Chris D'Amore

[Chris D'Amore @cmd1775]

@brettshavers I am very interested. Thank you!

[Thurrott Feed @Thurrottfeed]

Ikea Announces Xbox-Inspired ‘YXSTABY’ Furniture and Accessories Collection https://t.co/nDU1X1V20S

[🦆 SchizoDuckie 🦆 @SchizoDuckie]

This seems... Kind of important.

https://t.co/94QCQkDUoz

[Tech Brandon @TechBrandon]

I've seen lots and lots of orgs that are completely unaware of the phishing risks associated with device code flow. The technique has been around for 5 years. The Microsoft docs provide a great walkthrough of checking logs and implementing policy.

[Chris D'Amore @cmd1775]

@NathanMcNulty @TechBrandon The same. Almost never see this policy when doing assessments.

[Justin Elze @HackingLZ]

Probably a good time for this reminder

[Chris D'Amore @cmd1775]

@robertgraham The real question is why isn’t this impacting their sales? It’s almost like enterprises don’t seem to care.

[Chris D'Amore @cmd1775]

@sapirxfed How can this telemetry be accessed from non-Microsoft products?

[Chris D'Amore @cmd1775]

@techspence Too many people listening to product marketing…

[Horizon Secured @horizon_secured]

🔒 Secure Bits 💡
New LAPS Features – 𝗔𝗿𝗲 𝗬𝗼𝘂 𝗨𝘀𝗶𝗻𝗴 𝗧𝗵𝗲𝗺?

You probably know about the newer Windows LAPS (now in GPO > System\LAPS), but are you really taking advantage of all its capabilities?

𝗪𝗵𝗮𝘁’𝘀 "𝗻𝗲𝘄" 𝗶𝗻 𝗟𝗔𝗣𝗦?
✅ Password Backup for DSRM accounts
✅ Password Encryption for extra security
✅ Automatic Account Management (not just the built-in Administrator)
✅ Backup Directory Configuration

𝗕𝘂𝘁 𝗵𝗲𝗿𝗲’𝘀 𝘄𝗵𝗮𝘁 𝗿𝗲𝗮𝗹𝗹𝘆 𝗰𝗮𝘂𝗴𝗵𝘁 𝗺𝘆 𝗮𝘁𝘁𝗲𝗻𝘁𝗶𝗼𝗻:
💡Improved Readability Mode – No more struggling to rewrite complex passwords! A simple change that makes LAPS so much more user-friendly.
💡Post Authentication Actions – Decide what happens after usage:
▪️Reset the password
▪️Log off the account
▪️Reboot the machine
▪️Even terminate all remaining processes!

Are you already using these? Or do you still rely on the "old" LAPS? Drop your thoughts below! 👇

#Windows #ActiveDirectory #Cybersecurity @BlueTeamDave

[Chris D'Amore @cmd1775]

@merill It is about time.

[Samir @SBousseaden]

some cool #Elastic detections added by @_w0rk3r to identify potential kerberos SPN Spoofing via the CredMarshalTargetInfo primitive (abused in CVE-2025-33073 and also in other Kerberos reflection attacks):

https://t.co/cBIyEgfGt9

https://t.co/ASqCOjxj9A

https://t.co/pHG3QElvSH

[Clate @clatent]

Finally made it happen! Public Custom Maester Test Collection is now available. Check out my blog post for more info, and hope you will contribute as well! #powershell #Maester #Security https://t.co/NUpuzb7A1o

[Chris D'Amore @cmd1775]

@clatent @NathanMcNulty This is awesome!

[John Althouse @4A4133]

How to use JA4H to find new C2 servers!
[WebScout blog]

https://t.co/y4cmZn5qhW

[spencer @techspence]

What types of deception tech should I use? Here’s some examples I have come across that I really liked. Please, other folks, chime in here with what you’ve seen and liked too…

- Honey file called password.doc on a shared drive
- Honey file called test.txt in an IT admins personal folder on a shared drive
- Honey account with a password in the description attribute in AD

[Elli @ellishlomo]

Hunt for suspicious scheduled task creation and execution in MDE.

DeviceProcessEvents
| where ProcessCommandLine contains "schtasks.exe" and ProcessCommandLine contains "/create"
| join kind=inner (
DeviceFileEvents
| where FileName endswith ".exe" or FileName endswith ".ps1" // Executable or PowerShell files
| summarize by DeviceId, FileName, ActionType, TimeGenerated
) on DeviceId
| join kind=inner (
DeviceLogonEvents
| where LogonType == 2 // Interactive logon
| summarize by DeviceId, AccountName, LogonTime = TimeGenerated
) on DeviceId
| summarize ScheduledTaskActivity = count() by DeviceName, AccountName, FileName
| where ScheduledTaskActivity > 2 // Adjust threshold
| order by ScheduledTaskActivity desc

[Chris D'Amore @cmd1775]

@LitMoose Blue Cape Security is another one to add - https://t.co/14X3RpoNeO

[Chris D'Amore @cmd1775]

@PSBK2E @brettshavers Will this be offered again at a latter date? I can not make this week work..

[Chris D'Amore @cmd1775]

@eric_capuano @shortxstack @WWHackinFest @velocidex Hell yes!!