Storage accounts in Azure comes with 2 keys. These keys basically give root access, so it can be beneficial for you to rotate to prevent storing of keys in an unsecure way, or sharing/abuse. You can now block access, however some may need on an in-frequent basis.

Below is a solution that I created to help monitor Public IPs, or to create an API allowing you to ingest for inventory. Please note: The PiPs here are deleted as soon as I’ve blogged so don’t attack or scan them thinking they are me.

Most of our endpoint management has now shifted to the cloud. With this often comes easy and great API access. Having this API access can really help you automate tedious tasks or increase your visibility. If you manage multiple agents on your endpoints, you often have teams managing at the…

LAPSUS$ seems to be the new focus after their recent activity surrounding Microsoft and Okta. If you’ve not seen, here is Microsofts blog. I always find these types of articles interesting but do often think that the cool aspect of “How they hacked” pulls focus away from some of the…

Incident response is at the heart of any organization. Built from the service desk up, it’s a key skill that reflects on how effectively your team handles unplanned events. For normal day to day, the focus is often on restoring availability or supporting users with localized issues, however for Security…

What are IOCs? Indicators of compromise (IOC) are a quick and easy way for your incident reponse/security team to check if similar activity occured (reactive) or preventing future attacks by means of blocking (Pro-active). These often come in the form of file hashes, IPs or domains and recently bitcoin addresses. …

Most vendors or services nowadays offer some form of tagging. To name a few: Azure, AWS, Google Cloud, Qualys, CrowdStrike. The feature itself is pretty straight forward, however if dynamic criteria can be applied or automation, it makes life that much easier. For most, the automation piece may come from…

The services below are some of the most commonly abused services for malicious parties to “live of the land”. Each are built into Windows and inherit trust by default. Because of this, security controls won’t ever be able to fully isolate them without affecting the operating system. For example, your…

As we explored in part one, PowerShell can be used for good and bad. We also talked about how monitoring and proper auditing is key. The reason why is that, PowerShell is being used in the wild for malicious activity. …