7MS #499: Desperately Seeking a Super SIEM for SMBs - Part 6

7 Minute Security

English - December 16, 2021 16:17 - 21 minutes - 19.8 MB - ★★★★★ - 63 ratings
Technology News Tech News information security security Homepage Download Apple Podcasts Google Podcasts Overcast Castro Pocket Casts RSS feed

Previous Episode: 7MS #498: Securing Your Mental Health - Part 2

Next Episode: 7MS #500: Interview with John Strand

Today we have some cool updates on this SIEM-focused series we've been doing for a while. Specifically, I want to share that one of these solutions can now detect three early (and important!) warning signs that bad things are happening in your environment:

ASREPRoasting

WDigest flag getting flipped (reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1)

Restricted admin mode getting enabled (reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f) - see n00py's blog for more info