posts.specterops[.]ioDomain
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 15 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Microsoft Entra ID OAuth Phishing and Detections“hxxps://posts.specterops[.]io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30”
-
Detect Credential Access with Elastic Security“hxxps://posts.specterops[.]io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107”
Indicators reported together
named in the same reports- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/authorize?state=https://mae.gov.ro/in 1 report
- vscode-redirect.azurewebsites[.]netin 1 report
- insiders.vscode[.]devin 1 report
- process[.]pidin 1 report
- hxxps://login.microsoftonline[.]com/organizations/oauth2/v2.0/tokenin 1 report
- azure.signinlogs[.]propertiesin 1 report
- hxxps://login.microsoftonline[.]com/WebApp/CloudDomainJoin/8in 1 report
- azure.auditlogs[.]propertiesin 1 report
- hxxps://dirkjanm[.]io/abusing-azure-ad-sso-with-the-primary-refresh-token/in 1 report
- dirkjanm[.]ioin 1 report
- hxxps://posts.specterops[.]io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30in 1 report
- 9375cff0413111d3b88a00104b2a6676in 1 report
- hxxps://github[.]com/AlessandroZ/LaZagnein 1 report
- hxxps://github[.]com/GhostPack/Seatbeltin 1 report
- hxxps://posts.specterops[.]io/operational-guidance-for-offensive-user-dpapi-abuse-1fb7fac8b107in 1 report
- hxxps://github[.]com/gtworek/PSBits/tree/master/LSASecretDumperin 1 report
- hxxps://github[.]com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Windows%20-%20Mimikatz.mdin 1 report
Copy these 17 indicators · defanged
Thanks — we review every report.