Netsec @NetsecSE

Bank-grade Security - Next Gen Thought Leader Stockholm, Sweden Joined June 2017

Tweets

495
Followers

147
Following

787
Likes

2K

Netsec @NetsecSE

12 months ago

Windows Server 2028 will include mandatory "Azure NTP", giving you modern cloud time sync capabilities for only $1/month/server.

CJ @N805DN

12 months ago

Windows Server 2028 will include mandatory "Azure NTP", giving you modern cloud time sync capabilities for only $1/month/server.

0 0 0 181 0

0 0 0 55 0

Elli Shlomo (IR) 🏴‍☠️ @ellishlomo

a year ago

While #CrowdSrtike had a massive outage, CISOs and many security managers asked me about delaying updates in Microsoft Defender. This article discusses these possibilities in MDAV and MDI. Still, you should decide what is best for your organization and technological…

4 24 115 11K 79

CIRCL - @[email protected] @circl_lu

2 years ago

A out-of-bounds write vulnerability [CWE-787] in FortiOS may allow a remote unauthenticated attacker to execute arbitrary code or command via specially crafted HTTP requests. "Workaround : disable SSL VPN (disable webmode is NOT a valid workaround)" fortiguard.com/psirt/FG-IR-24…

0 22 30 7K 4

Netsec @NetsecSE

2 years ago

Begs the question why MSFT who spends billions on LLMs can't make their phishing filter more effective. Should be a perfect match for Defender for Office? x.com/markrussinovic…

0 0 1 143 0

Netsec @NetsecSE

3 years ago

Not comforted by the fact that Microsoft doesn't clearly and publicly address this question that obviously worries alot of people. If there wasn't anything fishy being planned here, why not just post a blog and clear all confusion?

Tristan Rice @ricetristan

3 years ago

1 0 5 0 0

0 0 0 0 0

🅰🅳🅼 @securityfreax

3 years ago

No, just No! If this requirement remains, then it's time to look for an alternative for MDE.

🅰🅳🅼 @securityfreax

3 years ago

No, just No! If this requirement remains, then it's time to look for an alternative for MDE. https://t.co/4ObvfajU5q

0 2 4 0 1

Download Image

0 2 3 0 0

Download Image

Michael Durkan 🇮🇪 @durkanm

3 years ago

I'm normally very Pro-MSFT, but this is ridiculous. Just when you thought MSFT were positioning themselves well as regards security, this will drive enterprises and possibly CSP's to choose other vendors as opposed to forcing customers to unneeded Azure subs. #msftsecurity

Nathan McNulty @NathanMcNulty

3 years ago

4 1 17 0 1

0 1 3 0 0

Nathan McNulty @NathanMcNulty

3 years ago

@headburgh This is what happens when people making decisions have no comprehension of the technical side and don't have anyone helping them I can see how an unknowing PM could see upsell opportunities, but they've obviously never lived a single deployment of the solution in their life

1 1 4 0 0

Nathan McNulty @NathanMcNulty

3 years ago

Whelp, not good news... This seems to affect EA too. This decision will drive many orgs away from MDE, not just on servers but clients too, which devalues E5 licensing affecting all other groups All to drive Azure sales that were never on the table

4 1 17 0 1

Netsec @NetsecSE

3 years ago

A capability I'd very much like to see. But doubt it'll work with current implementation of group write back(?).

Frederik Leed @FrederikLeed

3 years ago

A capability I'd very much like to see. But doubt it'll work with current implementation of group write back(?).

4 0 15 0 0

0 0 0 0 0

Netsec @NetsecSE

3 years ago

This is gonna be fun to play with.

Tali Ash @Taliash1

3 years ago

This is gonna be fun to play with.

1 38 84 0 13

0 0 2 0 0

Netsec @NetsecSE

3 years ago

Microsoft Defender for Windows Print Spooler (P1/P2).

0 0 3 0 0

Netsec @NetsecSE

3 years ago

Security Policy & Regulatory Compliance would be nice, but hardly worth 3x the cost of P1 imho.

Yuri Diogenes @yuridiogenes

3 years ago

Security Policy & Regulatory Compliance would be nice, but hardly worth 3x the cost of P1 imho.

5 28 74 0 2

Download Image

0 0 0 0 0

Justin Elze @HackingLZ

3 years ago

So hurry up and take number matching out of preview? microsoft.com/security/blog/…

2 9 29 0 3

Download Image

rik van duijn @rikvduijn

4 years ago

@_wald0 Admin came to us after we retrieved his credentials in plaintext with mimikatz. Asked us not to put his credentials in the report as he used it for all his accounts(work and private). And he didn't want to have to change it.

5 9 62 0 0

Netsec @NetsecSE

4 years ago

Love the FalconFriday posts. Educational and actionable content that has helped me to build several new detections in my environment.

Olaf Hartong @olafhartong

4 years ago

Love the FalconFriday posts. Educational and actionable content that has helped me to build several new detections in my environment.

0 30 88 0 18

1 0 2 0 0

AskWoody DEFCON Alerts -- Time to pause updates @DefconPatch

4 years ago

See askwoody.com/ms-defcon-syst… going to be sending out a special alert in the morning warning about business patching side effects. Going to MS-DEFCON 1

0 3 7 0 0

Netsec @NetsecSE

4 years ago

@SwiftOnSecurity For MDE it would be useful to have something for domains that's similar to the prevalence count available for executables. Not sure if technically feasible though. In general I think there's much potential for adding features that leverages the DNS telemetry already collected.

0 1 1 0 0

Netsec @NetsecSE

4 years ago

Vendors happily informing you that they use Log4j 1.x is the equivalent to "This patch Tuesdays vulnerabilities does not affect us since all our servers run Windows 2000".