Robin Granberg

Works @ Semperis, Tweets are my own. Blog: Project:

[Robin Granberg @ipcdollar1]

Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't!
Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated.
New post: https://t.co/aNYAd6tlxz

[Robin Granberg @ipcdollar1]

The .NET ActiveDirectorySecurity API was built for helpdesk scripts, not ACL fidelity.
If you're using it for backup, migration, or exact cloning — you're going to have a bad time. New post: the 9 design problems you need to know. https://t.co/OWOAcVbMnH

[EZ @IAMERICAbooted]

A tool you would use when you cant use BH :P
https://t.co/TBbjybdX85

[Andrea P @decoder_it]

Remember the CredMarshalInfo trick? If you hadn’t applied the June 2025 patch, CVE-2025-33073 would have been critical. We know that in NTLM local auth, msg 3 is empty:You can drop sign/seal -> from Domain User to DomainAdmin escalation. 😅

[Robin Granberg @ipcdollar1]

@ifexploit @oryair1999 @ShahakMo @safebreach I figured that out. Thanks 🙏

[Andrea P @decoder_it]

M'm glad to release the tool I have been working hard on the last month: #KrbRelayEx
A Kerberos relay & forwarder for MiTM attacks!
>Relays Kerberos AP-REQ tickets
>Manages multiple SMB consoles
>Works on Win& Linux with .NET 8.0
>...
GitHub: https://t.co/zoN2fX6Hsc

[Andrea P @decoder_it]

A short and light post on one of my favorite topics: spotting and exploiting GPO misconfigurations, nothing too technical, just the basics! 😅 https://t.co/lbspKs5f9c

[Andrea P @decoder_it]

Now a good one: In the latest Windows 11 Enterprise Insider edition, with Credential Guard enabled (by default), the "tgtdeleg" trick, previously a key for attack chains, is no more possible #tgtdeleg #rubeus

[Robin Granberg @ipcdollar1]

@decoder_it You’re worth more… You’re awesome and I’m grateful to be working side by side with you 🙌

[Andrea P @decoder_it]

Is Kerberos relaying so limited? I'd say no, thanks to @tiraniddo CredMarshalTargetInfo trick. In this case, I'm relaying SMB to HTTP (ADCS) with a modified version of @cube0x0 krbrelay using DFSCoerce and PetitPotam - classic ESC8 attack with Kerberos, no DCOM involved ;)

[Eric Woodruff | MVP | CIDPRO @ericonidentity]

🤫 The part I’m most excited about with my #BHUSA talk is secretly teaching everyone about identity components of #Entra multi-tenant applications and service principals. 🤓

If that sounds boring, pretend you didn’t read this.

#BlackHat2024 #infosec #EntraID #foreshadowing

[Hot Fiendish Dr. Noid Summer @_noid_]

Are you also on a conf bridge in the middle of the night dealing with Crowdstrike's bullshit?

[Karl Emil Nikka @KarlEmilNikka]

Utmärkt inlägg av Staffan Dahllöf (@StaffaniDK) på @SvDDebatt om regeringens massövervakningsförespråkande.

https://t.co/qM4YuFDaIf

#ChatControl #GoingDark #svpol #eupol

[inversecos @inversecos]

Detecting Lateral Movement in Entra ID 😍

Threat actors can perform tenant-to-tenant lateral movement by abusing Cross Tenant Synchronisation.

Full blog 👇
https://t.co/r8RF9XLIS8

You can detect lateral movement from specific logons abusing this feature in Entra ID 😝

This blog covers:
> Attack methodology
> Detection methodology

[Robin Granberg @ipcdollar1]

@sapirxfed @decoder_it @decoder_it rocks!

[Robin Granberg @ipcdollar1]

@sapirxfed @WEareTROOPERS Good luck! It will go great! 👍

[Andrea P @decoder_it]

Just published a short blog post on abusing the SeRelabelPrivilege ;) https://t.co/4otLkOXH7B

[Robin Granberg @ipcdollar1]

I have written a new blog post about Entra ID PIM and how Sensitive Actions are supposed to protect privileged objects. But there is a situation you need to be aware of when working with PIM.

https://t.co/SV6j65WPMB

#EntraID #Cybersecurity #PIM #PrivilegeIdentityManagement