Aziz Chourou

[Aziz Chourou @chourou_sec]

Day 19/30 · DSRM persistence

Every DC has a second local admin teams forget: the DSRM account.

One registry change lets you Pass-the-Hash it onto the DC, access that survives a domain password reset.

🛡️ Defense: monitor DsrmAdminLogonBehavior, and rotate the DSRM password.

[Aziz Chourou @chourou_sec]

@GauravGoyalAI @X Hi

[Aziz Chourou @chourou_sec]

@Iamkaifyyy @X Let's connect!

[Aziz Chourou @chourou_sec]

@Badboi_x_ace Let's go!

[Aziz Chourou @chourou_sec]

@acadictive Hey Ehsan, connected! 👋🏻

[Aziz Chourou @chourou_sec]

Anyone working in cybersecurity, let's connect.

[Aziz Chourou @chourou_sec]

@Gbolavic374 Yes.

[Aziz Chourou @chourou_sec]

@FAMOUS_ust Here.

[Aziz Chourou @chourou_sec]

@gifted_hands3 Here, let's connect.

[Aziz Chourou @chourou_sec]

@StephenO50731 Sure

[Aziz Chourou @chourou_sec]

Day 18/30 · Diamond Ticket

Golden tickets are loud now.

A Diamond asks the DC for a real TGT, then rewrites its PAC with krbtgt's key.

It looks legitimately issued, because it is.

🛡️ Defense: baseline ticket lifetime and groups.

Anomalies inside a 'real' TGT are the tell.

[Aziz Chourou @chourou_sec]

@vm_patne @X Hi, let's connect.

[Aziz Chourou @chourou_sec]

@SamVale29 @X Glad to connect!

[Aziz Chourou @chourou_sec]

@UTDDrey17 Here, let's connect.

[Aziz Chourou @chourou_sec]

@Samuel121p2d Sure!

[Aziz Chourou @chourou_sec]

@XlJ3X Here!

[Aziz Chourou @chourou_sec]

@Roukceo In!

[Aziz Chourou @chourou_sec]

@EliasTarus79386 Not yet, let's connect.

[Aziz Chourou @chourou_sec]

@louisthehussla Sure.

[Aziz Chourou @chourou_sec]

@MAKANAKI200 Sure.

[Aziz Chourou @chourou_sec]

@damiwillz789 No, let's connect then