Cedric Van Bockhaven

[Marat Nigmatullin @_mnigma_]

In one week I will be presenting at @SpecterOps SO-CON 2026 about CyberArk PAM. I will share our practical experience and insights on PVWA edge cases and CCP API misconfigurations. #SOCON2026

More information and registration: https://t.co/dHORi2Jooo

[Melvin langvik @Flangvik]

Pushed a major redesign and improvement of https://t.co/ZRVQgWfEKI for the old-school PowerShell warriors out there. Includes five more recent patch methods and tons of fixes, thanks to my best friend Claude 🤠

[mgeeky | Mariusz Banach @mariuszbit]

1. There's little to no value giving away someone's hard work to public only to feed threat Intel feeds, signature databases and APTs in return for a few likes and kudos 🙃

2. Private Discord servers offer Signal/Noise ~ 1.0 + friendly atmosphere🫢

Initial Access Guild FTW! 🍻

[N7WEra @N7WEra]

Added a feature to ADExplorerSnapshot script today to gather useful information about the environment via the classes, now it will tell you if SCCM, ADCS etc are active in the environment https://t.co/cOeOyf3PRe . Thank you @c3c for the awesome tool and the quick PR approval

[Outflank @OutflankNL]

📢 Big News! @mariuszbit is joining Outflank! He ticks all the boxes:
Experienced #offsec researcher ✓
Respected name in red teaming ✓
Built RMF tooling for initial access ✓
His work is coming to OST✓
The red hoodie fits perfectly ✓
Welcome Mariusz!
https://t.co/EBbODaWPBB

[Dirk-jan @_dirkjan]

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: https://t.co/jD6EaGtsn3

[Cedric Van Bockhaven @c3c]

@ze_ts_ @SEKTOR7net The bigger risk with enclave vulns is that sensitive data/key material may be compromised, which is what they were designed to protect.

[Cedric Van Bockhaven @c3c]

@ze_ts_ @SEKTOR7net Abusing an enclave for running malicious code is tough (custom gadget chains needed) and most interesting functions (file IO, network IO) will go via VTL0/be subject to analysis in VTL0 anyway.
For post exploitation their use is limited - at least for now

[Cedric Van Bockhaven @c3c]

@ze_ts_ @SEKTOR7net Identifying what is exported in existing DLLs requires some reverse engineering to figure out the playing field for that enclave.
The offensive use is limited to memory ops within the same process - anything more interesting will go via VTL0 and is subject to ETW/EDR analysis

[Cedric Van Bockhaven @c3c]

@ze_ts_ @SEKTOR7net Thanks for the mention 😊
@ze_ts_ are you looking for defensive guidance? For developing enclaves it’s indeed important to limit the exported functions and follow the recommendations by microsoft :
https://t.co/fByQjHp847

[Dirk-jan @_dirkjan]

Awesome work by Lance, clear write-up on the issue, the solution, a PR to ROADtools and more tradecraft!

[Marat Nigmatullin @_mnigma_]

My first blog with @falconforceteam! Check it out if you want to learn a few things about Azure DevOps.

[Outflank @OutflankNL]

🚀 We're hiring a DevOps/Cloud Engineer at Outflank!

Join us to build and manage complex Azure environments that deliver our OST toolkit.

Skills: Kubernetes (AKS), GitOps, IaC, Tekton, Python💻 It's NOT an offensive role!

Based in NL or a time zone-friendly region? Let's chat!

[Outflank @OutflankNL]

New Blog Alert! 🚨

Introducing Early Cascade Injection, a stealthy process injection technique that targets Windows process creation, avoids cross-process APCs, and evades top-tier EDRs.

Learn how it combines Early Bird APC Injection & EDR-Preloading: https://t.co/oWreVHNKyL

[Guido @Guid6F]

I am excited to share that I have graduated for my master's degree in Cybersecurity from the Radboud University🎓. I completed my thesis "Endpoint Detection & Response Evasion during Windows Process Creation" with a 9/10!

[matteo malvica ⭕ @matteomalvica]

@c3c rocking the stage on @Sikkerhetsfest day 2!

[Outflank @OutflankNL]

Who’s the real #GrimResource? Spoiler: It’s us! 😏

Here's our latest blog on using MSC files for initial access: https://t.co/aQ0Of11pU8

Fun fact: @elastic’s post on this technique came from a sample caught by a blue team, originally used by a red team through our OST offering.

[Olaf Hartong @olafhartong]

Great times at ⁦@WEareTROOPERS⁩ with ⁦@_dirkjan⁩ ⁦@DrAzureAD⁩ ⁦@c3c⁩ ⁦@Jonas_B_K⁩ ⁦@max__grim⁩

[Outflank @OutflankNL]

It's not *always* about Windows--macOS and Linux #EDRs need attention, too! In our latest blog, @kyleavery explains more about the telemetry sources for these under-discussed #endpoint products>

https://t.co/fxA5s7vKUH

[FalconForce Official @falconforceteam]

We are thrilled to publish SOAPHound: a custom-developed data collector tool to enumerate Active Directory environments via the ADWS-protocol. Enjoy!

https://t.co/xO0Jv9ONNd