secarclabs

Jun 30 2024

DFIR Series: Windows Defender Tamper Protection

https://blog.secarclabs.com/post/dfir-series-windows-defender-tamper-protection Windows Defender Tamper Protection is a security feature to enhance the protection provided by Windows Defender Antivirus. Tamper Protection is designed to prevent malicious actors or unauthorized programs from modifying or disabling key security settings in Windows Defender. When Tamper Protection is enabled, it helps safeguard critical Windows Defender features, including real-time protection, cloud-based […]

DFIR Series: Windows Defender Tamper Protection Read More »

Jan 19 2024

Winternals Series – Virtual Memory

Winternals / By architect

Overview Memory in modern operating systems is not mapped directly to physical memory (i.e the RAM). Instead, virtual memory addresses are used by processes that are mapped to physical memory addresses. There are several reasons for this but ultimately the goal is to save as much physical memory as possible. Virtual memory may be mapped

Winternals Series – Virtual Memory Read More »

Jun 29 2023

OffSec Series – AS-REP Roasting

Active Directory, Kerberos, OffSec / By architect

https://blog.secarclabs.com/post/offsec-series-as-rep-roasting Overview Technique that is used to target weak user account settings in Active Directory, particularly those with the “Do not require Kerberos preauthentication” setting enabled to abuse the lack of Kerberos pre-authentication to retrieve password hashes. This setting allows a user account to request and obtain a service ticket without providing initial authentication, essentially

OffSec Series – AS-REP Roasting Read More »