DirectoryRanger

This account assembles and disseminates information related to Active Directory and Windows security.

[DirectoryRanger @DirectoryRanger]

24/7 Active Directory Incident Response Contact:
Tel. [phone]
E-mail: [email protected]

[Enno Rey @Enno_Insinuator]

Upcoming Incident Analysis Trainings (Basic & Advanced) by @ERNW_ITSec
https://t.co/wYcpHeP57R

[📔 Michael Grafnetter @MGrafnetter]

@_dirkjan @DirectoryRanger Welcome to the club! I don’t need any AI to achieve the same results, but that’s what VM snapshots are for.

[SpecterOps @SpecterOps]

New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇

https://t.co/jNcQOmH72U

[Peter Gabaldon @PedroGabaldon]

I've just implemented Administrators group's WRITE_DAC permission abuse technique in my custom Windows SAM dumper

https://t.co/8mEMBJejy5

[Dirk-jan @_dirkjan]

Current research status

[🕳 @sekurlsa_pw]

https://t.co/opAhxug996

In GOAD

[Fabian Bader @fabian_bader]

@jonoberheide Why not just use a "virtual" passkey approach where you intercept the Javascript and then use some code to circumvent UV altogether. For Entra ID I build this into https://t.co/LEokd5OSzs

[Enno Rey @Enno_Insinuator]

BSI seziert Windows Hello: Wo Microsofts Anmeldung an Grenzen stößt
https://t.co/HNTDXGjIi0

[DirectoryRanger @DirectoryRanger]

24/7 Active Directory Incident Response Contact:
Tel. [phone]
E-mail: [email protected]

[RedTeam Pentesting @RedTeamPT]

🚨 Rocket Remote Desktop encrypts users' saved credentials with their Windows SIDs. Every user with access to a Windows client on which the client software is installed has access to the database, where these credentials are saved. No fix available yet.

https://t.co/gv18e1dIFv

[DirectoryRanger @DirectoryRanger]

Token Theft in Microsoft Entra ID (Part 3 of 4): Token Protection
https://t.co/RVADmlcm2X

[DirectoryRanger @DirectoryRanger]

Field Notes: Reconstructing an Attacker’s Workflow, by @malmoeb #DFIR
https://t.co/8WgLfxeZRi

[DirectoryRanger @DirectoryRanger]

ripgrep as a lolbin
https://t.co/hI4Y3Tjh8M

[DirectoryRanger @DirectoryRanger]

Hunting the Invisible Trust Boundary: Detecting Third-Party OAuth App Abuse in Microsoft Entra ID
https://t.co/YwUqFN19bp

[DirectoryRanger @DirectoryRanger]

Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In.
https://t.co/SW0WvdGDhy

[DirectoryRanger @DirectoryRanger]

The AD Forest As A Security Boundary And the Impact of Trusts on That Security Boundary – The Revisited Still (In)Secure Sequel, by @JsQForKnowledge
https://t.co/SukgFlsR1C

[DirectoryRanger @DirectoryRanger]

Windows Rootkits and Bootkits Guide, by @artem_i_baranov
https://t.co/8jGCF8r4dt

[DirectoryRanger @DirectoryRanger]

Investigating WMI Permanent Event Subscription Persistence #DFIR
https://t.co/7xRLIKk5gB

[DirectoryRanger @DirectoryRanger]

Token Theft in Microsoft Entra ID, by @insinuator
Part 1: Threat Landscape and Attack Techniques https://t.co/jIgt0hXSJD
Part 2: Continuous Access Evaluation https://t.co/F6SepUh9nL
Part 3: Token Protection https://t.co/RVADmlcm2X

[Florian Hansemann @CyberWarship]

''EDR Evasion: Process Injection Without WriteProcessMemory''

#infosec #pentest #redteam #blueteam
https://t.co/14WJx8l6Wi