CeB23

Hunter - Opinions and private research are my own

[spencer @techspence]

Microsoft Defender for Endpoint Plan 2 is honestly a beast. Automatic attack disruption booted me several times where other top tier products didn’t give a hoot.

I came up against this during a recent internal and it totally kicked my butt.

[jewbuzz @jewbuzz]

🎙️ « J’AI ÉTÉ OTAGE À GAZA APRÈS LE 7 OCTOBRE », par Rom Braslavski.

Le 7 octobre 2023, Rom Braslavski travaillait comme agent de sécurité au festival Nova lorsqu’il est capturé et détenu à Gaza.

Il y restera 738 jours.

738 jours de captivité, de privations, de violences et d’incertitude, avant de retrouver enfin sa famille et sa liberté.

Depuis son retour, Rom a choisi de témoigner et de faire entendre sa voix. Il est également devenu une figure engagée de la hasbara israélienne, utilisant son histoire pour raconter ce qu’il a vécu et défendre Israël à travers ses prises de parole.

❓ Que s’est-il réellement passé pour lui le 7 octobre au festival Nova ?
❓ À quoi ressemblait son quotidien pendant 738 jours de captivité ?
❓ Avait-il accès à des nouvelles du monde extérieur ?
❓ Comment a-t-il trouvé la force de tenir mentalement malgré ce qu’il subissait ?
❓ Savait-il lorsque Kippour, Pessa’h ou Hanouka avaient lieu, et comment vivait-il ces journées en captivité ?
❓ Que ressent-on lorsque, après 738 jours, on retrouve enfin sa famille et sa liberté ?
❓ Que lui a fait ressentir la nouvelle de l’élimination de son principal bourreau par Tsahal ?
❓ Et quel message souhaite-t-il adresser aujourd’hui aux Juifs qui, face à l’antisémitisme, ont parfois peur d’affirmer leur judaïsme ?

Les réponses de Rom Braslavski sont à découvrir dans ce nouveau Story Time jewbuzz, une interview que nous avons réalisée avec énormément d’émotion.

Au-delà de l’ex-otage que le monde a découvert dans les médias, nous avons voulu rencontrer le jeune homme derrière les cicatrices : sa foi, sa résistance, son retour à la vie et la mission qu’il porte aujourd’hui.

Un immense merci à @RomBraslavski d’avoir accepté de témoigner pour la 1ère fois devant un média français, avec autant de sincérité.

[Jérémy Benhaïm @JeremBenhaim]

Voici le capitaine Smit Machchhar.

Poignardé lors du vol Flydubai, il a trouvé la force et le courage d’empêcher le terroriste de détourner l’appareil, avec l’aide de passagers israéliens.

Ce soir, il se bat pour sa vie. Nous prions pour le retablissement de ce héros. 🙏🏻❤️

[Sean Metcalf @PyroTek3]

There are two main password attacks leveraged by adversaries; one is called Password Spraying and the other is called Kerberoasting.

This post focuses on identifying accounts that may be targeted for Kerberoasting and how to harden the environment against Kerberoasting.

Password spraying involves the attacker using a list of passwords and for each password attempts to authenticate as each user using that one password. After working through all users with the first password, they move on to the next password in the list. Successful authentication is noted along the way as these are compromised accounts.
I wrote about detecting password spraying here: https://t.co/YtdnOj7tg5
Kerberoasting is possible when an Active Directory account has a Kerberos Service Principal Name (SPN) associated with it. In order to enable Kerberos authentication for an application, the associated service account needs a SPN. Kerberoasting takes advantage of the fact that one can request a service ticket using the SPN associated with a target service account and take that Kerberos service ticket offline to attempt to crack it.

Attackers are most likely to attempt Kerberoasting on the accounts with passwords that are about 5 years and older since they are more likely to have poor passwords, though attackers may just attempt kerberoasting all AD accounts that have SPNs.

For more information on how Kerberoasting works as well as detecting Kerberoasting, read this article: https://t.co/JNnLrihOpt

I wrote a short PowerShell script that identifies all accounts with SPNs as well as Active Directory admin accounts with SPNs (leverages the Active Directory PowerShell module):
https://t.co/whYaotZJJw

TO DO LIST:
Remove SPNs from AD Admin accounts associated with people since they shouldn’t have any SPNs associated with them.

If the default domain administrator account is listed here, work to remove the SPN associated with it. This account should never have a SPN.

Remove SPNs from the other accounts associated with people since they shouldn’t have any SPNs associated with them.

Identify service accounts identified as AD Admin accounts (those that are members of Administrators, Domain Admins, or Enterprise Admins). Remove accounts that don’t belong and leave only those accounts that require these privileges (should be a minimal to 0 list of service accounts).

Identify the AD Admin accounts that have old passwords (> 5 years) and put together a plan to change those passwords, preferably with a password of >25 characters.

Identify the other accounts that have old passwords (> 5 years) and put together a plan to change those passwords, preferably with a password of >25 characters.

IMPORTANT NOTE: Ignore the krbtgt account with regard to these directions as this is required to be configured this way for AD Kerberos to work.
The KRBTGT account requires special attention: https://t.co/pRejsodGWq

Reference:
https://t.co/f9pxadubiv

[24h Pujadas @24hPujadas]

▶️️️Gaza : quand le Hamas truque ses morts

Les faits rien que les faits avec Lucile Devillers @luciledevillers 🔍

🔄 Retrouvez #24HPujadas sur #LCI - canal 15

#Hamas #Gaza #Palestine #Israël⤵️

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft released security updates on July 14, 2026, to address CVE-2026-54121 (Certighost), an elevation-of-privilege vulnerability in Active Directory Certificate Services (AD CS).

