Zero Labs

Zero Networks Research team, specializing in open source security tools for defenders.
Join our slack at

[Zero Labs @ZeroNLabs]

#NauthNRPC is a tool that can help you enumerate computer / user accounts anonymously in #ActiveDirectory via DsrGetDcNameEx2 RPC calls.

This is not often in most environments, so used could be blocked via #RPCFirewall.

Nice job by @haider_kabibo 🏆🏆

https://t.co/Jf0Ep0AGb2

[Sagie Dulce @SagieDulce]

My thoughts about CVE-2025-33073, and on how to prevent #NTLM / #Kerberos relay attacks in general using #RPCFirewall & #LDAPFirewall

https://t.co/oV47fgPedH

[Zero Labs @ZeroNLabs]

Learn about how to find hidden resources in #Azure using our new #opensource tool #MapAz

[Sagie Dulce @SagieDulce]

Are you sure you can enumerate all of your #Azure resources? You may be missing some out.

#MapAz is a new #PowerShell Module that (among other things) can help you enumerate hidden resources.

Read more in my latest post:
https://t.co/J9DjcaYvIQ

[Zero Labs @ZeroNLabs]

Excellent writeup by @cybergentix on #WMI #LateralMovement

Didn't mention mitigation via #RPCFirewall, which could be achieved by blocking remote #DCOM operations

https://t.co/BCbhHmFUwE

[Florian Roth ⚡️ @cyb3rops]

ADCS … often exploited, rarely mentioned

[Zero Labs @ZeroNLabs]

Read @dekel_paz excellent writeup on #badsuccessor #LDAP vulnerability, and how to mitigate with the #LDAPFirwall

[Dekel Paz @dekel_paz]

BadSuccessor is a slick AD privilege escalation that uses LDAP to take over user accounts
…and the LDAP Firewall can already block it — no updates needed.

How the attack works + how to block it:
👉 https://t.co/CEzSYW5xL0

[Zero Labs @ZeroNLabs]

Yes, LDAP enumeration is still a thing in 2025.
https://t.co/Mcrp7cWPJJ

[Zero Labs @ZeroNLabs]

@FlorianHeigl1 @DirectoryRanger @_kripteria Works in theory :)

[Zero Labs @ZeroNLabs]

A new open source tool to visualize #LDAP data ovre #Neo4j graph database: #Neo4LDAP by @_kripteria !

And, you can inject data directly from #BloodHound 🐕

Check it out here:

https://t.co/qvsafVNdfU

[Zero Labs @ZeroNLabs]

CVE-2025-29969 is an RPC #RemoteCodeExecution vulnerability, base score 7.5.

Exploits a time-of-check time-of-use & affects Windows vers 2025, 2022, 2019, 2016, 2012 R2, 2012, 2008 R2 SP1, 2008 SP2; Win 11 22H2/23H2/24H2, Win 10 1607/1809/21H2/22H2.
https://t.co/jrd1brZLjs

[Tal Be'ery @TalBeerySec]

Shields up! time to limit access to Telnet (TCP port 23) on internal network.
CC: @ZeroNetworks

[Zero Labs @ZeroNLabs]

A handy list of LDAP search filters used by common enumeration tools, compiled by @Unit42_Intel (@PaloAltoNtwks).
The best part? You can block all of them with our open-source #LDAPFW! 📷
Full article: https://t.co/m2oZaIRKLN
Get started: https://t.co/z6EDf8vFAF

[Zero Labs @ZeroNLabs]

Did you know that you can block DCOM via the #RPCFirewall?

Make sure you're protected against #RemoteMonologue #NTLM #Coersion !

https://t.co/WGjbhkAM7J

[Andrew Oliveau @AndrewOliveau]

RemoteMonologue - A Windows credential harvesting attack that leverages the Interactive User RunAs key and coerces NTLM authentications via DCOM. Remotely compromise users without moving laterally or touching LSASS.

Hope you enjoy the blog & tool drop 🤟

https://t.co/ch9WuSP6bm

[Zero Labs @ZeroNLabs]

This one checks a lot of #LateralMovement TTPs. Could have been nicely blocked by #LDAPFirewall & #RPCFirewall + some #NetworkSegmentation

How #blackSuit #ransomware spread from first fake #zoom installer -> d3f@ckloader #IDAT #SectopRAT

https://t.co/nuYNOBicMp

[The DFIR Report @TheDFIRReport]

🌟New report out today!🌟

Fake Zoom Ends in BlackSuit Ransomware

Analysis and reporting completed by @pigerlin, UC1 and @Miixxedup

Audio: Available on Spotify, Apple, YouTube and more!

https://t.co/r9hQxzPTL0

[Sagie Dulce @SagieDulce]

Nice work by @YaronZi & @CrowdStrike promoting LDAP Security to detect suspicious LDAP activities.

https://t.co/aedfdIG8dh

Maybe someone wants to slap an AI agent on their #LDAPFirewall for similar results? :)

https://t.co/G766b53uj7

[Zero Labs @ZeroNLabs]

How to stop #LDAPNightmare / #LDAPBleed
CVE-2024-49112 & CVE-2024-49113
https://t.co/Y5lQwW3Upa

[Zero Labs @ZeroNLabs]

When we first published "What the Filter" we never thought we would have more than a 100 downloads, let alone a thousand.
We're happy to see the community getting value with the latest version bypassing the 1000 mark ! 🏆
https://t.co/NV1OEViwCW

[Zero Networks @ZeroNetworks]

🎉2024 brought remarkable growth, new faces to #ZeroNation, and plenty of fun moments together 💪🏼🚀.

To our customers, partners, investors, and team—thank you for an incredible year; here’s to a successful and inspiring 2025! 🥂

#ZeroNetworks #NewYear2025 #Cybersecurity #Gratitude

[Zero Labs @ZeroNLabs]

Hi all!
We released a native version for WTF-WFP, supporting a limited number of operations. Especially good for those instances when you can't use #PowerShell module #NtObjectManager.

/bypass command will skip the entire layer of filters

https://t.co/pVsPDmGyut

[Zero Labs @ZeroNLabs]

@egosumdns @TalBeerySec @gentilkiwi @harmj0y @_wald0 We're not sure ChatGPT is best for finding bugs, but you're welcome to raise issues @egosumdns.

Even if #LDAPFirewall fails (running now in several production envs with 0 crashes), it will be in the same 𝗰𝗿𝗼𝘄𝗱 with Billion dollar companies who can't say the same
#YOLO