Research & Engineering Manager @CrowdStrike. Tweets are my own
Joined May 2013
- Tweets173
- Following233
- Followers556
- Likes341
Pinned Tweet
The @defcon talk I gave with @simakov_marina on #NTLM relay is now available online! youtu.be/vIISsfLh4iM
If you haven't seen it live and you're interested in #ActiveDirectory security you should definitely check it out!
Yaron Zinar retweeted
1/2 Three years ago @YaronZi and I presented a generic NTLM relay detection at #BHUSA. Recently, we extended it to detect machine accounts relay, independent of the coercion tactic used (PetitPotam, ShadowCoerce, DFSCoerce, etc.)
crowdstrike.com/blog/how-to-…
Want to learn more on how to mitigate #NTLM relay attacks exploiting #PetitPotam and #DFSCoerce?
Be sure to check out this blog post by @simakov_marina: crowdstrike.com/blog/how-to-…
Yaron Zinar retweeted
Get a primer on the Follina vulnerability and learn how the CrowdStrike Falcon platform protects customers by using behavior-based indicators of attack (IOAs). crwdstr.ke/6016zVMGq
Yaron Zinar retweeted
OMG! OMG! OMG! 🤯😱
I am growing the #team....again.
This time in North America.
Come join our #identityprotection Product Management team.
I want to work with you.
More details here
#identitysecurity #jobsearching #crowdstrik…lnkd.in/eRrJQw2z lnkd.in/eM9SCjA6
I wonder what will happen when MS finally decides to force LDAP signing or EPA for LDAPS and ADCS via patches
We saw a lots of problem after KB5005565 patch (or others KB on September 2021 patch tuesday), thinking it was related to #printnightmare 4x branch fix
But don't forget a nightmare can hide another one ( CVE-2021-1678 ), and see: msrc.microsoft.com/update-gu…
Excited to share I'll be (virtually) in Vegas presenting in @defcon a talk titled: "Adventures in MitM-land: Using Machine-in-the-Middle to Attack Active Directory Authentication Schemes" with
@sagish1233 @eyal_karni.
We'll present cool new MitM attacks against NTLM and Kerberos
Yaron Zinar retweeted
On January 12, 2021, Microsoft released a patch for CVE-2021-1678, an important vulnerability discovered by @CrowdStrike researchers. In this blog, we show how companies can protect themselves from this vulnerability. bit.ly/3bZVTkh via @aionescu @eyal_karni
Great research by @eyal_karni finding cool new ways to perform #NTLM relay.
NTLM relay refuses to die! A new blog is alive with details about the cool vuln in Print Spooler we have found!
It was patched by Microsft in the last Patch Tuesday. We also have a PoC we intend to release later.
The blog was written jointly with @aionescu crowdstrike.com/blog/cve-202…
Cool research by @eyal_karni - msrc.microsoft.com/update-gu…
#NTLM relay strikes yet again...
More details coming out soon...
Yaron Zinar retweeted
While the Bronze Bit vulnerability was patched, the ability to bypass the "Kerberos Only" protection in Kerberos Constrained Delegation was published 2 years ago by @elad_shamir and still works today against patched DCs 😇 shenaniganslabs.io/2019/01/2…
Great opportunity to join @preemptsecurity
linkedin.com/jobs/view/22318…
Yaron Zinar retweeted
📃 "NTLM relay of ADWS (WCF) connections with Impacket"
The story of how I implemented a new NTLM relay server in Impacket and succeeded in my pentest 😀
➡ clement.notin.org/blog/2020/…
Thanks to @agsolino and @_dirkjan for the inspiration and the original ntlmrelayx code!
Yaron Zinar retweeted
Today, we are delighted to share that @CrowdStrike, a leader in cloud-delivered endpoint and cloud workload protection, announced that it has agreed to acquire @preemptsecurity and its industry-leading Conditional Access technology.
Learn more here: crowdstrike.com/press-releas…
Yaron Zinar retweeted
CrackMapExec v5.1.1 is now available on Pypi. Thanks to @mpgn_x64 its stable enough for me to finally get rid of the old version. You can now install the latest version of CME with a `pip install crackmapexec`.
Happy Pwnage.
pypi.org/project/crackmapexe…
Yaron Zinar retweeted
Are all your DCs already patched against Zerologn (CVE-2020-1472)? Check out this simplified overview of the critical vulnerability discovered by @SecuraBV + further steps you can take to protect your network 😎
@YaronZi @preemptsecurity
preempt.com/blog/security-ad…
Yaron Zinar retweeted
Look at this slice of awesome. The new Wireshark version in dev (3.3.0) has a packet diagram view.
A fantastic teaching and learning tool! When released, I'll be making pretty extensive use of this in my classes! Great job @geraldcombs and @WiresharkNews team.
#Zerologon is (at least) one of the most critical vulns discovered this year. Its severity is equivalent to MS-14-068 (forged-pac). Exploits are public (@_dirkjan and #mimikatz).
You should patch ASAP. If you can't, this tool github.com/preempt/ntlm-scan… scans for *actual* attacks.
Tool works by trying an empty password for DCs every minute. Since exploitation must set password to an empty one, unless reverted very quickly this will detect exploitation attempts if running during exploitation.
Yaron Zinar retweeted
A new #mimikatz 🥝release with #zerologon / CVE-2020-1472 detection, exploit, DCSync support and a lots of love inside ❤️
It now uses direct RPC call (fast and supports unauthenticated on Windows)
> github.com/gentilkiwi/mimika…
Thank you: @SecuraBV