Article: Windows Defender Exploit Guard ASR VBScript/JS Rule - published about 9 years ago.
Content: Microsoft has been adding to Windows 10 the features of the Enhanced Mitigation Experience Toolkit (EMET) in to the OS. On the 1709 release they added more features and expanded on them as part of Windows Defender Exploit Guard One of the features of great interest for me is Attack Surface Reduction. I have used this feature in EMET with great success as a m...
Copy Link: https://www.darkoperator.com/blog/2017/11/6/windows-defender-exploit-guard-asr-vbscriptjs-rule   
Published: 2017 11 07 12:00:00
Received: 2026 11 08 03:03:46
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Article: Windows Defender Exploit Guard ASR Obfuscated Script Rule - published about 9 years ago.
Content: On this blog post I will cover my testing of the Attack Surface Reduction rule for Potentially Obfuscated Scripts. This is one of the features that intrigued me the most. One obfuscates the scripts for several reasons:Bypass detection controls like AV, automatic log analysis and other controls. Hinder analysis of the script to determine its purpose and actio...
Copy Link: https://www.darkoperator.com/blog/2017/11/8/windows-defender-exploit-guard-asr-obfuscated-script-rule   
Published: 2017 11 08 12:00:00
Received: 2026 11 08 03:03:46
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Article: Windows Defender Exploit Guard ASR Rules for Office - published almost 9 years ago.
Content: On this blog post I continue looking at the ASR rules, this time I'm looking at the ASR rules for Office.  The ASR rules for office are:Block Office applications from creating child processesBlock Office applications from creating executable contentBlock Office applications from injecting code into other processesBlock Win32 API calls from Office macroThese ...
Copy Link: https://www.darkoperator.com/blog/2017/11/11/windows-defender-exploit-guard-asr-rules-for-office   
Published: 2017 11 14 11:00:00
Received: 2026 11 08 03:03:46
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Free Score Certificate

Article: Operational Look at Sysinternals Sysmon 6.20 Update - published almost 9 years ago.
Content: Sysmon has been a game changer for many organizations allowing their teams to fine tune their detection of malicious activity when combined with tools that aggregate and correlate events.  A new version of Symon was recently released. Version 6.20 fixes bugs and adds new features. Some the of the note worthy changes for me are:Enhancements in WMI Logging. Ab...
Copy Link: https://www.darkoperator.com/blog/2017/11/24/operational-look-at-sysinternals-sysmon-620-update   
Published: 2017 11 27 11:00:00
Received: 2026 11 08 03:03:45
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Article: Rebuilding My Playbook .. Knowledge Base - published almost 9 years ago.
Content: I find myself in the situation where I lost my personal playbook by user error. I accidentally deleted the VM where I ran xWiki where it was kept and did not realized the mistake until days later. Even if painful to rebuild it is a good opportunity to think on how to better organize it and put it in a more flexible format.  I Initially called my collection o...
Copy Link: https://www.darkoperator.com/blog/2017/12/10/nmba1hrmndda8m3eo7ipoh7bxvphz4   
Published: 2017 12 13 11:00:00
Received: 2026 11 08 03:03:45
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Article: Operating Offensively Against Sysmon - published about 8 years ago.
Content: Sysmon is a tool written by Mark Russinovich that I have covered in multiple blog post and even wrote a PowerShell module called Posh-Sysmon to help with the generation of configuration files for it. Its main purpose is for the tracking of potentially malicious activity on individual hosts and it is based on the same technology as Procmon. It differs from ot...
Copy Link: https://www.darkoperator.com/blog/2018/10/5/operating-offensively-against-sysmon   
Published: 2018 10 08 10:00:00
Received: 2026 11 08 03:03:45
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Cyber Tzar Score Summary

Article: Getting DNS Client Cached Entries with CIM/WMI - published almost 7 years ago.
Content: What is DNS CacheThe DNS cache maintains a database of recent DNS resolution in memory. This allows for faster resolution of hosts that have been queried in the recent past. To keep this cache fresh and reduce the chance of stale records the time of items in the cache is of 1 day on Windows clients. The DNS Client service in Windows is the one that manages t...
Copy Link: https://www.darkoperator.com/blog/2020/1/14/getting-dns-client-cached-entries-with-cimwmi   
Published: 2020 02 03 10:00:00
Received: 2026 11 08 03:03:44
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security

Article: Tracking WMI Activity with PSGumshoe - published over 4 years ago.
Content: WMI (Windows Management Instrumentation) is the Microsoft implementation of the Web-Based Enterprise Management (WBEM) and Common Information Model (CIM) standards from the Distributed Management Task Force (DMTF). This allows for a unified way to manage a group of systems by administrators allowing them to get information about the system, its current state...
Copy Link: https://www.darkoperator.com/blog/2022/3/27/tracking-wmi-activity-with-psgumshoe   
Published: 2022 03 27 17:18:01
Received: 2026 11 08 03:03:42
Feed: Blog
Source: Blog
Category: Cyber Security
Topic: Cyber Security