Category: Blue Team

• View Azure NSG Flow Logs In Powershell

  Azure can be chatty at the best of time and NSG flow logs are no exception. With this large volume comes cost and ingesting them into your SIEM may add to the pocket. Because of this, I created a simple script to display the NSG logs in a standard format…..

  Securethelogs

  17th Sep 2020

  Blue Team

  flow logs, logs, nsg, nsg logger, powershell, securethelogs, siem

• Active Directory Scripts

  I’ve created a bunch of Active Directory scripts to help identify attack points or stale accounts. This can be used for both, Blue and Red team members as they dive into abusable privileges….

  Securethelogs

  6th Jun 2020

  Blue Team

  active directory, ad, attack, powershell, scripts, security

• Phishing.web.core.windows.net

  EvilGinx is a prime example of some of the amazing tools out there that came be used for Phishing. If you haven’t heard of it, EvilGinx was release a few years back and showed us a weak point in 2FA. For most back then, MFA was a sure way to thwart the bad guys and…

  Securethelogs

  14th May 2020

  Blue Team, Cyber Security, Red Team

  hack, phiser, phish, Phishing, windows.net

• Living Off The Land: Suspicious System32

  The services below are some of the most commonly abused services for malicious parties to “live of the land”. Each are built into Windows and inherit trust by default. Because of this, security controls won’t ever be able to fully isolate them without affecting the operating system. For example, your endpoint protection can’t block command…

  Securethelogs

  12th May 2020

  Blue Team, Cyber Security, Red Team

  breach, cli, exe, hack, hacking, nc, netcat, powershell

• Hacking With Powershell: Malware

  With malicious parties continuing to use Powershell as their way in, I thought I would look into how it’s being used and what can be done to prevent it. This is something I’ve covered before, so think of this as a part 3…………

  Securethelogs

  26th Apr 2020

  Blue Team, Cyber Security, Red Team

  cmd, cyber, infosec, power, powershell, ransomware, security