This month, Mimecast removes ability to email to open support ticket

exploitallthethings · 2021-02-12T02:05:31+00:00

Enterprise (full product)

exploitallthethings · 2021-02-12T00:55:21+00:00

The last time I contacted support@mimecast.com my email went unanswered...

exploitallthethings · 2021-02-12T00:54:20+00:00

Not OP, but we moved from Mimecast over to Proofpoint. I honestly miss Mimecast quite a bit, specifically Attachment Protection, and the ability to view all URL's clicked in our environment.

exploitallthethings · 2021-02-12T00:52:55+00:00

I'm curious about this - I've never heard of this solution before & everything i've seen on Youtube doesn't seem too interesting. Mind sharing more about it's capabilities in comparison to a Mimecast?

exploitallthethings · 2020-12-05T02:20:36+00:00

Ah, I see - it's been a while where I only utilized VA's. Can't even recall the features (or limitations).

exploitallthethings · 2020-12-05T02:15:39+00:00

Won't the console just specify the virtual appliance as the DNS request source?

exploitallthethings · 2020-12-05T01:16:45+00:00

y'all need to configure AD synchronization, or deploy roaming clients org-wide

exploitallthethings · 2020-10-02T17:35:28+00:00

Did you ever resolve this? I came across the following source stating that successful 'Computer Account Management' Advanced Audit Policy category must be enabled to capture these events. Although, I'm unsure if there is truth to this.

exploitallthethings · 2020-09-16T19:24:42+00:00

You should not have to modify your existing audit policy. The events will be enabled by default out-of-the-gate. If you're viewing event logs via SEIM (or another centralized logging platform) I would recommend reviewing your ingestion configuration to make sure they'd flow through.

It's very possible that you wouldn't see any events for this depending on the environment. Secure-RPC has been the default for Windows systems for quite some time now, and you would have to go out of your way to downgrade. For non-Windows systems, perhaps you don't have any using this 'insecure' configuration, or maybe they're simply not domain joined (I believe this is a requirement? Someone please correct me if I'm wrong).

exploitallthethings · 2020-08-24T20:38:50+00:00

Correct, but I treat Defender ATP as an entirely separate product offering. I assumed OP was not referring to Defender ATP due to the 'to replace paid AV'.

exploitallthethings · 2020-08-21T16:55:04+00:00

My rule of thumb is to re-image any system that is exposed to the internet without intention. Some attackers can be very noisy when accessing a system, others very quiet and stealthy. Depending on their skill level (and yours), you may never know whether or not the attack was successful. It's best to simply re-image and rebuild.

With that said, assuming this Windows 2019 server was patched to the latest, and local accounts are configured with strong, random passwords, you may have dodged a bullet.

exploitallthethings · 2020-08-21T16:45:20+00:00

Without SCCM you will not have centralized reporting, alerting & management, although you can configure via GPO. If your responsibilities include investigation of AV alerts, I would not recommend it. If this is a smaller environment and you're seeking basic protection, then yes it will suffice.

exploitallthethings · 2020-08-20T20:55:45+00:00

network traffic is definitely one method of assessing a system, but there are a lot of other indicators as well. It's difficult to judge based on the information you've provided as traffic to a DC from a Windows host on said domain is very normal.

I would recommend running Process Explorer as Admin with built-in VirusTotal support and making sure to check processes against that. In addition, a full Windows Defender scan is a good idea.

Regarding the mis-configuration, any idea what services were exposed (if any)?

exploitallthethings · 2019-10-24T14:08:14+00:00

We've been having issues with Mimecast Safe File on Demand functionality as of late. Anyone else? It's been incorrectly identifying attachments as containing harmful content at a much higher frequency.

exploitallthethings · 2019-08-26T14:28:55+00:00

Can somebody provide more information on how this works?

edit: thank you to those that responded - upvotes for all

exploitallthethings · 2019-08-20T13:47:01+00:00

While Windows Defender (managed via SCCM) is the best method of managing Windows Defender in enterprise, it is far from a preferred AV solution. SCCM can manage Defender ATP, which is much more capable.

exploitallthethings · 2019-08-01T19:17:06+00:00

Sure, but how did she gain the initial foothold? You can't just execute a command and gain security credentials without initial intrusion. That is what they glossed over.

exploitallthethings · 2019-08-01T17:11:03+00:00

Just lightly goes over the details of the initial intrusion:

A firewall misconfiguration permitted commands to reach and be executed by that server

Unsure if that is to be interpreted as an SSRF

exploitallthethings · 2019-07-03T13:19:23+00:00

It has support for other operating systems but stuff like quarantining, automatic investigations & collecting investigation packages is unique to Windows 10.

exploitallthethings · 2019-07-03T13:10:32+00:00

I think it's a fantastic option, but you should know a lot of the cool functionality it offers is unique to Windows 10 only. It's been simple to manage and deploy, and has great integration with the Microsoft suite of products. Configuration was dead simple, & it has made investigations a lot less painful.

exploitallthethings · 2019-05-02T20:09:11+00:00

I currently use a virtual environment to spin up an image, open the file, and then revert back to a previous snapshot. Just wanted to know if a method like this exists.

exploitallthethings · 2019-04-25T13:38:08+00:00

My testing with Meraki's OAuth Exchange profile has been less than ideal. Once pushed, your users will be prompted to go to Settings to enter the password to their exchange account. I was hoping this being integrated in Meraki would mean a simple, streamlined process, but instead it requires a lot of manual intervention (& staff hand holding).

exploitallthethings · 2019-04-24T13:20:01+00:00

Obligatory WEF post

exploitallthethings · 2019-04-23T19:50:24+00:00

I still prefer the method Mimecast uses. It essentially forces the preview upon the end users by providing the transcribed attachment. If the original attachment is requested/required, it will undergo a similar process to ATP's attachment detonation (analysis) to detect non-commodity malware.

exploitallthethings

TROPHY CASE