<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>Praetorian Prefect &#187; Microsoft</title>
	<atom:link href="http://praetorianprefect.com/archives/tag/microsoft/feed/" rel="self" type="application/rss+xml" />
	<link>http://praetorianprefect.com</link>
	<description>Information security, a little slower...a little deeper</description>
	<lastBuildDate>Thu, 19 Jan 2012 03:59:33 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>May&#8217;s Patch Tuesday</title>
		<link>http://praetorianprefect.com/archives/2010/05/mays-patch-tuesday/</link>
		<comments>http://praetorianprefect.com/archives/2010/05/mays-patch-tuesday/#comments</comments>
		<pubDate>Tue, 11 May 2010 22:46:23 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[patch tuesday]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3915</guid>
		<description><![CDATA[
After a busy April patch month, May&#8217;s patch Tuesday proves to be much quieter with two updates released by Microsoft. Although deemed critical, read the details below to see how your environment may or may not be affected.

Microsoft Updates



ID: MS10-030
Title: Vulnerability in Outlook Express and Windows Mail Could Allow Remote Code Execution 
Microsoft Severity: Critical

Summary: [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/05/mays-patch-tuesday/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>IEPeers &#8211; A New Internet Explorer Zero Day Vulnerability</title>
		<link>http://praetorianprefect.com/archives/2010/03/iepeers-a-new-internet-explorer-zero-day-vulnerability/</link>
		<comments>http://praetorianprefect.com/archives/2010/03/iepeers-a-new-internet-explorer-zero-day-vulnerability/#comments</comments>
		<pubDate>Wed, 10 Mar 2010 23:01:30 +0000</pubDate>
		<dc:creator>Prefect</dc:creator>
				<category><![CDATA[Remote Exploit]]></category>
		<category><![CDATA[aurora]]></category>
		<category><![CDATA[drive by download]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Vulnerability]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3511</guid>
		<description><![CDATA[We posted an aside yesterday referencing <a href="http://blogs.technet.com/msrc/archive/2010/03/09/security-advisory-981374-released.aspx">Microsoft's recent blog post</a> for <a href="http://www.microsoft.com/technet/security/advisory/981374.mspx">new security advisory 981374</a> referencing a new zero day vulnerability in Internet Explorer versions 6 and 7. New details have emerged since, and the exploit has moved from being what was described as part of "limited targeted attacks" to being widely accessible and <a href="http://www.rec-sec.com/exploits/msf/ie_iepeers_pointer.rb">available as a new module for the Metasploit framework</a>.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/03/iepeers-a-new-internet-explorer-zero-day-vulnerability/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>March&#8217;s Patch Tuesday</title>
		<link>http://praetorianprefect.com/archives/2010/03/3473/</link>
		<comments>http://praetorianprefect.com/archives/2010/03/3473/#comments</comments>
		<pubDate>Tue, 09 Mar 2010 20:38:40 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Patch Management]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[excel]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[office]]></category>
		<category><![CDATA[office for mac]]></category>
		<category><![CDATA[patch]]></category>
		<category><![CDATA[patch tuesday]]></category>
		<category><![CDATA[updates]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3473</guid>
		<description><![CDATA[<a href="http://praetorianprefect.com/wp-content/uploads/2010/03/msft_logo.jpg"><img src="http://praetorianprefect.com/wp-content/uploads/2010/03/msft_logo.jpg" alt="msft_logo" title="msft_logo" width="150" height="150" class="alignleft size-full wp-image-3484" /></a>

Today is patch Tuesday for March 2010, and Microsoft has released two security bulletins for this round of updates, neither of which are deemed critical. The second bulletin addresses seven different vulnerabilities across various versions of Microsoft Office Excel.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/03/3473/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Press F1 for Help, pwned.</title>
		<link>http://praetorianprefect.com/archives/2010/03/press-f1-for-help-pwned/</link>
		<comments>http://praetorianprefect.com/archives/2010/03/press-f1-for-help-pwned/#comments</comments>
		<pubDate>Tue, 02 Mar 2010 17:39:54 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Remote Exploit]]></category>
		<category><![CDATA[help system]]></category>
		<category><![CDATA[ie]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[winhlp32]]></category>
		<category><![CDATA[zero-day]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3444</guid>
		<description><![CDATA[

