Opalsec :verified:<p>Get up to speed on the week's infosec news before another week in the trenches:</p><p><a href="https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-e05" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.substack.com/p/soc-gou</span><span class="invisible">lash-weekend-wrap-up-e05</span></a></p><p>Last week's patch Tuesday had SmartScreen bypasses and the Ping of Death, but nothing could beat the <a href="https://infosec.exchange/tags/Outlook" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Outlook</span></a> zero-click credential leak that <a href="https://infosec.exchange/tags/Microsoft" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Microsoft</span></a> patche-er, uh, wait, no not quite patched - turns out you can still abuse it locally to harvest NTLM credentials, yikes!</p><p>Non-transitive trusts have one job - to enable cross-domain authentication between only the two domains that maintain it. Turns out, that's not the case - you can actually pivot between domains and forests, authenticating to Services well outside the intended scope of the trust. And Microsoft aren't going to fix it.</p><p><a href="https://infosec.exchange/tags/Emotet" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Emotet</span></a> have realised in week two of their return that there's more to life than Macros, and have joined in the abuse of <a href="https://infosec.exchange/tags/OneNote" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>OneNote</span></a> files to deliver their lures.</p><p>In the world of ransomware, <a href="https://infosec.exchange/tags/BianLian" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>BianLian</span></a> have opted to focus on exfil-and-extortion campaigns, after Avast released a pesky decryptor for their ransomware in January this year. <a href="https://infosec.exchange/tags/CISA" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>CISA</span></a> have opened their books and shared a detailed profile on <a href="https://infosec.exchange/tags/LockBit" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>LockBit</span></a> 3.0's favoured TTPs and tooling that's worth a read.</p><p><a href="https://infosec.exchange/tags/Google" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Google</span></a> TAG have ousted Microsoft taking the easy way out in their previous patch of a SmartScreen bypass, opting to issue a half-baked patch that the <a href="https://infosec.exchange/tags/Magniber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Magniber</span></a> ransomware crew quickly circumvented, enabling them to deliver over 100,000 malicous lures unencumbered by the now-patched security control.</p><p>If you're running Adobe's ColdFusion, Aruba ClearPass, or SAP software - you're going to want to make sure you caught and patched these vulnerabilities that debuted last week.</p><p><a href="https://infosec.exchange/tags/Redteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Redteam</span></a> members have a new and improved AD lab environment to play in, as well as new evasion techniques for remote shells and macros to add to the toolkit!</p><p>Offensive Security have a gift for the <a href="https://infosec.exchange/tags/blueteam" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>blueteam</span></a> in the defensive Kali Purple distro, and we've caught a bunch of awesome write-ups to help in scaling Detection Engineering and mitigating common initial access vectors.</p><p>Catch all this and much more in this week's newsletter:</p><p><a href="https://opalsec.substack.com/p/soc-goulash-weekend-wrap-up-e05" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">opalsec.substack.com/p/soc-gou</span><span class="invisible">lash-weekend-wrap-up-e05</span></a></p><p><a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/cyber" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cyber</span></a> <a href="https://infosec.exchange/tags/news" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>news</span></a> <a href="https://infosec.exchange/tags/cybernews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybernews</span></a> <a href="https://infosec.exchange/tags/infosec" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosec</span></a> <a href="https://infosec.exchange/tags/infosecnews" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>infosecnews</span></a> <a href="https://infosec.exchange/tags/informationsecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>informationsecurity</span></a> <a href="https://infosec.exchange/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cybersecurity</span></a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacking</span></a> <a href="https://infosec.exchange/tags/security" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>security</span></a> <a href="https://infosec.exchange/tags/technology" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>technology</span></a> <a href="https://infosec.exchange/tags/hacker" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>hacker</span></a> <a href="https://infosec.exchange/tags/vulnerability" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerability</span></a> <a href="https://infosec.exchange/tags/vulnerabilities" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>vulnerabilities</span></a> <a href="https://infosec.exchange/tags/malware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>malware</span></a> <a href="https://infosec.exchange/tags/ransomware" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ransomware</span></a> <a href="https://infosec.exchange/tags/dfir" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>dfir</span></a> <a href="https://infosec.exchange/tags/soc" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>soc</span></a> <a href="https://infosec.exchange/tags/threatintel" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintel</span></a> <a href="https://infosec.exchange/tags/threatintelligence" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>threatintelligence</span></a> <a href="https://infosec.exchange/tags/patchtuesday" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>patchtuesday</span></a> <a href="https://infosec.exchange/tags/adobe" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>adobe</span></a> <a href="https://infosec.exchange/tags/ColdFusion" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ColdFusion</span></a> <a href="https://infosec.exchange/tags/Aruba" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Aruba</span></a> <a href="https://infosec.exchange/tags/ClearPass" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>ClearPass</span></a> <a href="https://infosec.exchange/tags/SAP" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SAP</span></a> <a href="https://infosec.exchange/tags/Kali" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>Kali</span></a></p>