Raph

[Alex Neff @al3x_n3ff]

SPN-less RBCD with NetExec🔥

While classic RBCD requires a computer account, you can use U2U authentication to perform RBCD with a normal user account, if a computer account is not available.

Thanks to @azoxlpf, you can now perform this attack with NetExec as well🚀

[Swissky @pentest_swissky]

Analysis of Python's .pth files as a persistence mechanism - @malmoeb
https://t.co/IIfZ0rMoic

[r0BIT @0xr0BIT]

shipping: WinSSHound

maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft.

https://t.co/ONXuguz7r3

[Adam Chester 🏴‍☠️ @_xpn_]

If you came to SOCON, you may have seen the fireside chat on Ouroboros (if you weren't too busy counting my "urm"s 😝). The blog post is now live, detailing how we can use Dev-Tunnels for lateral movement, and allow pivoting from GitHub/Entra ID access. https://t.co/yb1jl1xkgV

[Mr.Z @zux0x3a]

https://t.co/YIMoWcThtL
A credential extraction BOF for Veeam Backup and Replication and Veeam One by Stephen Munro and Logan Kroeger from @MWRCyberSec

[Fabian Bader @fabian_bader]

Now I see you @_dirkjan 😁

Blog post including ROADrecon detection based on AADGraphActivityLogs is coming very soon(tm)

[incendiumrocks @incendiumrockz]

It's been a while since I wrote a blog post. My new post writes about some cool updates to the MS-RPC-Fuzzer for recursively fuzzing complex structures, logging using ETW, and we found a way to escalate to nt\authority system!

https://t.co/Guxzx0gu2J

[Mr.Z @zux0x3a]

https://t.co/NxpKMPge66
Reflective PE loader written in Zig. Loads and executes native and .NET PE files directly from memory.
by @Thoxy67

[SEKTOR7 Institute @SEKTOR7net]

Remote EDR Discovery.

Methods for detecting remote EDR deployments without local agent presence, a post by Jonathan Johnson (@JonnyJohnson_ )

Source: https://t.co/7X3qwmrsEo

#redteam #blueteam #maldev #malwaredevelopment

[InfoGuard Labs @InfoGuard_Labs]

New Advisory from our Pentest Team:
We've identified a Local Privilege Escalation vulnerability in the remote management software pcvisit (CVE-2026-0539). Insecure file permissions allow low-privileged users to gain SYSTEM access. Details: https://t.co/Gd16A9KbDZ

[dylan davis @lildylannn]

I just dropped some research: DSCourier and would love for your opinion and to check it out!!

It’s a novel post-exploitation technique abusing WinGet’s COM API to execute code through Microsoft-signed binaries.

GitHub: https://t.co/pgIhifT5cT
Blog: https://t.co/kgeBvZw06N

[Pavel Yosifovich @zodiacon]

ETW from C++: session setup, EnableTraceEx2, OpenTrace, ProcessTrace, and a real-time event callback. The full pipeline, including the parts the docs don't make obvious.

https://t.co/pe9wyAG3WE

[Raph @_Raeph]

@n00py1 @cyb3rops I think you underestimate your blog. It’s Great!

[Panos Gkatziroulis 🦄 @ipurple]

KslDump - Extraction of credentials from PPL-protected LSASS using only Microsoft-signed components https://t.co/pDHUeRw33I

[S3cur3Th1sSh1t @ShitSecure]

WSUS fake updates for LPE or RCE when HTTP is being used? This one took many days and troubleshooting with claude but now we have a C2-Capable tool for the full stack including poisoning plus fake update delivery - the only thing we need is a low privileged C2 session! 🔥

[Co11ateral @co11ateral]

An interesting piece of research on stopping arbitrary ETW traces using an undocumented “Stop Trace” flag

https://t.co/FeYhG8SLjw

#ThreatHunting #blueteam #redteam #pentesting

[drm @lowercase_drm]

I was bored to type the same commands each time I started a new internal pentest. So here comes KingCastle. This script does not perform any attacks, consider it as a cheat sheet, to quickly see low hanging fruits.

https://t.co/tFUZkzYdXC

[SpecterOps @SpecterOps]

Backup Operators don’t get enough attention.

@JimSycurity will be at #WWHF demonstrating how Titanis can be used to abuse Backup Operator privileges over SMB and bypass NTFS security descriptors.

👉 https://t.co/YtQNAtldWr

[SpecterOps @SpecterOps]

SCCM admins: review your roles.
MSSQL admins: review ALTER ANY LOGIN exposure.

@_Mayyhem details CVE-2025-47179 & CVE-2025-49758 and how these escalations can be identified through graph analysis.

Check out his blog post for more! https://t.co/M2q6TeMGh1

[Alexandre Borges @ale_sp_brazil]

My colleague Fabian Bader (@fabian_bader) wrote a PowerShell script a few months ago to list Windows patches and updates for the current month or any specific month, and the script is really useful:

https://t.co/OqzcmKWUi7

#microsoft #windows #patches #powershell