Blog

Findings, advisories and field notes from Threatbear engagements.

26 September 2023 · 1 MIN READ

Backing up Proxmox VMs to Backblaze B2

There are many ways to backup VMs on a Proxmox hypervisor : Use their “Proxmox Backup Server” — this is a great option because it offers incremental backups & deduplication. Use a ZFS volume to store your VMs and use zfs send to backup the snapshots to a remote system Copy the backup files to S3 compatible storage such as Backblaze B2 or Amazon S3. We will be doing the latter due to the fact that is it simple and cost effective.

6 July 2023 · 1 MIN READ

Microsoft Edge popping shells on macOS

Microsoft Edge popping shells on macOS If you’re wondering why Microsoft Edge on Mac spawns a bash shell on Mac you might have the same reaction and thought process as me. I don’t want my browser to be able to spawn a shell (or possibly any program that isn’t shipped with the browser) Is there a better way to do this? probably! Can we turn this off!? Why? Let us look at the last question — why? If we inspect the process.args we can derive an indication of what Microsoft are getting at :

17 October 2022 · 1 MIN READ

Properly renaming Proxmox nodes

In the event you need to rename a Proxmox PVE node you will probably stumble upon this article : https://pve.proxmox.com/wiki/Renaming_a_PVE_node I followed most of these instructions, but missed a crucial bit : This must be done on a empty node. Yeah…whoops! After rebooting you might find that your VMs are not running! Thankfully it is a simple-ish fix: Backup your /etc/pve directory Move the files from the /etc/pve/nodes/oldnodename/qemu-server to their respective new directory, for example to /etc/pve/nodes/newnodename/qemu-server

7 October 2022 · 1 MIN READ

Zeek without rc.local

Zeek without rc.local In order for Zeek to properly capture packets you need to disable some network card features, such as tcp offloading and the like. Security Onion has a handy article at https://blog.securityonion.net/2011/10/when-is-full-packet-capture-not-full.html While you can just run this manually : for i in rx tx sg tso ufo gso gro lro; do ethtool -K enp2s0 $i off; done You don’t really want to be doing this every time the system restarts. Before systemd you might have just put the above command in /etc/rc.local but nowadays systems are not guaranteed to have this legacy feature.

20 April 2022 · 1 MIN READ

Using Osquery to check if you’ve patched CVE-2022-26809

Using Osquery to check if you’ve patched CVE-2022–26809 Update: this won’t work as monthly rollups supersede discreet KB patches. See https://claroty.com/2022/05/04/blog-research-from-kbs-to-cves-understanding-the-relationships-between-windows-security-updates-and-vulnerabilities/ Here is a quick search you can run across any vulnerable Windows version to see if you have installed the patch for CVE-2022–26809 select * from patches where hotfix_id in ('KB5012596', 'KB5012599', 'KB5012599', 'KB5012604', 'KB5012596', 'KB5012670' ,'KB5012639' ,'KB5012650' ,'KB5012666' ,'KB5012658', 'KB5012632', 'KB5012670', 'KB5012626' ,'KB5012649', 'KB5012592' ,'KB5012653', 'KB5012599', 'KB5012599', 'KB5012591', 'KB5012647');

19 April 2022 · 1 MIN READ

Using Google Chat for Elastic Security Alerts

If you’re a fan of Google’s new spaces feature and want to have one less app to check you may be considering replacing Slack with Google Chat or Spaces. Here is how to configure an Elastic connector so that you can get alerts and notifications in Google Spaces : Add an incoming web-hook in the space that you want to receive notifications in. I recommend a dedicated space per environment so you can mute and better manage notifications

18 April 2022 · 2 MIN READ

Getting Dockerd to behave with Snap

When you install docker using snap on Ubuntu you can’t configure it using the default config files dues to the isolated nature of snapd. Here is how you can configure dockerd to listen on a network socket when using snap on Ubuntu First, edit /var/snap/docker/current/config/daemon.json and add a hosts line like so: { "log-level": "error", "storage-driver": "overlay2", "hosts": ["tcp://1.2.3.4:2376"] } Then run : snap restart docker You can now connect to Dockerd over the network (remember to set the TLS cert and secure the service appropriately) by specifying the socket

27 March 2022 · 2 MIN READ

Increasing signal to noise ratio for Mitel systems

If you’re responsible for defending Mitel systems, specifically the Mitel MiCollab suite running on Mitel’s “Mitel Standard Linux” you have probably noticed by now that the systems are very noisy from defenders point of view, for example: Yes this is actually a legitimate process tree on a Mitel Micollab system — I was investigating an alert that detects suspicious child processes spawned by Java and this is what I found. With process parent-sibling relationships as long as these being the normal (the full tree is about 20 processes long) it is hard to detect or alert on actual malicious activity.

23 November 2021 · 1 MIN READ

Detecting CVE-2021–41379 using EQL

Microsoft’s patch for https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379 was apparently done on a bumpy taxi ride and we now have an exploit that can do local privilege escalation with very few mitigations. If you use Elastic Agents on your fleet you can detect exploitation of this using the following EQL query. Please note that this is a work-in-progress (although due to the severity of this bug a noisy detection might be better than getting owned) :

28 October 2021 · 2 MIN READ

Deploy Elastic Agent with Microsoft Intune

In my previous story I shared how any organisation can go from having zero security visibility to having a wealth of contextual information in less than a day. In this article I’m going to share a small Powershell script that can be used with any management tool to deploy Elastic Agent to a whole fleet of Windows systems. Using this tool an administrator can easily deploy Elastic Agent to 10 or 1000 systems without breaking a sweat!