Krelkci

@BHInfoSecurity @DefensiveOGs @WWHackinFest @Antisy_Training Security Analyst and Researcher; Educator; SysAdmin; Strategic Security; #PurpleTeam

[Krelkci @Krelkci]

@techspence Naww, just saving it up for a quiet day in Jira?

[Krelkci @Krelkci]

@praetorianlabs Second comment, since your agentic forgot to post the first: https://t.co/2XxAVArMwd

[Krelkci @Krelkci]

@praetorianlabs First comment: https://t.co/Rcs43WvR2y

[Krelkci @Krelkci]

@georgeguimaraes Pretty sure NIST says you need to force rotation when the Authenticator is compromised. Just being technical. They said to stop arbitrary age based
rotations, not rotations.

[Krelkci @Krelkci]

@Wakedxy1 @DirectoryRanger Password reuse. IPMI exposed (with guessable username), lack of network segmentation, lack of protected users group membership… probably didn’t have LAPs… weak password policy… guessing we can find a few more in there. Nice work

[Krelkci @Krelkci]

@digitalix My fingers hurt already. Always carry a short flathead screwdriver

[Wild West Hackin' Fest @WWHackinFest]

Join @Krelkci & @Rev10D for their class "Active Directory Security and Hardening," at Wild West Hackin' Fest @ Mile High 2026! Don't ya go missin' it, grab yer tickets to the con today! --> https://t.co/QLA9JGyXWo

[Krelkci @Krelkci]

@techspence Teaching defensive mechanisms to offsec has been rewarding. More interested in the “how it works” than the why it’s important. Understnding the current capabilities/visibility of EDR/XDR drives offsec’s invisibility.

[Krelkci @Krelkci]

@techspence I mean, I suppose I’m biased. #shamelessplug https://t.co/GEQ7OUBS47

[Krelkci @Krelkci]

@cyb3rops Say we fork it and make it malicious after it has some signature adoption. Does that make it a decoy decoy?

[Krelkci @Krelkci]

@troyhunt How the h does their site load so fast? Sure this isn’t entirely cached?

[Krelkci @Krelkci]

@DebugPrivilege @citrix Thank you for giving me an example to use in class! Good for them of resolution

[Krelkci @Krelkci]

@DirectoryRanger I removed DCSync from DCn+1$ but now something isn’t working right.

;)

[Krelkci @Krelkci]

@NathanMcNulty Do all MVPs get tights and cutouts? Think I need to realign my priorities!

[Krelkci @Krelkci]

@wyoham Glen Rock? You got your power back already? Seems a bit bigger than that yeah? Anyway, stop hogging all the power bro and let the neighbors have some

[Krelkci @Krelkci]

@rjfox92 @techspence Your workstation admin doesn’t need to be DA

[Krelkci @Krelkci]

@jagrmeister @techspence Maybe, but not the kind of CISO you want managing risk.

[Krelkci @Krelkci]

@PrzemyslawKlys @EvotecIT “covering usage might be the more correct term. @PrzemyslawKlys — reach out if you want a copy of our lab where we use GPOZaur and Testimo. You guys are awesome!

[Krelkci @Krelkci]

@PrzemyslawKlys I’ve been including this in our Defending the Enterprise class for a couple years now. I imagine it’s been helpful for many orgs at this point. Keep up the awesome work!