Give it a look ! smokescreen.io/four-mitre-sh…

Thinking about #activedefense tactics and looking through MITRE Shield: The challenge is not "how" to implement the measures, the challenge is "where". Everywhere? Only a few assets? Only in the DMZ? #netsec #mitre #DFIR

I enjoy writing. Writing makes you think deeply about topics, deconstruct complexity, and relive significant events in your life. I LOVED writing this one #redteam #pentest #storytime @SmokescreenTech smokescreen.io/library/red-t…

I've only recently started tweeting as opposed to lurking. Highlighting my favorite post by @jaredcatkinson posts.specterops.io/introduc… So clarifying at so many levels. I still go back to this every other week. Must read for defenders. <3

Top 5 Wishlist for 2021 : Domain/enterprise admin lockdown Service account privileges reduced SMB traffic restriction No shared admin accounts for day-to-day operations LAPS #activedirectory #DFIR #ransomware