C:\hristoph Weste

husband, dad, unified communications guy, automation lover, powershell addict, security hobbyist @[email protected]

[Dr. Nestori Syynimaa @DrAzureAD]

Slide deck of my @WEareTROOPERS talk "Dumping NTHashes from Azure AD" available at https://t.co/J9iCAkwrP4

TL;DR:
🔹Deploying Azure AD Domain Services (AADDS) makes Azure AD connect to sync legacy credentials (NTHashes) to Azure AD
🔹Credentials are stored in Azure AD in hidden user object attributes only accessible by "Azure AD Domain Services Sync" application
🔹Credentials are encrypted/decrypted using certificates stored in AADDS DC:s certificate store
🔹Dumping NTHashes requires compromising AADDS DC

[Vadims Podāns 🇱🇻 @Crypt32]

PowerShell PKI module v4.0 is out with lots of bug fixes and breaking changes: https://t.co/ssP1RATOyz #PowerShell #PKI #PSPKI

[Andy Robbins @_wald0]

My latest blog post: how to turn Domain Admin in a child domain into Enterprise Admin with ADCS ESC5: https://t.co/If8Ek3bRkZ

[Vadims Podāns 🇱🇻 @Crypt32]

Here is my follow up on the escalation from DA to EA with the demo on how to install Enterprise CA without Enterprise Admins and get to EA: https://t.co/RdhdqKsX2W #PKI #adcs #specterops

[Helge Klein @HelgeKlein]

The Name Resolution Policy Table (NRPT) is a very effective way to specify DNS servers per domain/TLD - on the DNS client!
Blocking TLDs like .zip is just one use case.

[Black Hole @konstructivizm]

Dimensions of how big our planetary system and universe is! Truly mind blowing!
Source: https://t.co/KMJgreDmgg

[Vadims Podāns 🇱🇻 @Crypt32]

I'm glad to announce a new version of AD CS "SID Policy Module" that addresses limitations in KB5014754. New version includes support of SAN URI strong mapping enforcement policy and other improvements: https://t.co/777M0r7CMj #pki #ADCS #CryptoAPI

[Richard Hicks @richardhicks]

#Microsoft introduces preview of new SAN URI for strong certificate mapping with offline templates. Would love to get your thoughts on this @Crypt32. :) https://t.co/fbR7nSVmlo

[Dirk-jan @_dirkjan]

📢 The first public edition of my "Offensive Azure AD and Hybrid AD" training is now scheduled and available for booking. June 5th to 7th in The Hague, The Netherlands. Tickets and more information at https://t.co/9vDTucJo4X.

[Andreas Stenhall @AndreasStenhall]

With more than two months to go of 2022 I can say with certainty that this is THE tip of the year: Shortcuts to Microsoft admin and user portals + deep shortcuts to Azure AD sections. https://t.co/h5b77hxzph

[MSXFAQ (Frank Carius) @msxfaq]

#MSXFAQ Free/Busy mit OAUTH https://t.co/n21IUqlvkL - Troubleshooting von Free/Busy-Fehlern zwischen #Outlook, #ExchangeOnline und #Exchange OnPremises mit #Fidder, IIS Request Tracing u.a. Ist das noch Level 400? Hilft aber beim Verstehen der Zusammenhänge.

[Mikhail @n176053]

The workaround with StrongCertificateBindingEnforcement=0 and CertificateMappingMethods=1f from KB5014754 helped this time: https://t.co/LucmigaM2x

[Greg Taylor @gregtaylor_msft]

Check out this post on the Microsoft Tech Community : Basic Authentication Deprecation in Exchange Online – May 2022 Update - Microsoft Tech Community https://t.co/RkEEXSRz1H #MSExchange #MSFTExchange #security

[David Segura | MVP | Recast Software @SeguraOSD]

Yes, it seems you can connect to #Azure in #WinPE using Device Code Flow (User Auth), grab your Tokens and Headers, and get to custom Windows Images on #Azure Storage

#OSDCloud will support imaging from #Azure soon, very soon @mike_marable @gwblok #MMSMOA #OSD

[Matt Ellis @MattEllisUC]

Latest update (May 4, 2022 6:52 PM) for MO372219. #MicrosoftTeams

[C:\hristoph Weste @_cweste]

@DB_Bahn Ahh, gefunden Danke

[C:\hristoph Weste @_cweste]

@DB_Bahn könnt ihr mir sagen wie ich in der IOS App ein Fahrrad Ticket kaufen kann? Besten Dank

[C:\hristoph Weste @_cweste]

@DB_Bahn Hmm okay danke für die Info , habt ihr mal einen Screenshot? Ich finde es nicht…

[Tony Redmond @12Knocksinna]

.@Office365 Sensitivity labels (or is that Microsoft Purview labels?) have a new advanced setting (in preview) to control #SharePoint site sharing permissions. Another example of why container management via labels is goodness.
https://t.co/QqEMf9XZWD
#Microsoft365 #Office365

[Dr. Nestori Syynimaa @DrAzureAD]

🚨 Do NOT blindly copy-paste KQL from the internet: Malicious Kusto query allows attacker to collect access tokens and use them to query information as victims..

And yes, this is by-design 🤦‍♂️