by Mike Saunders | May 10, 2021 | Blog Posts
If you want to execute arbitrary code on an endpoint during a penetration test, chances are you’ll have to evade some kind of antivirus solution. AV engines use two detection methods to identify malicious code – signature-based and heuristic-based...
by Mike Saunders | Jan 6, 2021 | Blog Posts
I recently performed an assumed breach test against what I would consider an Apex Defender organization. The security team is smart, well-funded, extremely capable, and resourceful. The team has both hardened systems and instrumented great logging and monitoring....
by Mike Saunders | Oct 30, 2020 | Blog Posts
It’s fairly well known that printers and MFDs can be a gateway to compromise on otherwise secured networks. We regularly encounter networks filled with these devices internal tests and (ab)use their functionality in various ways, including harvesting usernames,...
by Mike Saunders | Apr 16, 2020 | Blog Posts
This is the third installment in a series of blogs on user enumeration. In Part 1 – Building Name Lists, I talked about ways of building usernames from OSINT and US census data. In this installment, I’m going to discuss putting this info to work in...
by Mike Saunders | Mar 24, 2020 | Blog Posts
A common tactic used by pen testers, “red teams”, and threat actors is searching for Group Policy Preference (GPP) files with usernames and passwords. These XML files, stored in the domain SYSVOL, are used to create local administrator accounts, map...
