Image Physical Security December 01, 2021 Protect your real-world assets and prevent targeted attacks against executives with Optiv's Physical Security services. See Details Download
Image Penetration Testing Services Our pen testing services help you predict, preempt and respond to attacks before the hackers get out of bed. See Details
Image Microsoft 365 OAuth Device Code Flow and Phishing August 17, 2021 We leveraged Microsoft’s OAuth authorization flow for a phishing attack. Here’s step-by-step guidance on how to conduct it for security assessment. See Details Blog
Image PetitPotam & Active Directory Certificate Services August 10, 2021 Multiple CVEs involving Active Directory Certificate Services and a new NTLM relay attack can be chained to compromise an Active Directory domain. See Details Blog
Image Kubernetes Attack Surface June 17, 2021 Optiv highlights the attack strategy of using forged Kerberos tickets to compromise a domain, and provides ways to defend against it. See Details Blog
Image Kerberos - A Domains Achille's Heel June 02, 2021 Optiv highlights the attack strategy of using forged Kerberos tickets to compromise a domain, and provides ways to defend against it. See Details Blog
Image Breaking the (WDAPT) Rules with COM May 12, 2021 This article explores gaps that allow for the undetected execution of code on systems protected by Microsoft Defender Advanced Threat Protection. See Details Blog
Image Threat Management: Application Security April 09, 2021 Optiv AppSec services reduce security risks by helping organizations design and build mature application security programs. See Details Download
Image Firefox Addons For Application Security Testing March 24, 2021 Firefox’s appsec add-ons make it a useful tool for new pen testers who can’t afford professional tools. See Details Blog
Image BadOutlook for C2 March 18, 2021 Given Office product functionality, it’s possible for adversaries to leverage Outlook's COM interface in attacks for extended persistence. See Details Blog
Image Automating Captcha Attacks February 17, 2021 Captcha images don’t provide robust protection as a primary security control. This analysis explores how to prevent automated (bot) attacks. See Details Blog
Image EDR and Blending In: How Attackers Avoid Getting Caught February 03, 2021 Even when the hooks are removed, defenders can still leverage other EDR functions, such as host isolation for incident triage or remote. See Details Blog