Active Directory Cheatsheet with code examples

- internal audit
- port forwarding
- bypass EP
- enumeration
- and etc…

— https://hideandsec.sh/books/cheatsheets-82c/page/active-directory

/ CrowdStrike Discovers First-Ever Dero Cryptojacking Campaign Targeting Kubernetes

https://www.crowdstrike.com/blog/crowdstrike-discovers-first-ever-dero-cryptojacking-campaign-targeting-kubernetes/

/ Multiple Internet to Baseband Remote Code Execution Vulnerabilities in Exynos Modems

https://googleprojectzero.blogspot.com/2023/03/multiple-internet-to-baseband-remote-rce.html

/ How to defences via the Win Registry from OneNote Malware

— https://www.huntress.com/blog/addressing-initial-access

/ KB5025175: Updating the WinRE partition on deployed devices to address security vulnerabilities in CVE-2022-41099

PatchWinREScript_2004plus.ps1 (Recommended)

This noscript is for Windows 10, version 2004 and later versions, including Windows 11:

-- https://support.microsoft.com/en-us/topic/kb5025175-updating-the-winre-partition-on-deployed-devices-to-address-security-vulnerabilities-in-cve-2022-41099-ba6621fa-5a9f-48f1-9ca3-e13eb56fb589

/ (Ab)using Adobe Acrobat Sign to distribute malware

https://blog.avast.com/adobe-acrobat-sign-malware

Good News and New Changes in Sys-Admin Open BLD ecosystem
 
lab.sys-adm.in - it's AD/Malicious-free Open BLD DNS secure service, today I happy present for you/us few good news:

New security concepts
🐕 Security - Open BLD ecosystem fundamentally changed preventing/attacking mitigation mechanisms, now Sys-Admin Open BLD infrastructure has centralized automated hacking IP mitigation system
☀️ Updates - With open Sys-Admin activities now we are have two new instruments which can change security protection prism which based on open source tools/instruments…
🐌 Speed - Extremely improved speed for collecting/merging/compressing and deploying block/allow lists from Internet

Results
🌵 Cactusd Server, which writen from scratch on GoLang - fully replace BLD-Server update service
🧘 ip2drop replaced fail2ban in Open BLD ecosystem
🥋 All servers has new firewall settings and improvements

Deprecations
♻️ BLD-Server will deprecated and excluded from Sys-Admin activities/supporting in future (thanks nodejs which was fundament for this service) ⚰

Welcome
👋 I'm looking for talent, experts, programmers and just good and positive people for code-review, feedback, suggestions and etc - Welcome 🤜🤛

/ Attackers are starting to target .NET developers with malicious-code NuGet packages

https://jfrog.com/blog/attackers-are-starting-to-target-net-developers-with-malicious-code-nuget-packages/

/ ShellBot Malware Being Distributed to Linux SSH Servers

https://asec.ahnlab.com/en/49769/

/ Cisco Event Response: March 2023 Semiannual Cisco IOS and IOS XE Software Security Advisory Bundled Publication

— https://sec.cloudapps.cisco.com/security/center/viewErp.x?alertId=ERP-74842

/ New guidance for identity and access management (IAM) from CISA and NSA for Administrators

/ “FakeGPT” #2: Open-Source Turned Malicious in Another Variant of the Facebook Account-Stealer Chrome Extension

https://labs.guard.io/fakegpt-2-open-source-turned-malicious-in-another-variant-of-the-facebook-account-stealer-d00ef9883d61

/ GitHub changed RSA SSH - need update locally

how to update key and why did they do it:

— https://github.blog/2023-03-23-we-updated-our-rsa-ssh-host-key/

/ Apache OpenOffice documents can contain links that call internal macros with arbitrary arguments..

CVE-2022-47502

https://www.cve.org/CVERecord?id=CVE-2022-47502

/ Nginxpwner is a simple tool to look for common Nginx misconfigurations and vulnerabilities

https://github.com/stark0de/nginxpwner

/ Shining Light on Dark Power: Yet Another Ransomware Gang

Another day, another ransomware gang. The Dark Power ransomware gang is new on the block, and is trying to make a name for itself..:

https://www.trellix.com/en-us/about/newsroom/stories/research/shining-light-on-dark-power.html

🌵 New Cactusd Release - v.0.1.7
 
Cactusd currently has multiple uses - download > aggregate > compress and sort and then merge to one block and allow domain/IP lists from Internet and finally publish lists in own embeded web server.

Now I want to present new few features:
- Upload server (as example: you can upload own IP lists from servers manually or with ip2drop.py to Cactusd which will merge and publish tis lists as dropped_ip.txt list)
- Now you can view size for published files on web server
- Now Cactusd can configure and ping remote servers with different ports (like as 53, 443, 853 and etc)
- Ping status results displayed on Cactusd web page
- Cactusd written on Go and now you cant simple implement cactusd binary in to systemd unit service

- https://github.com/m0zgen/cactusd

/ Malicious Actors Use Unicode Support in Python to Evade Detection

-- https://blog.phylum.io/malicious-actors-use-unicode-support-in-python-to-evade-detection

/ Microsoft Mitigates Outlook Elevation of Privilege Vulnerability

March 23, 2023 update:

— https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/

MacStealer: New macOS-based Stealer Malware Identified

https://www.uptycs.com/blog/macstealer-command-and-control-c2-malware