Mor Rubin

Security Researcher @Aorato acquired by @Microsoft developing #AzureATP #MCAS

[Mor Rubin @rubin_mor]

From Pass The Prt to Pass The Certificate for Azure AD machines

In this post, I will explain what NegoEx and PKU2U are, what P2P certificate is and how to use those to gain access to Azure AD machines

https://t.co/dZ26jNdi3Z

[Mor Rubin @rubin_mor]

Glad that NTLM relay replacement found for AAD😆
Releasing My NegoEx relay tool which also allows you to modify the PKU2U part and bypass NegoEx message validation
https://t.co/UibeH6cuXB

[Tal Be'ery @TalBeerySec]

NTLM relay is dead and living in AAD.
An interesting @BlackHatEvents talk by @rubin_mor
https://t.co/9lVZdlkPHy
CC: @SteveSyfuhs @gentilkiwi
#BHUSA2022

[Tal Be'ery @TalBeerySec]

NTLM relay is dead and living in AAD.
An interesting @BlackHatEvents talk by @rubin_mor
https://t.co/9lVZdlkPHy
CC: @SteveSyfuhs @gentilkiwi
#BHUSA2022

[Blumira @blumirasec]

Headed to @BlackHatEvents next week? Prep your schedule -- @ericamix selected 10 sessions.

Ft. speakers @Microsoft's @rubin_mor, @Google's @tiraniddo, @NetSPI's @monoxgas, @DrStacyThayer, @SentinelOne's @TomHegel, @kimzetter and more.

#blackhat2022

https://t.co/KZTVRvNjMZ

[Tal Maor @talthemaor]

2nd reason to attend Blackhat this year is @rubin_mor's "AAD Joined Machines - The New Lateral Movement" talk. Don't miss it.

https://t.co/z7vr8eOIzf

[Mor Rubin @rubin_mor]

Azure ATP now detects SmbGhost on Domain Controllers
#Microsoft #smbghost

https://t.co/ArzShk8L54

[Tal Maor @talthemaor]

@_dirkjan @WEareTROOPERS @sannemaasakkers Nice!!
GREAT MINDS THINK ALIKE
https://t.co/2rgRP7ZrvZ
looking forward.