Author: Daniel

CQURE Hacks #75: NTFS Forensics – Recovering Deleted Files and Analyzing MFT Records

When you remove a file in Windows, the operating system marks the space as available, but the data often stays behind. By using Sleuthkit’s fls tool and MFTECmd, we can bypass the GUI to read the Master File Table directly.  This allows us to see deleted entries and even track the source URL via the Zone.Identifier stream. One of the most critical findings […]

CQURE Hacks #73: Using a Malicious LNK File to Take Over Infrastructure (LNK Relay)

The scenario is straightforward: a regular domain user has WRITE permissions on a shared folder. That’s enough to plant a malicious .lnk file pointing to an attacker-controlled SMB server. The moment another user browses that share in File Explorer, the system attempts authentication automatically – and the NETNTLMv2 response is captured. From there, the path […]

CQURE Hacks #72: KQL Threat Hunting – One Query, Three Hunts

In active-duty security, time is your most valuable asset. Most hunters struggle because they try to write a brand-new query for every single alert. This creates a messy library of code that is hard to manage. Kajetan, one of our frontline experts, shows you how to use one “Base Query” as a launchpad for three […]

CQURE Hacks #71: 5 KQL tricks to speed up threat hunting

In active-duty threat hunting, time is the only currency that matters. Most IT professionals struggle with queries bogged down by excessive calculations or filtering applied far too late in the pipeline, creating a bottleneck that can obscure critical indicators of compromise. Kajetan, one of our frontline practitioners, walks through five practical techniques that immediately improve […]

CQURE Hacks #69: SMB Signing – Why It Won’t Save Your Data from a Passive Traffic Sniffer

The Experiment Setup Our test environment was configured for maximum network security, with both the server (SRV01) and the client (WIN11-01) explicitly set to support and require SMB signing. The Critical Finding Despite having SMB signing enforced on both endpoints, our packet capture yielded a critical, visible finding: the entire contents of the file, “SMB […]

CQURE Hacks #68: NTLM Relay Attacks Explained and Why It’s Time to Phase Out NTLM

We begin on the Domain Controller, where the Group Policy setting “Network security: Restrict NTLM: NTLM authentication in this domain” is initially set to Disabled. This allows NTLM-based authentication to proceed – opening the door for potential relay attacks. On the attacker machine (running Kali Linux), the Responder and Impacket’s ntlmrelayx tools are launched. Once […]