Hello Reader,
Tonight Evan and I tried to fix the workflow and fix some bugs in our CloudTrail log explorer. We had some successes and some failures and ended with the idea that we need a better set of prompts to redefine the problem. We rolled back some changes but made some progress in the end.
Hello Reader,
Tonight on the 'vibe stream' Evan and I added AWS SSO credential support to our AWS CloudTrail explorer script. It lead us into some interesting rabbit holes and ended with us realizing we should get Github commits ready before trying to tweak our workflow.
You can watch it here:
Hello Reader,
One of the trends I've been noticing when a threat actor first gets into Azure or Microsoft 365 accounts is they will immediately look to see how many other third party services they can access from that account. This allows them to expand their reach into additional services, clouds and systems without needing any additional credentials. Within Azure this is called 'My Apps' and you can reach it by click on your user profile picture in the upper right hand corner and then clicking on My Apps on the bottom left as shown below.
To see this in the logs go to Entra ID and then Signin Logs and you can see the user accesses to My Apps as shown below.
So the next time you are working an Azure incident, make sure to keep an eye out for My Apps access and then you can begin the long process of determining how many apps you are going to have to review to determine total impact.
Tonight Evan and I were 'vibe debugging', trying to get the models to fix their own code. We were successfully able to get it to fix issues with the storage of the configuration file, but we left the stream being unable to start a memory capture process. Tune in tomorrow for more!
Hello Reader,
Just an announcement that I'll be moderating a panel on legal cybersecurity issues on March 26, 2025. I'll be joined by my colleague Jonathan Rajewski and a host of inside and outside counsels as well as the Honorable Ada Brown. If you are interested or just want to learn more please click this link to read about it and register.
Hello Reader,
It's Sunday! This week's challenge is vibing. If you haven't heard about 'vibe coding' it's what Evan and I have been doing in our streams, letting the AI do all the coding and just 'vibing' along. This week I want to see you resurrect old unmaintained tools and see what you can do with them!
Pick an unsupported DFIR project of your choice and bring it back to life! Add new features and make it work on modern systems. While you are not required to 'vibe code' (AI coding) in this instance it's fully encouraged! Send me links to writeups or github repo's when your done!
Hello Reader,
This week Phill Moore has brought us the winning answer but as his conversation on X showed it was an answer that could have had additional findings if all of the new logging sources were turned on. Let's celebrate Phill's win and know that blogs will be coming to explore his results and what log sources can be turned on to give even more information.
Hello Reader,
Tonight Evan and I took an express train to the coast and brought a Jimmy Buffet inspired web interface to Margarita shotgun with one prompt and two fixes. Here is the prompt:
"create a web interface as you proposed earlier to allow the user to be able to configure, run, manage and monitor the tool. This should not require nodejs or react, things like flask and bootstrap or htmx would be better. I want the server and front end to be self contained within the script and while it can add additional libraries it should not require additional programs/servers/framework or systems to be installed outside of just python modules. The interface should be modern, resiazble, sortable on any fields displayed and have an overall theme of Jimmy Buffetts classic tale of wasting away again in margartivalle. Thematic elements of shotguns, limes, margatitas, salt shakers and phrases like its five oclock somewherfe are encouraged. If you cannot generate the art images ascii art is acceptable. Quotes from Jimmy Buffet are desriable and welcome in the interface. The http server and web mode should start if someone runs the script without options, it should then return a text string telling them the localhost url to visit to view the page. "
and with that the Claude 3.7 model in Cursor actually did generate a full Margaritaville themed web dashboard for a tool that never had one! Next week we will actually test the tool to see if works! Tomorrow though stay tuned to see who won this week's Sunday Funday Challenge!
