Windows Archives | JUMPSEC LABS

Advisory: IDOR in Microsoft Teams Allows for External Tenants to Introduce Malware

by maxcorbridge | Jun 21, 2023 | Exploitation, Research, Security Bug, Vulnerability, Windows

TL;DR Max Corbridge (@CorbridgeMax) and Tom Ellson (@tde_sec) of JUMPSEC’s Red Team recently discovered a vulnerability in the latest version of Microsoft Teams which allows for the possible introduction of malware into any organisations using Microsoft Teams in its default configuration. This is done by bypassing client-side security controls which prevent external tenants from sending files (malware in this case) to staff in your organisation. JUMPSEC has detailed remediation options, as...

Butting Heads with a Threat Actor on an Engagement

by maxcorbridge | Apr 17, 2023 | Exploitation, Incident Response, Vulnerability, Windows

After compromising a sensitive external server JUMPSEC’s Red Team found that they were not the first ones there…

No Logs? No Problem! Incident Response without Windows Event Logs

by editor | Nov 22, 2021 | Forensics, Incident Response, Windows

In this article, we discuss some Digital Forensics and Incident Response (DFIR) techniques you can leverage when you encounter an environment without Windows event logs.

PowerShell Jobs

by editor | Oct 7, 2021 | Detection, Incident Response, Monitoring, Windows

JUMPSEC investigators recently observed an adversary weaponising PowerShell Jobs to schedule their attack whilst responding to an incident. We discuss what PowerShell Jobs are, how they can be leveraged for malicious purposes, and how defenders can protect, detect, and respond to neutralise the threat.

Running Once, Running Twice, Pwned! Windows Registry Run Keys

by editor | Aug 11, 2021 | Detection, Incident Response, Monitoring, Windows

The Windows registry is a vast and complex topic and cannot be understood and defended in one article. One particular area of interest from a security perspective is registry run keys. In this article, we discuss who uses them, how to uncover abuse, and how to eradicate evil from them.

JUMPSEC LABS

Butting Heads with a Threat Actor on an Engagement

No Logs? No Problem! Incident Response without Windows Event Logs

PowerShell Jobs

Running Once, Running Twice, Pwned! Windows Registry Run Keys

[Latest Posts]

[Categories]

GitHub

Follow JumpsecLabs

Disclaimer