Marat Nigmatullin

Hacking & Researching @falconforceteam | Ex-Unit 42

[Olaf Hartong @olafhartong]

Next august, we'll host our newly designed advanced defensive engineering training at @BlackHatEvents in Las Vegas. Next to detection engineering we'll also cover topics like enrichment, lifecycle management and AI. There are still some spot left!

https://t.co/2mD07Fu3HM

[FalconForce Official @falconforceteam]

Last week, we joined @SpecterOps' SO-CON conference in Arlington, US. It has been an exciting week, with two FalconForce presentations on stage from @_mnigma_ and @olafhartong .
We look back at a great time at SO-CON!

[SpecterOps @SpecterOps]

CyberArk is built to protect your crown jewels, but what if it becomes the attack path?

@_mnigma_ shows how misconfigurations in PVWA & CCP can be abused to extract credentials and escalate privileges in just a few steps. #SOCON2026

[Marat Nigmatullin @_mnigma_]

In one week I will be presenting at @SpecterOps SO-CON 2026 about CyberArk PAM. I will share our practical experience and insights on PVWA edge cases and CCP API misconfigurations. #SOCON2026

More information and registration: https://t.co/dHORi2Jooo

[FalconForce Official @falconforceteam]

FalconForce is proud to be part of @SpecterOps' SO-CON conference in April.

And this year, there’s not one but two FalconForce talks at #SOCON!

More information and registration: https://t.co/lDO1QFpNux

[FalconForce Official @falconforceteam]

At FalconForce, we are always looking to enhance our detection engineering practices. In our latest #FalconFriday blog, we present the applied research that was done and our observations on near-real-time (NRT) analytic rules in practice: https://t.co/vDjMWhS3KZ

[Dirk-jan @_dirkjan]

New year, new training dates! First stop of the year will be at @1ns0mn1h4ck, March 16-18 in Lausanne, Switzerland. Tickets for my Entra ID class are now on sale. More info and registration: https://t.co/DmFc24HKwW

[FalconForce Official @falconforceteam]

Happy New Year! 2026 has started and we are eager to share with you our ambitions for this brand-new year.

Read the full post: https://t.co/ID7u2L64Wt

[Marat Nigmatullin @_mnigma_]

Thrilled to speak at @SpecterOps SO-CON 2026! 🔥 Expect to learn about CyberArk PVWA edge cases & common CCP API misconfigurations to access "hidden" secrets: "4 GET requests = 3 Domain Admins – CyberArk magic you didn't know." #SOCON2026

[FalconForce Official @falconforceteam]

FalconForce is proud to be part of @SpecterOps' SO-CON conference in April 2026. @_mnigma_ will present a talk on abusing misconfigurations in #CyberArk to get high privileges: “4 Get requests = 3 Domain admins: CyberArk magic you didn’t know about”.

https://t.co/lDO1QFpNux

[Olaf Hartong @olafhartong]

#MDE custom collection is finally in public preview! It's a centrally managed solution to improve visibility and detection opportunities.

We're releasing a management tool and rule repository in YAML format to share new rules with the community.

https://t.co/kxit8fFjhU

[SpecterOps @SpecterOps]

Back in July, Neeraj Gupta introduced DeepPass2, a smarter secret scanner that finds both API keys/tokens & contextual passwords using BERT + LLM validation.

The model & tool code are now live!

Model ➡️ https://t.co/dzFnhyHW6J
Code ➡️ https://t.co/N2aShS3xYg

🧵: 1/2

[SpecterOps @SpecterOps]

What happens when the User-Account-Restrictions property gets misconfigured?

Spoiler: It's not good. From account compromise to full domain takeover, @unsigned_sh0rt breaks down why this permission set is more dangerous than most realize. https://t.co/czepcA58Qu

[Marat Nigmatullin @_mnigma_]

Big thanks to @MDSecLabs & @OutflankNL for organizing #RedTreat 🙌 Great content, awesome panel discussions, and amazing people. Thanks to all the presenters and to the new people I had the chance to meet🫶

[Dominic Chell 👻 @domchell]

#RedTreat2025 is a wrap @StanHacked @MarcOverIP - thanks to all the speakers and the panel team for an extra awesome con this year 🫶

[Andy Gill @ZephrFish]

Made a thing, mucking about with python and a LDAP browser concept to ingest straight into BloodHound, simple LDAP browser using PyQt as a GUI and neo4j-driver to ingest into BH. Coming Soon #itstimetobrowse

[Olaf Hartong @olafhartong]

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs.

https://t.co/Gnz0ssUXYN

Slides available here:
https://t.co/2zhhBe83Df

[Olaf Hartong @olafhartong]

In about an hour I’ll present my talk I’m in your logs now, deceiving your analysts and blinding your EDR at #BHUSA25 @BlackHatEvents in Islander E/I. Come and hang out!

[Olaf Hartong @olafhartong]

Wow, very excited to delivery my first offensive talk at #BHUSA this summer

[FalconForce Official @falconforceteam]

One of the least discussed topics in detection engineering is maintenance. But why is no one talking about this? In this first blog we explore its relevance to #detectionengineering and the paradox that keeps us awake at night. Enjoy!

https://t.co/18u2SD6EFG

[sapir federovsky @sapirxfed]

Just me exploring new undocumented Entra APIs and doing some TTD to make Device Registration Service to change some Device attributes🙂
https://t.co/XTZM2GDowL

[William Knowles @william_knows]

.NET GAC and NIC hijacking for lateral movement: https://t.co/1AIxHyrnVn