Old domains, especially defunct “secure” file sharing servies, are a risk (and a red team vector)
Posted by jpluimers on 2026/11/06
Interesting opinion to which I agree: [Wayback/Archive] Greg Linares (Laughing Mantis) on Twitter: “@SwiftOnSecurity Legit great tip One of the best vectors for this are old “secure” file sharing services that seem to have disappeared in the last 5 to 10 years which hosted files to be shared from corp to corp. Files are often white listed from these are several services such as EDR & web”
From this Twitter thread:
- [Wayback/Archive] SwiftOnSecurity on Twitter: “Red Team Tip: Target environment likely has tons of ancient Trusted Sites in Group Policy. Some may not be registered anymore. Those sites may have security exceptions and firewall passthroughts, and also bypass the “Office macro block from internet” setting.”
- [Wayback/Archive] SwiftOnSecurity on Twitter: “This is something your company should look at cleaning up. It makes Group Policy run slower too with every extra key. I mean barely but it’s dumb to let stuff sit there.”
- [Wayback/Archive] Greg Linares (Laughing Mantis) on Twitter: “@SwiftOnSecurity Legit great tip One of the best vectors for this are old “secure” file sharing services that seem to have disappeared in the last 5 to 10 years which hosted files to be shared from corp to corp. Files are often white listed from these are several services such as EDR & web”
- [Wayback/Archive] Jeroen Wiert Pluimers @wiert@mastodon.social on Twitter: “@Laughing_Mantis @SwiftOnSecurity Copy dot com and similar come to mind.”
- [Wayback/Archive] Greg Linares (Laughing Mantis) on Twitter: “@jpluimers @SwiftOnSecurity In a previous engagement we compromised a finance employee’s account but needed to target engineering Sent IT a request to allow .com to be allowed so they could accept billing 30 minutes later it was globally whitelisted across the domain”
- [Wayback/Archive] Simon Tunnat 📯 on Twitter: “@Laughing_Mantis @jpluimers @SwiftOnSecurity Our IT-security always has an in depth discussion about every service we need to get whitelisted in some firewall. I really appreciate that! :)”
- [Wayback/Archive] Jeroen Wiert Pluimers @wiert@mastodon.social on Twitter: “@simontunnat @Laughing_Mantis @SwiftOnSecurity Are the Internet Archive and Wayback Machine whitelisted?”
Which means that both red and blue teams should go through both these lists and amend them with other historic file sharing services:
–jeroen
Leave a Comment