If you are using managing an enterprise, you will undoubtedly encounter malicious emails targeting your end users. Ideally, you could delete these messages from within your end users’ mailboxes. Normally, this is a premium feature, but if you have configured your G-Suite environment to use PSGSuite, it can be accomplished with some pretty basic scripting….
Category: InfoSec
Posts pertaining to information security
Cloud – Synchronizing Disablements Between Federated Domains (Azure, Google)
When configuring provisioning between Azure and Google federated domains, you will likely reference Microsoft’s documentation on configuring their canned provisioning Enterprise Application at https://learn.microsoft.com/en-us/entra/identity/saas-apps/g-suite-provisioning-tutorial. There is more information here as well: https://learn.microsoft.com/en-us/entra/identity/app-provisioning/configure-automatic-user-provisioning-portal. The procedure outlined here will get you started- however, you will quickly realize that disablements are not synchronizing between the two platforms. I…
PowerShell – Get AD User’s Last Logon Time
Here’s a simple little function I put together that will accept a user’s name in First Last format, and then return their last logon time information from AD. Here is the GitHub link: https://github.com/p8nflnt/SysAdmin-Toolbox/blob/main/Get-AdUserLogonTime.ps1
PowerShell – Get Windows Host Info with PsExec
Over the past several days, I have been exploring the idea of retrieving information for diagnostic purposes from Windows hosts using PsExec of the Sysinternals suite. This is something that might make sense for a small environment, as it is clientless, and there is really no overhead besides the lightweight PsExec tool, and the ThreadJob…
PowerShell – Convert PsExec-run Cmdlet Output Strings Back to Objects, Properties, & Values
I have been experimenting with using PsExec of the Sysinternals suite to gather information from remote Windows systems for diagnostic use. I’ve found it to be a powerful tool, especially when integrated with PowerShell scripts. It is able to execute a script or command on a remote machine and return the output back to the…
Thoughts on Obfuscation of Botnet C2 Communications
This afternoon, while mountain biking, I was listening to a cybersecurity podcast about botnets. The gentleman on the episode was discussing detection of unknown botnets by looking at recurring patterns from the level of a dynamic DNS provider. A provider like this has incredible insight into web traffic on a global scale. The man described…
JavaScript – Bot Repellant – Obfuscation
For obvious reasons, it is not a good idea to have your contact information displayed in plaintext on the web. Webcrawlers and bots do exist, and will use RegEx to pick emails and phone numbers out of client-side-source like it’s a cakewalk. Now, ideally, your implementation of what I am dubbing “bot-repellant”, would include server-side…
PowerShell – Add Hosts to AD Group
Here’s another simple script I put together. It allows you to specify a Security Group in Active Directory, and add a list of hosts to this group. Simple, but yet another tool that every SysAdmin should have in their repository.
PowerShell – Save Updates And Import to WSUS
Since Internet Explorer has now been deprecated, there is a need to import updates to WSUS natively without the installation of additional browsers. I’ve found that some of the functionality can be accomplished with Microsoft MVP Chrissy Lemaire’s “KBUpdate” PowerShell module, but it merely facilitated the process by downloading the update, and thus, I did…
PowerShell – Set AD Security Group Membership
Here’s a script that I wrote to allow you to provide a list of machine names and set the membership of an Active Directory security group. It outputs the initial membership count to the console, removes devices that are not present in the provided list, adds devices that are not already present, and then outputs…