Microsoft published security advisory 981169 yesterday in response to the zero day vulnerability reported a few days prior. The vulnerability is in the help system and can be triggered by luring an Internet Explorer user into pressing the F1 key. Windows 2000, Windows XP SP2 &#38; SP3, and Windows 2003 SP2 with Internet Explorer 7 [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/03/press-f1-for-help-pwned/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>Microsoft&#8217;s Google Attack Patch?</title>
		<link>http://praetorianprefect.com/archives/2010/02/microsofts-google-attack-patch/</link>
		<comments>http://praetorianprefect.com/archives/2010/02/microsofts-google-attack-patch/#comments</comments>
		<pubDate>Fri, 26 Feb 2010 04:18:26 +0000</pubDate>
		<dc:creator>Prefect</dc:creator>
				<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[Funny]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[Patch Management]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3421</guid>
		<description><![CDATA[Noted journalist and friend of the blog <a href="http://twitter.com/georgevhulme">George V. Hulme</a> shared the picture below from CNBC, perhaps the most amusing way seen thus far of describing the patch for the '<a href="http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/">Aurora bug</a>' that famously affected Google late last year.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/02/microsofts-google-attack-patch/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>February&#8217;s Patch Tuesday</title>
		<link>http://praetorianprefect.com/archives/2010/02/februarys-patch-tuesday/</link>
		<comments>http://praetorianprefect.com/archives/2010/02/februarys-patch-tuesday/#comments</comments>
		<pubDate>Tue, 09 Feb 2010 22:56:29 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Patch Management]]></category>
		<category><![CDATA[ActiveX]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[patch tuesday]]></category>
		<category><![CDATA[Remote Exploit]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3305</guid>
		<description><![CDATA[Today is patch Tuesday for February 2010, and it marks a fairly busy patch cycle for Microsoft, who released thirteen updates today. In late January, there was an out-of-band release for two critical patches, in response to the high profile issue around the Internet Explorer Aurora exploit. This makes a total of fifteen total patches between since January's patch Tuesday.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/02/februarys-patch-tuesday/feed/</wfw:commentRss>
		<slash:comments>3</slash:comments>
		</item>
		<item>
		<title>The &#8220;Aurora&#8221; IE Exploit Used Against Google in Action</title>
		<link>http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/</link>
		<comments>http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/#comments</comments>
		<pubDate>Sat, 16 Jan 2010 00:42:41 +0000</pubDate>
		<dc:creator>Prefect</dc:creator>
				<category><![CDATA[Remote Exploit]]></category>
		<category><![CDATA[featured]]></category>
		<category><![CDATA[adobe]]></category>
		<category><![CDATA[google]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[metasploit]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[post-wide]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=3065</guid>
		<description><![CDATA[The <a href="http://www.computerworld.com/s/article/9144844/Hackers_used_IE_zero_day_not_PDF_in_China_Google_attacks?source=toc">big news</a> hit earlier this week, the attack vector that allowed bad actors presumably from China into the networks of Google, Juniper, Adobe, and some 30 other firms was an Internet Explorer zero day, a use after free vulnerability on an invalid pointer reference affecting IE 6, 7, and 8 but only used in IE 6 according to Microsoft.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2010/01/the-aurora-ie-exploit-in-action/feed/</wfw:commentRss>
		<slash:comments>74</slash:comments>
		</item>
		<item>
		<title>Regular or Decaf? Tool launched to combat COFEE</title>
		<link>http://praetorianprefect.com/archives/2009/12/regular-or-decaf-tool-launched-to-combat-cofee/</link>
		<comments>http://praetorianprefect.com/archives/2009/12/regular-or-decaf-tool-launched-to-combat-cofee/#comments</comments>
		<pubDate>Tue, 15 Dec 2009 01:21:34 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[Incident Response]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[anti-forensics]]></category>
		<category><![CDATA[cofee]]></category>
		<category><![CDATA[decaf]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=2250</guid>
		<description><![CDATA[

About a month ago, there was much news about the release of COFEE into the torrent wild. I even gave my two cents about the much hyped forensics toolkit which is provided to law enforcement for the purposes of easily capturing volatile data from personal computers during evidence collection. A tool to counter COFEE, aptly [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/12/regular-or-decaf-tool-launched-to-combat-cofee/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>From Promiscuous to Port Scanning with Powershell</title>
		<link>http://praetorianprefect.com/archives/2009/11/from-promiscuous-to-port-scanning-with-powershell/</link>
		<comments>http://praetorianprefect.com/archives/2009/11/from-promiscuous-to-port-scanning-with-powershell/#comments</comments>
		<pubDate>Mon, 23 Nov 2009 19:04:15 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Security]]></category>
		<category><![CDATA[Administration]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[network]]></category>
		<category><![CDATA[portscan]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[scripting]]></category>
		<category><![CDATA[Windows]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=1924</guid>
		<description><![CDATA[

