.\MandiantAzureADInvestigator.psd1 you should receive this output ">
Mandiant Azure AD Investigator
Focusing on UNC2452 Investigations

PS C:\Users\admin\Desktop\mandiant>
Connect to Azure AD by running Connect-MandiantAzureEnvironment -UserPrincipalName . You should receive a login prompt and output to the PowerShell window indicating the connections have been established. Note: If you run into issues you may need to change your execution policy by running Set-ExecutionPolicy -ExecutionPolicy RemoteSigned. This may require administrator privileges. ----------------------------------------------------------------------------
The module allows access to all existing remote PowerShell (V1) cmdlets in addition to the 9 new, faster, and more reliable cmdlets.

|--------------------------------------------------------------------------|
| Old Cmdlets | New/Reliable/Faster Cmdlets |
|--------------------------------------------------------------------------|
| Get-CASMailbox | Get-EXOCASMailbox |
| Get-Mailbox | Get-EXOMailbox |
| Get-MailboxFolderPermission | Get-EXOMailboxFolderPermission |
| Get-MailboxFolderStatistics | Get-EXOMailboxFolderStatistics |
| Get-MailboxPermission | Get-EXOMailboxPermission |
| Get-MailboxStatistics | Get-EXOMailboxStatistics |
| Get-MobileDeviceStatistics | Get-EXOMobileDeviceStatistics |
| Get-Recipient | Get-EXORecipient |
| Get-RecipientPermission | Get-EXORecipientPermission |
|--------------------------------------------------------------------------|

To get additional information, run: Get-Help Connect-ExchangeOnline or check https://aka.ms/exops-docs

Send your product improvement suggestions and feedback to exocmdletpreview@service.microsoft.com. For issues related to the module, contact Microsoft support. Don't use the feedback alias for problems or support issues.
----------------------------------------------------------------------------

Account Environment TenantId TenantDomain
------- ----------- -------- ------------
doug@test.onmicrosoft.com AzureCloud xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx test.onm...
Run all checks Invoke-MandiantAllChecks -OutputPath . You can also run individual checks using the specific cmdlet. Review the output on the screen and the written CSV files. Further Reading For additional information from Mandiant regarding UNC2452, please see: Highly Evasive Attacker Leverages SolarWinds Supply chain to Compromise Multiple Global Victims with SUNBURST Backdoor (https://www.mandiant.com/resources/evasive-attacker-leverages-solarwinds-supply-chain-compromises-with-sunburst-backdoor) Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452 (https://www.mandiant.com/resources/remediation-and-hardening-strategies-for-microsoft-365-to-defend-against-unc2452) The response to UNC2452 has been a significant effort across the security industry and these blogs heavily cite additional contributions that will be of value to users of this tool. We recommend reading the linked material from these posts to best understand activity in your environment. As always, the Mandiant team is available to answer follow-up questions or further assist on an investigation by contacting us here. (https://www.mandiant.com/report-incident)

Download Mandiant-Azure-AD-Investigator (https://github.com/mandiant/Mandiant-Azure-AD-Investigator)

___________________________
@hacking_Attack
@Hacking_Video

Bug Fix Update: TribeOne dApp is Ready to Take NFT Space by Storm
https://tribeone.medium.com/bug-fix-update-tribeone-dapp-is-ready-to-take-nft-space-by-storm-3cc6ac6077cd?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Our dApp is getting closer and closer to perfection as we work hard to achieve the best possible user experience.Continue reading on Medium » (https://tribeone.medium.com/bug-fix-update-tribeone-dapp-is-ready-to-take-nft-space-by-storm-3cc6ac6077cd?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Guide - Part 2
https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-2-4fa6f99250ac?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Previous: Beginner Bug Bounty Guide - Part 1Continue reading on Medium » (https://takshil-patil529.medium.com/beginner-bug-bounty-guide-part-2-4fa6f99250ac?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Fix Update: TribeOne dApp is Ready to Take NFT Space by Storm

Our dApp is getting closer and closer to perfection as we work hard to achieve the best possible user experience.Continue reading on Medium »
Read more...

Beginner Bug Bounty Guide - Part 2

Previous: Beginner Bug Bounty Guide - Part 1Continue reading on Medium »
Read more...

How to auto-run a script from a USB on Windows without using Rubber Ducky?
https://www.reddit.com/r/Pentesting/comments/sabwkz/how_to_autorun_a_script_from_a_usb_on_windows/

