Adversaries Are Doing Stranger Things Part 3

[@harshil.]

Really nifty usage of dev tunnels another great vid!

[@twalalyclassic5538]

This is awesome! Thank you very much. I keep learning new things from you, buddy

[@CyberAttackDefense]

You’re welcome. As always the more you share the more I can make!

[@0uss4m4]

I love how you simplify stuff !! thanks a lot for this

[@KATEMPAALEXIS]

Amazing tricks

[@tebo2286]

Awesome series, thank you for sharing

[@CyberAttackDefense]

Thanks for watching! Tell your friends!

[@tebo2286]

@@CyberAttackDefense I shall do so

[@局外祥神浪跡天涯]

I love this series of video! They're just too great. Thanks!

[@richardghani5458]

Hi subscriber hereh. We want a video on how we can set up elastic and configure sysmon on all our windows hosts and servers.

[@CyberAttackDefense]

Ok I might add that to the lineup.

[@MrVik24]

I don't understand why numbers of viewers is so low? Thank you for sharing

[@CyberAttackDefense]

Thanks! Share and maybe the numbers will go up!

[@MrVik24]

@@CyberAttackDefense Yes sirrrr!

[@AbelSheferaw]

Off-topic question: As a pentester wanna be, where do I find exploits before they die. Like before they are 2 years old and works no more. We want more videos on exploits. And thanks for the amazing contents you provide us for free.

[@CyberAttackDefense]

The true answer is you write them yourself. I know that sounds insane but it’s not that hard once you know how to exploit an application.

[@TalbertHoule]

If someone has a L7 firewall rule between the compromised host and the file server will that deep packet inspection be able to block the attack?

[@CyberAttackDefense]

The deep packet inspection would only work if it is designed to stop files being added via an admin share. Given that it’s a file server though odds are that it wouldn’t differentiate between an admin share and a standard share. So the typical consultant answer of it depends :).

[@BEAST4LIF3]

Lol sophos doesnt alert on default smbexec……..

[@CyberAttackDefense]

There is always one EDR that lets things go.