An authenticated, low-privileged attacker with network access could manipulate certificate enrollment to impersonate a Domain Controller, potentially enabling privileged operations and full domain compromise. Exploitation requires no administrative privileges or user interaction, but does require network access and a valid domain account.

The publication of proof-of-concept code increases the likelihood of exploitation attempts, so we recommend customers prioritize installing the July 2026 security update as soon as possible. Microsoft has observed researcher testing activity but has not confirmed active exploitation by threat actors. In response to these early signs of activity, we are sharing detection and hunting guidance to help defenders identify potential exploitation attempts, particularly in environments where the security update has not yet been applied.

Microsoft Defender detects malicious certificate requests associated with this vulnerability and generates the alert:
- “Potential Certighost (CVE-2026-54121) AD CS abuse.”
- "Active Directory Certificate Services attack tool activity "

Other alerts, including the following, may also appear during the attack chain. These signals support investigation but are not independently specific to Certighost.
- Security principal reconnaissance (LDAP)
- Suspicious Active Directory Certificate Services abuse tool activity
- Suspected suspicious Kerberos ticket request
- DCSync attack (replication of directory services)

Customers should apply the July 14, 2026 security update to every server running an Enterprise Certification Authority (CA). The security update provides the primary protection by validating the enrollment chase target before the CA contacts it, preventing invalid or attacker-controlled systems from influencing certificate issuance.

Customers who can't apply the July 14, 2026 security update immediately for all affected servers, should consider configuring the following audit logs to enable the mentioned detections and forensic:
- Enable Certification Services auditing for both successful and failed operations.
- Configure the CA audit filter to capture certificate lifecycle activity.
- Monitor Security events 4886 and 4887 for anomalous certificate requests and issuance.
- Investigate certificates requested through machine templates that contain unexpected Domain Controller identity information.

[🥝🏳️‍🌈 Benjamin Delpy @gentilkiwi]

you know about #passtheshirt ?
new attack model here at @BlueHatIL

[Jérémy Benhaïm @JeremBenhaim]

Vous vous souvenez d’Ismaël Boudjekada, cet ex-élu qui avait fait l’apologie du terrorisme en affirmant que le Hamas est un « mouvement de résistance » et qui avait rendu hommage à son chef, Yahya Sinwar ?

Sachez qu’il a été condamné aujourd’hui à 12 mois de prison, dont 6 mois ferme sous bracelet électronique, ainsi qu’à 3 ans d’inéligibilité avec exécution provisoire.

Ne rien laisser passer. Jamais.

Un grand bravo à l’@Association_OJE pour avoir obtenu sa condamnation.

[CeB23 @b23_ce]

@MsftSecIntel Crazy attack!

[Microsoft Threat Intelligence @MsftSecIntel]

A sophisticated and multi-layered attack by the threat actor tracked by Microsoft as Storm-2949 demonstrates how a single compromised cloud identity could lead to a full-scale organizational breach. https://t.co/s1MMx0fI4L

Relying on social engineering and abusing legitimate administrative tools, Storm-2949 moved laterally across cloud resources and endpoints without using traditional malware, quietly exfiltrating large volumes of sensitive data.

This stealthy attack underscores the importance of strong identity protections, least-privilege access, and unified visibility across environments. Read the latest Microsoft Defender Research blog for guidance on detecting and containing multi-stage attacks before they escalate.

[CeB23 @b23_ce]

https://t.co/WK0HLC0M4K

[CeB23 @b23_ce]

Organizations are still defending assumed siloed environments.

Attackers are already operating across them.

This investigation shows how a single compromised identity escalated into a cloud-wide breach. https://t.co/tORbw4AB8F

[CeB23 @b23_ce]

Huge credit to Alon Marom , Adi Segal, and Karam Abu Hanna for this outstanding work!

[Grafana @grafana]

🚨 We recently discovered that an unauthorized party obtained a token with access to the Grafana Labs GitHub environment, enabling the threat actor to download our codebase. (1/6)

[Heidi Bachram @HeidiBachram]

Flotilla leader Thiago Avila got his detention extended until Sunday. He entered court with hands clasped behind his back as if he’s handcuffed. He’s not. Even the guard looks confused. There’s nothing real about this people.

[Joshua L. Zarka @yzarka]

🚨 Fausse information 🚨

Le couvent des sœurs Salvatoriennes à Yaroun dans le sud-Liban n’a pas était détruit, ni même touché.

Un bâtiment résidentiel en dehors du complexe religieux a été touché après qu’une enquête a conclu à son utilisation à des fins militaires, notamment pour des tirs de missiles.

L’opération s’inscrit dans le cadre des règles du droit international humanitaire, en vertu des articles 52 et 57 du Protocole additionnel I.

Toutes les mesures nécessaires ont été prises pour ne causer aucun dommage à tout bâtiment religieux.

J’appelle à la prudence alors qu’une propagande agressive est à l’œuvre. Tout responsable politique devrait vérifier les faits avant de condamner.

L’Etat d’Israël protège et respecte les lieux de culte de toutes les religions.

Il chérit ses relations privilégiées avec les communautés chrétiennes à travers le monde.

[CeB23 @b23_ce]

@SpecterOps @croco_byte Really cool GPO is being abused a lot in the wild great blog about it: https://t.co/BYOaXgQigQ

[פיקוד העורף @PikudHaoref1]

צילמת יירוטים? אתם מהמרים על החיים. שימו 🧡 בזמן קבלת התרעה מתמגנים, בשום אופן לא מצלמים ומסתכנים❗️

[Bill Bramhall @BillBramhall]

Cartoon