Starting with a simple inspection of a web application, we uncover an exposed Azure Blob Storage container with anonymous listing enabled. From there, we demonstrate how attackers can enumerate additional containers, discover sensitive internal information, and take advantage of blob versioning to recover deleted credential files. The attack escalates quickly – by retrieving an old […]
Event ID 4624 is one of the most important Windows events for monitoring successful logons. We start by enabling detailed logon auditing on the Domain Controller and then generate several different logon scenarios, including: 1. Workstation unlocks, Logon Type 7 2. Local interactive logons, Type 2 3. Network authentication, Type 3 4. New logon session […]
ESC16 occurs when a Certificate Authority is configured not to include the SID security extension in issued certificates. This extension provides a strong binding between a certificate and the Active Directory account for which it was issued. If the extension is absent and the Domain Controller permits weak certificate mapping, certificate identities such as the […]
Conditional Access decides which device platforms it trusts based on the User-Agent, a value the client controls. Windows, Linux, iPhone all get blocked. So, we try something the policy never accounted for: Xbox Series X. The result is a Microsoft Graph access token, issued without ever triggering MFA. With that token we go straight to […]
I’m going to show you eight essential queries that cover everything from daily baselining to advanced threat hunting. For each query, I’ll explain what it does, when to run it, and why it matters. Let’s jump right in.” QUERY 1: Baseline Traffic Overview First up – the morning routine. This daily traffic overview is what […]
DDoS (Distributed Denial of Service) attacks remain one of the most common and disruptive cyber threats today. Instead of focusing on theory, this video walks you through realistic network data and shows how to identify attack patterns using powerful, real-time analytics. What you’ll learn: 1. How to detect SYN flood attacks using connection timeouts and […]
Traditional SOC workflows are slow, relying on manual log reviews and reactive alerting that often leaves you one step behind. When malware hides in encrypted payloads or fileless scripts, standard signatures simply aren’t enough. In this episode, we move beyond basic searches to implement three powerful queries designed to speed up your analysis: 1. Behavioral […]
Starting from an exposed SQL Server instance, we demonstrate how weak credentials can be exploited to gain access using a brute-force attack. Once authenticated as the powerful sa account, the attack quickly escalates beyond the database. We show how an attacker can: This episode highlights how small security gaps — like weak passwords and excessive […]
Setting up an EDR is a good first step, but simply having it installed doesn’t mean you’re protected. Many organizations rely on default settings, assuming the tools handle everything automatically. However, modern attackers know exactly how to work around those standard configurations. If your endpoints are invisible to your security team, or if your protection rules aren’t tuned to your specific environment, you’re leaving gaps […]
When you remove a file in Windows, the operating system marks the space as available, but the data often stays behind. By using Sleuthkit’s fls tool and MFTECmd, we can bypass the GUI to read the Master File Table directly. This allows us to see deleted entries and even track the source URL via the Zone.Identifier stream. One of the most critical findings […]
Learn more about our offer in terms of Consulting. Our Cybersecurity Experts perform consulting work on a daily basis, hence we are fully prepared for any challenge.
Lorem ipsum dolor sit amet, consectetur adipiscing elit. Ut elit tellus, luctus nec ullamcorper mattis, pulvinar dapibus leo.
