DirectoryRanger

This account assembles and disseminates information related to Active Directory and Windows security.

[DirectoryRanger @DirectoryRanger]

24/7 Active Directory Incident Response Contact:
Tel. [phone]
E-mail: [email protected]

[DirectoryRanger @DirectoryRanger]

Investigating suspicious AI workflows in Microsoft Entra Agent ID: Autonomous agents, by @mattifestation
Part 1: https://t.co/X7JO1HvrZB
Part 2: https://t.co/E7FQmztOJm

[winterknife 🌻 @_winterknife_]

Releasing SILVERPICK, a Windows shellcode development framework using C/C++.

https://t.co/Jk94d3OvMX

[Florian Hansemann @CyberWarship]

''Debugging Windows Isolated User Mode (IUM) Processes - Quarkslabs blog''

#infosec #pentest #redteam #blueteam
https://t.co/rtTWrHZ1JU

[🕳 @sekurlsa_pw]

MS AD Kerberos update active since April:

If there is no explicit msds-SupportedEncryptionTypes Active Directory attribute defined the DefaultDomainSupportedEncTypes will be AES-SHA1 (0x18).

This is significantly slower to crack as RC4.

[DirectoryRanger @DirectoryRanger]

Getting Started with NetExec: Streamlining Network Discovery and Access
https://t.co/Ckh5ayaIzn

[Enno Rey @Enno_Insinuator]

Manipulating RPKI (and more) with marquees in TLS certificates (and more) #RIPE92
https://t.co/TtkGhDvghk [PDF]

[R.B.C. @G3tSyst3m]

@FlorianHeigl1 @Enno_Insinuator Yes that is my understanding. The blocklist should take effect if they used a sig date. Unless we’re missing something obvious here. I feel gaslit half the time I’m trying to make sense of how signing rules are applied or rather misapplied haha.

[R.B.C. @G3tSyst3m]

My latest blog post: Using BYOVD to loot LSASS bypassing HVCI and all other security protections built in to Windows 11 25h2:

https://t.co/xuKSBQSwYr

[DirectoryRanger @DirectoryRanger]

Insights into Entra ID’s (Un)Conditional Access, by @insinuator
https://t.co/63BLlCvOtG

[Mr.Un1k0d3r @MrUn1k0d3r]

I decided to publish my internal Azure Entra ID tool. There are a lot of these already available, but I've added some interesting features that have made a difference for me over the years. You can capture token through the browser using playwright

https://t.co/xiZaz0PKsC
#Azure

[DirectoryRanger @DirectoryRanger]

Outlook 365 for the PWN
https://t.co/hI6AnYXlmD

[DirectoryRanger @DirectoryRanger]

The Interesting Case of WSL for Payload Staging
https://t.co/d9vvc7PaJj

[DirectoryRanger @DirectoryRanger]

Site Unseen: Enumerating and Attacking Active Directory Sites, by @Synacktiv
https://t.co/TQJ9NRfTbj

[SpecterOps @SpecterOps]

If you had FOMO during #SOCON2026 or you want to run back your favorite talk, the talk playlist is now available!

👀 Watch all currently available sessions: https://t.co/MrcmfXAmsZ
📊: Access the presentation slides: https://t.co/qSjOXlELgF

[DirectoryRanger @DirectoryRanger]

24/7 Active Directory Incident Response Contact:
Tel. [phone]
E-mail: [email protected]

[Alex Neff @al3x_n3ff]

SMB share enumeration via ACLs with NetExec🔥

NetExec now detects share permissions via ACL enumeration, instead of trying to write a file. In addition, we can now detect if a user has indirect access to the share, e.g. by having ACL write permissions!

Made by @PytelJack🚀

[Nikhil @Ox4d5a]

Windows Internals Part78: Terminating Process

https://t.co/mwq6xVefPa

#infosec #windows #linux #cybersecurity

[Andrew @4ndr3w6S]

Round two!

Yesterday was one report, here’s another: an unpatched NTLM coercion via the Windows Search (search-ms://) URI handler.

Same questions about how it got handled. It’s all in the writeup, timeline included.

https://t.co/eMbyEGbx8b

[DirectoryRanger @DirectoryRanger]

Exposed RDP: The Misconfiguration that Keeps Paying Off
https://t.co/QSqvCILMQX

[R.B.C. @G3tSyst3m]

@FlorianHeigl1 @Enno_Insinuator it's complicated, lol. Essentially yes, Microsoft-signed components get more implicit trust baked into the OS. But even signed third-party drivers (like the AMD PDFWKRNL.sys I used) can slip through if that specific version/hash isn't on Microsoft's blocklist yet.