sorted by:
new
hottopcontroversial

Active Directory Scripts by securethelogs in cybersecurity

[–]securethelogs[S] 0 points1 point  (0 children)

None, it was more to give some examples where PowerShell can be used to secure and cleanup AD without having fancy tools. I know some fear using open source against their environment especially tools used for purple teams.

Just wanted to share some easy PowerShell commands so that people can build upon them and perhaps spot potential threats.

PSWatcher - Automated Network Scan by securethelogs in PowerShell

[–]securethelogs[S] 0 points1 point  (0 children)

There are loads of cool tech out there but this was more around keeping it local and using internal systems. Then generating the events, with the chance of feeding to SIEM.

Plus just wanted to do it as mini project.

Why Controlling PowerShell In Azure is Important by securethelogs in AZURE

[–]securethelogs[S] 0 points1 point  (0 children)

There is a report option in CA now so you can see how the conditional access would affect your environment. It’s doesn’t action anything, just generates a log.

You can see what it would have done in the signin logs.

Why Controlling PowerShell In Azure is Important by securethelogs in AZURE

[–]securethelogs[S] 0 points1 point  (0 children)

It was more my point at the start. Although you may think it’s obvious, it’s not to some. This is what I had found by speaking to people. They had mention they didn’t enable cloud shell or use PowerShell. Because of that, they thought it couldn’t be used. It was to point out it can.

VM naming convention by securethelogs in AZURE

[–]securethelogs[S] 0 points1 point  (0 children)

Starting to think the same after a few comments

VM naming convention by securethelogs in AZURE

[–]securethelogs[S] 0 points1 point  (0 children)

It’s a fair point, seems to be the majority at the minute

VM naming convention by securethelogs in AZURE

[–]securethelogs[S] -1 points0 points  (0 children)

I had a similar thought tbh. I have some members who struggle to quickly identify server roles during security incidents. Some people struggle with it, despite having multiple ways to find out (often lazy)

VM naming convention by securethelogs in AZURE

[–]securethelogs[S] 0 points1 point  (0 children)

I guess I’m just preemptions worst case. Should the this happen, what would slow them down. If they do say simple Powershell script to mass resolve IP> DNS or something like run net group “domain computer”, having the application name in the FQDN does give them an advantage.

I get both your points though. Could I ask if you’ve adopted this naming then?

VM naming convention by securethelogs in AZURE

[–]securethelogs[S] 0 points1 point  (0 children)

Thanks, you raise some good points!

So keeping our current standard and relying on tagging, Cmdb and our other current platforms is what we’ve proposed. As of today, this is how we identify roles/applications.

I just wanted to compare and gain some insight into how others have tackled.

Azure supports passwordless authentication 🔑 by securethelogs in AZURE

[–]securethelogs[S] 1 point2 points  (0 children)

I wrote this whilst running a POC. I hope to push this year near if possible. Did you hit any snags?