It&#8217;s been a while since my last post regarding Powershell which showed how to scan hosts for network interfaces in promiscuous mode. This time around, we’ll scan for some well known ports in our Active Directory to see who has a local IIS or SQL Express running on their machine. I know what you’re thinking. [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/11/from-promiscuous-to-port-scanning-with-powershell/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>More COFEE Please, on Second Thought&#8230;</title>
		<link>http://praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/</link>
		<comments>http://praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/#comments</comments>
		<pubDate>Mon, 09 Nov 2009 17:24:49 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Forensics]]></category>
		<category><![CDATA[featured]]></category>
		<category><![CDATA[hype]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/</guid>
		<description><![CDATA[The forensics tool provided to law enforcement officials created by Microsoft called COFEE&#160; (Computer Online Forensic Evidence Extractor) has been leaked on torrents last week, and this has caused quite a bit of excitement.&#160; Let’s see if the big deal is warranted.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/11/more-cofee-please-on-second-thought/feed/</wfw:commentRss>
		<slash:comments>13</slash:comments>
		</item>
		<item>
		<title>Server 2008 R2: Active Directory Functional Levels</title>
		<link>http://praetorianprefect.com/archives/2009/10/server-2008-r2-active-directory-functional-levels/</link>
		<comments>http://praetorianprefect.com/archives/2009/10/server-2008-r2-active-directory-functional-levels/#comments</comments>
		<pubDate>Tue, 06 Oct 2009 09:12:14 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[federation services]]></category>
		<category><![CDATA[kerberos]]></category>
		<category><![CDATA[ldap]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[server]]></category>
		<category><![CDATA[windows 2008]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=758</guid>
		<description><![CDATA[Windows Server 2008 R2 was released in August, and it introduced new functional levels for Active Directory. This article takes a look back at the different functional levels of the past and what is new in the latest release of the server operating system for Active Directory (yes, a recycle bin for AD objects!).

Functional levels [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/10/server-2008-r2-active-directory-functional-levels/feed/</wfw:commentRss>
		<slash:comments>8</slash:comments>
		</item>
		<item>
		<title>2008 Server to the Core</title>
		<link>http://praetorianprefect.com/archives/2009/09/2008-server-to-the-core/</link>
		<comments>http://praetorianprefect.com/archives/2009/09/2008-server-to-the-core/#comments</comments>
		<pubDate>Wed, 23 Sep 2009 21:47:06 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[featured]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[cli]]></category>
		<category><![CDATA[firewall]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[scripting]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[windows 2008]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=398</guid>
		<description><![CDATA[One of my favorite websites in the days of Windows 2000 Server was a project from a group of system managers from the Department of Electrical Engineering at the Swiss Federal Institute of Technology; it was titled “Real Men Don&#8217;t Click”, and it was dedicated to accomplishing tasks solely using the command line interface (CLI). [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/09/2008-server-to-the-core/feed/</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Who’s Being Promiscuous in Your Active Directory?</title>
		<link>http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/</link>
		<comments>http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/#comments</comments>
		<pubDate>Tue, 15 Sep 2009 00:18:50 +0000</pubDate>
		<dc:creator>MJP</dc:creator>
				<category><![CDATA[Administration]]></category>
		<category><![CDATA[Network Security]]></category>
		<category><![CDATA[Security]]></category>
		<category><![CDATA[Tools]]></category>
		<category><![CDATA[active directory]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[powershell]]></category>
		<category><![CDATA[Windows]]></category>
		<category><![CDATA[WMI]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=719</guid>
		<description><![CDATA[I’m always a fan of more queries and peaks at what is going on in my AD domain, especially at what is happening on the workstations. I was working on some WMI queries to get information about network interfaces using the Win32_NetworkAdapterConfiguration class, and thought about promqry.exe. Promqry is a tool provided by Microsoft to [...]]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/09/whos-being-promiscuous-in-your-active-directory/feed/</wfw:commentRss>
		<slash:comments>1</slash:comments>
		</item>
		<item>
		<title>Microsoft Video ActiveX Control Vulnerability</title>
		<link>http://praetorianprefect.com/archives/2009/07/microsoft-video-activex-control-vulnerability/</link>
		<comments>http://praetorianprefect.com/archives/2009/07/microsoft-video-activex-control-vulnerability/#comments</comments>
		<pubDate>Wed, 08 Jul 2009 06:04:23 +0000</pubDate>
		<dc:creator>Prefect</dc:creator>
				<category><![CDATA[Vulnerability]]></category>
		<category><![CDATA[ActiveX]]></category>
		<category><![CDATA[exploit]]></category>
		<category><![CDATA[featured]]></category>
		<category><![CDATA[Internet Explorer]]></category>
		<category><![CDATA[Microsoft]]></category>

		<guid isPermaLink="false">http://praetorianprefect.com/?p=319</guid>
		<description><![CDATA[Microsoft is recommending setting the kill bit for an ActiveX control object, MPEG2TuneRequest, to avoid an in the wild zero day exploit that allows for remote code execution when a web site containing the exploit is browsed by a user with Internet Explorer.]]></description>
		<wfw:commentRss>http://praetorianprefect.com/archives/2009/07/microsoft-video-activex-control-vulnerability/feed/</wfw:commentRss>
		<slash:comments>2</slash:comments>
		</item>
	</channel>
</rss>

