Search This Blog

@inversecos

my research :D

Posts

Showing posts with the label lateral movement

Show All

Detecting Lateral Movement in Entra ID: Cross Tenant Synchronization

Get link
Facebook
X
Pinterest
Email
Other Apps

- September 21, 2024

Full blog post link: https://www.xintra.org/blog/lateral-movement-entraid-cross-tenant-synchronization

Contact

https://linktr.ee/inversecos

Blog Archive

February 20251
September 20242
March 20231
January 20231
December 20221
October 20222
September 20221
August 20222
July 20222
June 20223

May 20222
April 20222
March 20221
January 20221
December 20211
November 20211
October 20213
September 20212
May 20211
February 20211
April 20201
November 20191
March 20181
October 20172
June 20172

Show more Show less

Labels

$FILE_NAME
2fa bypass
4624 anonymous logon
aad
aad backdoor
aad persistence
activitiescache.db
AESCCMP
anonymous logon from asia
anonymous logon type 3

AnyDesk forensics anydesk anydesk log analysis anydesk logs anydesk file transfer
apt abuse exchange
apt compromise
apt ttps
apt-c-40
apt29 sdelete
arm64 buffer overflow
arm64 exploitation
arm64 heap overflow
arm64 rop chain
attack matrix
autologon
automation account abuse
azure ad
azure ad azure backdoor SAS URI hack azure blobs azure containers detecting azure storage azure storage
azure ad backdoor
azure ad forensics
azure cli forensics aadinternals forensics
azure command line forensics
azure command line logging forensics
azure host forensics
azure hybrid health compromise
azure key vault
azure oauth stealing
azure persistence
azure webhooks
backdoor application
binwalk
botnet
breakmedaddy
browser forensics
cahnadr
certificates
chrome cleared files
chrome forensics
chrome history
citrix
clipboard data
clipboard forensics
compromising azure health agent
cycript
debugging ios
defence evasion
detecting device code authentication
detecting linux defence evasion
detecting spoofed logs
detecting timestomping
device code authentication
entra id tokens in entra id
equation group
evasion
ews
exchange webshells
external ip connecting to server
fake adfs server
fake azure logs
forensic analysis of clipboards
forensic file deletion
forensics activitiescache.db
golden saml
gollumapp
heap feng shui arm64
heap grooming arm64
heap overflow ios
hunting exchange
hunting webshells
indicators of compromise JAR
insider case
insider forensics
insider threat
intel
intel registers
investigating insider threat
ios buffer overflow
ios exploitation
ios reverse engineering
ios reversing
ios rop chain
ios uaf exploit
iot device
iot reaper
JAR malware
JAR pdf malware
kaspersky labs
key vaults
KRACK
lateral movement
least significant bit
linux anti forensics
linux anti-forensics
linux defence evasion
linux log tampering
linux timestomping
m365 matrix
m365 phishing
malicious service installations
malware
malware analysis
mathy vanhoef
memory forensics
mfa bypass
mirai
native apis
native windows api
netscaler
nonce reuse
nsa
nsa ttps
ntsetinformationkey
o365
Oauth
oauth abuse
oauth access token
office 365
office365
otools
pass the cert
pass the prt
pass-through authentication
phishing JAR email
phishing office365
pngcheck
pyrogenic
pyrogenic malware
reaper botnet
recovering cleared chrome history
registry abuse
registry manipulation
registry timestomping
rest apis
reverse engineering
runbook abuse
sdelete
secrets
service principal abuse
service principals
slingshot malware
slingshotapt
spoofing azure ad sign in logs
spoofing azure logs
stack frames
stealing access token
steganography
stuxnet
timestomp
timestomping
timestomping $FILE_NAME
token stealing
use after free ios exploitation
warfare
Wi-Fi
windows apis
WPA2
x86 assembly

Show more Show less