I would like to pentest my AutoPlay settings on Windows to see if I can prevent a regular USB flash drive from automatically running a script on the USB. I have a script that simply creates an empty file on the desktop, and I've placed this script on the USB flash drive. How do I get my flash USB to automatically run this script? My goal is to confirm that my AutoPlay settings successfully defeat this kind of attack. I am aware that USB Rubber Ducky is a more popular attack vector and will not be prevented by AutoPlay. Regardless I just want to pentest my AutoPlay settings for regular USB flash drives, not USB Rubber Ducky. But speaking of Rubber Ducky attacks, I disabled AutoPlay on windows and then unplugged and replugged my keyboard, and it worked automatically. Is there anyway to instruct Windows to disallow this and somehow require my approval, for example by clicking on a dialogue box? I assume that this could defeat a USB Rubby Ducky attack. Am I correct? submitted by /u/highlightprotein (https://www.reddit.com/user/highlightprotein)
[link] (https://www.reddit.com/r/Pentesting/comments/sabwkz/how_to_autorun_a_script_from_a_usb_on_windows/) [comments] (https://www.reddit.com/r/Pentesting/comments/sabwkz/how_to_autorun_a_script_from_a_usb_on_windows/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Mandiant-Azure-AD-Investigator - PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity

https://blogger.googleusercontent.com/img/a/AVvXsEhnfet5fSf1tYAxR0JFBmdtRK2FmIYsK3YjblmF6YbDUeMPzbcG0LFgOy3FWoMTxt8_hyHcMgm7ayEYRRHBh0uP7DfM6W6JYrXxgjVZZDhk6cok69bGnv3BsUGDYW-VLU7CpwZZShrbQC5625dv9rfeAlV7zrj-lboaYrgptqQN2r6U_RZzuIFtv8oG=w340-h400 This repository contains a PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity. Some indicators are "high-fidelity" indicators of compromise, while other artifacts are so called "dual-use" artifacts. Dual-use artifacts may be related to threat actor activity, but also may be related to legitimate functionality. Analysis and verification will be required for these. For a detailed description of the techniques used by UNC2452 see our blog.
This tool is read-only. It does not make any changes to the Microsoft 365 environment.

In summary this module will:

* Do a best effort job at identifying indicators of compromise that will require further verification and analysis

It will not:

* Identify a compromise 100% of the time, or
* Tell you if an artifact is legitimate admin activity or threat actor activity.

With community feedback, the tool may become more thorough in its detection of IOCs. Please open an issue, submit a PR, or contact the authors if you have problems, ideas, or feedback. FeaturesFederated Domains (Invoke-MandiantAuditAzureADDomains)This module uses MS Online PowerShell to look for and audit federated domains in Azure AD. All federated domains will be output to the file federated domains.csv.

* Signing Certificate Unusual Validity Period - Alerts on a federated domain where the signing certificates have a validity period of > 1 year. AD FS managed certificates are valid for only one year. Validity periods that are longer than one year could be an indication that a threat actor has tampered with the domain federation settings. They may also be indicative of the use of a legitimate custom token-signing certificate. Have your administrators verify if this is the case.
* Signing Certificate Mismatch - Alerts on federated domains where the issuer or subject of the signing certificates do not match. In most cases the token-signing certificates will always be from the same issuer and have the same subject. If there is a mismatch, then it could be an indication that a threat actor has tampered with the domain federation settings. Have your administrators verify if the subject and issuer names are expected, and if not consider performing a forensic investigation to determine how the changes were made and to identify any other evidence of compromise.
* Azure AD Backdoor (any.sts) - Alerts on federated domains configured with any.stsas the Issuer URI. This is indicative of usage of the Azure AD Backdoor tool. Consider performing a forensic investigation to determine how the changes were made and to identify any other evidence of compromise.
* Federated Domains - Lists all federated domains and the token issuer URI. Verify that the domain should be federated and that the issuer URI is expected.
* Unverified Domains - Lists all unverified domains in Azure AD. Unverified domains should not be kept in Azure AD for long in an unverified state. Consider removing them. Examples!! Evidence of AAD backdoor found.
Consider performing a detailed forensic investigation
Domain name: foobar.com
Domain federation name:
Federation issuer URI: http://any.sts/16B45E3B ‼️
The script has identified a domain that has been federated with an issuer URI that is an indicator of an Azure AD Backdoor. The backdoor sets the issuer URI to hxxp://any.sts by default. Consider performing a forensic investigati[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Mandiant-Azure-AD-Investigator - PowerShell module for detecting artifacts that may be indicators of UNC2452 and other threat actor activity

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[Hack The Box] Forge— Walkthrough

https://cdn-images-1.medium.com/max/1920/1*0gKY5fJjgIKfB7IKWLkZMA.png
Forge is a simple, beginner-friendly box that does not involve any guesswork.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kioptrix Level 5 — VulnHub

https://cdn-images-1.medium.com/max/700/0*l9569XIZPyaIM3VY.jpg
Introduction: Kioptrix Level 5 from Vulnhub

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
DonkeyDocker VM Walkthrough

https://cdn-images-1.medium.com/max/651/0*qwIGrub64iplKX7C.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking videos w educational and entertainment value?

Im just starting to get into the IT world, and my goal is to get into penetration testing. Right now im working on basic certifications to get general knowledge before my OSCP which hopefully ill start before the year ends. That being said, im looking for some hacking videos that i can learn from, but are also entertaining enough that i can get high and just chill w when im done studying for the night. Any youtube or other video streaming platform recommendations would be awesome!

submitted by /u/piehero2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
dsicord hacks

dsucord hakcs

submitted by /u/yyrczzz
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video