Devin McLean

SOC & cyber infrastructure manager. I hunt the badness alongside my team. Father of 3. I like video games. Engineer at heart.

[Devin McLean @devinmclean]

@DennisF obviously a kandra

[Devin McLean @devinmclean]

@N3mes1s same hash referenced in https://t.co/5db02m5Rcs

[Axel_jg @KulinskiArkadi]

https://t.co/ZbjanUsr2Y
Registrant 37bfbc24cafea5d2 (https://t.co/TEYHoWvCwE)
https://t.co/XpppdFGcMO

https://t.co/la4P3l0veB

[Devin McLean @devinmclean]

@akshay_pachaar what did you use to make these images?

[Dirk-jan @_dirkjan]

The ADSyncCertDump tool is now part of the adconnectdump tools and can be used to extract SP credentials from Entra ID connect hosts. I will cover that during my BH/DC talks today and Friday! Tool is heavily based on Shwmae by @_EthicalChaos_

[Micah Van Deusen @micahvandeusen]

Search 15M+ Microsoft 365 tenants by org name or domain and discover all known domains in the same tenant: https://t.co/QxzqVo4sbf. Legacy methods like Autodiscover/GetFederationInfo no longer work (https://t.co/qoKZCMIIU6).

[nc 🌐🕸️🐱 @thoughtfault]

opsec like bedrock

[Nathan McNulty @NathanMcNulty]

This is interesting - a compilation of the well known GUIDs Microsoft uses in cloud

This list includes Ids for a bunch of permissions, applications, licensing SKUs, and more

We can query Graph API app roles, licensing SKUs, etc., but this is pretty nice
https://t.co/9ycTU8ZE9X

[Brian Baskin @bbaskin]

CTF players be like

[Katie Nickels @likethecoins]

If you like to know what's happening with threat trends, check out @redcanary's mid-year update to our beloved Threat Detection Report! https://t.co/mxiEja913r A couple highlights are in a thread, or join our webinar on October 10 to hear from my teammates https://t.co/EC38UfWQ9I

[Learn Something @cooltechtipz]

Where has this been all my life?

[George Kurtz @George_Kurtz]

As CrowdStrike continues to work with customers and partners to resolve this incident, our team has written a technical overview of today’s events. We will continue to update our findings as the investigation progresses. https://t.co/xIDlV7yKVh

[Devin McLean @devinmclean]

Attackers think in graphs. Defenders now think in GraphRAG Knowledge Models? @JohnLaTwC

[Microsoft Research @MSFTResearch]

GraphRAG, a graph-based approach to retrieval-augmented generation (RAG) that significantly improves question-answering over private or previously unseen datasets, is now available on GitHub. Learn more. https://t.co/HeH4bqlmpB

[Happy Captain @EODHappyCaptain]

Candor is an under utilized organizational value. The ability to have hard conversations and be honest and frank across all levels of leadership should be rewarded.

[Digital_Monet @aRtAGGI]

Enterprise defenders have grappled with the rise of ORB networks & how to talk about this growing trend among China Nexus threat actors. We dropped a blog on Universal ORB Anatomy, an enterprise framework empowering defenders against this threat class https://t.co/QFJq2RyMd6

[Nathan McNulty @NathanMcNulty]

Thanks to @stianstrysse for the push to look at this :)

# Find all SAML apps with a cert expiring in the next 30 days

Get-MgServicePrincipal -Filter "PreferredSingleSignOnMode eq 'saml'" | Where-Object { $_.KeyCredentials.EndDateTime -lt (Get-Date).AddDays(30) }

[Devin McLean @devinmclean]

@likethecoins Congratulations!

[Merill Fernando @merill]

👏 Folks! Provisioning security groups from Entra ID to on-prem AD just went GA! 🤩

With this, you can move to a cloud-first approach to managing groups in Entra ID while allowing on-prem apps to continue working.

Even better, you can use ID Governance to govern access to on-prem apps and make use of access reviews, lifecycle workflows and more!

This feature is available in Entra Cloud Sync which can run side by side with Entra Connect Sync!

Learn more → https://t.co/lY9Vp5cmqq

Bookmark this + like and repost to share with your network. Thanks!

[Devin McLean @devinmclean]

I hope there's a command to flood IRC channels :D

[JS0N Haddix @Jhaddix]

A 13 year old coded a botnet control framework that utilizes pastebin and github for control of hosts in red teaming…

This makes the hacker in me so hopeful.

Check out pastebomb when it’s dropped!