Doug Bienstock

@doughsec

IR Leader @Mandiant. Hacking things and responding to things being hacked. Opinions my own

Joined February 2018

110 Following

2,456 Followers

Replies Reposts Media

Pinned
Doug Bienstock
@doughsec
Apr 27, 2021
🚨🚨 New technique to steal AD FS secrets over the network. Defenders need to block internal traffic to AD FS servers over port 80 now! Read more: fireeye.com/blog/threat-re… shoutout to @DrAzureAD who had the same though to look into AD FS replication and all his great work! 1/3
Mandiant Cybersecurity Consulting
From cloud.google.com
6
Doug Bienstock
@doughsec
Jul 30, 2024
What is old is new again. Very cool work from @TrustedSec team! Highlights the importance of understanding what a vendor means when they use the word “patch”
GIF
TrustedSec
@TrustedSec
Jul 29, 2024
Today, TrustedSec is releasing #Specula (our previously internal framework) into the world, which will transform the Outlook email client into a beaconing C2 agent. @Oddvarmoe and @freefirex2 walk through how to use Specula in our latest blog! hubs.la/Q02JfFFN0
Doug Bienstock
@doughsec
May 22, 2024
Great news for DFIR 🕵️ Except! These logs won’t be searchable from the Unified Audit Log for E3 licensees unless you manually toggle auditing for every mailbox in your tenant… 💀🤦🏽‍♂️ @Microsoft365 likes to make things difficult learn.microsoft.com/en-us/purview/… #DFIR
Matt Zorich
@reprise_99
May 21, 2024
For those who were waiting for the additional logging and events to be available in the standard audit logging in Microsoft 365, like MailItemsAccessed, they should be available now in public preview for you - techcommunity.microsoft.com/t5/security-co…
Doug Bienstock
@doughsec
Apr 15, 2024
Anyone have resources or insights into Windows code integrity driver.stl file? I’m trying to parse it… 🕵️ #DFIR #Windows
Doug Bienstock
@doughsec
Apr 8, 2024
Audit log query graph API for @Microsoft365 rolling out in May. Has anyone found the actual documentation for the new API? Asking for a friend 💀#m365 #DFIR
1