Sanjeev Singh

[Merill Fernando @merill]

Did you know that if you have Entra ID P1 there is a new way to block your stolen refresh token from being replayed by the attacker?

Find out 🧵👇
1/7

[spencer @techspence]

If you're an IT admin and you're responsible for managing and/or securing Active Directory, this webinar is for you.

I'm going to share what I think are some of the most impactful ways to harden Active Directory that meaningfully help you make your environment harder to attack.

I'll also be discussing real pentest attack walkthroughs and how these hardening measures help mitigate & prevent them.

Q&A at the end! Please come hang out and do me a solid by sharing this with your network. 🤘

10/14 at 11am Eastern

Register here 👉 https://t.co/alJpN5S5J5

Ps - Excited to partner with IS Decisions and John Dunn on this sponsored webinar. Always fun teaming up with teams who I share a common mission with. Thank you for having me!🙏

[Thomas Naunheim @Thomas_Live]

🤖 New chapter: #AgentIdentities in the Attack & Defense Playbook for #MicrosoftEntra is live!
🔗 https://t.co/nXAVuysVQ2

Together with @samilamppu, @RobbeVdDaele, and @DerkvanDerWoude, I’ve been researching #AgentID foundations, attack scenarios, detections, and mitigations.

[DFIR Radar @DFIR_Radar]

Source: https://t.co/4s6SK2prRn

[spencer @techspence]

I've seen a lot of Active Directory environments in the last 5+ years. These are some of the most dangerous issues I recommend reviewing and addressing in your environment.

Treat it like a check list.

If you have 0 of these, you're doing a great job. https://t.co/xOJN8qRe5X

[DFIR Radar @DFIR_Radar]

ADE-Skills launches as a public knowledge base for adversarial detection engineering, cataloging 37 technique files and nearly 600 candidate bypass findings across Elastic, Microsoft Sentinel, and Sigma rulesets.

Key details:

- The core of the repo is a four-category taxonomy of detection-logic failure modes: ADE1 covers reformatting in actions (NTFS 8.3 short names, PowerShell tick-escaping, environment-variable splicing), ADE2 covers omitted equivalence-class members (certutil -verifyctl/-decode/-URL while only -urlcache is watched, pwsh.exe while only powershell.exe is listed), ADE3 covers context manipulation (process-name cloning, activity spreading across entities, correlation-window timing, parent-process spoofing), and ADE4 covers Boolean and field-logic errors including negated filters that reference fields absent from a customer's telemetry, which can silently swallow true positives or disable themselves depending on how the backend evaluates a missing field.

- Each of the 37 technique files follows a fixed structure: summary, ADE classification, the technique, a vulnerable rule, a hardened rule, detection layers that survive the bypass, implementation nuances, and references. A good number are anchored to named vendor rules, giving practitioners a direct line from the abstract gap to a concrete rule they may already be running.

- Platform-specific bug-pattern catalogs cover Elastic Security, Microsoft Sentinel, and Sigma. Highlighted assumptions that quietly fail include Windows 4688 command-line auditing being off by default and script block logging disappearing after a PowerShell v2 downgrade, both of which can make a rule receive no data at all rather than fire incorrectly.

- The findings catalog contains 593 candidate bypass findings machine-extracted from public rulesets and mapped to the taxonomy with affected fields, the gap, and a suggested fix. The false-negative checklist provides four lenses: does the rule receive the data it needs, does it hinge on a threshold a slower technique avoids, does it cover only one binary or version when others are in scope, and is it tuned against a baseline that does not match the environment.

Practitioner takeaway: pull a rule you own, identify every member of its equivalence class (LOLBin aliases, alternate flags, short-name paths), confirm the required telemetry is actually enabled on the hosts that matter, and check any negated filters against fields your SIEM actually populates. The ADE-Skills repo at github[.]com/Adversarial-Detection-Engineering/adeskills ships MIT-licensed with the full taxonomy, worked technique files, the findings catalog, and Redamon scoping tooling. The findings catalog and hardened-rule examples are in the report.

#DFIR_Radar

[Florian Roth ⚡️ @cyb3rops]

Good piece from the NCSC on agentic defence

The difficult part starts when the agent is allowed to actually change things in production.

Scope, criticality, confidence and recoverability suddenly matter a lot more than “can the model understand the attack?”

Worth a read
https://t.co/1Q1tpFH08D

[Sean Metcalf @PyroTek3]

This week let’s look at Active Directory domain permissions which are configured on the domain root and apply to the domain. There are many different type of concerning permissions, but let’s look at the most egregious.

Directory Changes & Directory Changes All – provides the ability to pull password hashes for users and computers (aka DCsync permissions).

Change Owner – provides the ability to set the owner on the domain root and the owner has the ability to set permissions.

Change Permission – provides the ability to set permissions on the domain root.

Full Control – provides the ability to control any type of object in the domain.

Full Control on Users and/or Computers – provides the ability to control the object type.

I wrote a PowerShell script leveraging the Active Directory PowerShell module that can help identify these permissions on the domain root: https://t.co/k1TS2GDgWv

For more on Active Directory permissions:
https://t.co/TgMpFORi6t
https://t.co/vLp3BunQjK
For more on DCSync: https://t.co/RQh4NnBq5c

Reference Article:
https://t.co/P4iSOwouoo

[Daniel Bradley @DanielatOCN]

@wpiotrw @Cyb3rMonk Here you go https://t.co/ADfL8YPRM0

[Sean Metcalf @PyroTek3]

There are two main password attacks leveraged by adversaries; one is called Password Spraying and the other is called Kerberoasting.

This post focuses on identifying accounts that may be targeted for Kerberoasting and how to harden the environment against Kerberoasting.

Password spraying involves the attacker using a list of passwords and for each password attempts to authenticate as each user using that one password. After working through all users with the first password, they move on to the next password in the list. Successful authentication is noted along the way as these are compromised accounts.
I wrote about detecting password spraying here: https://t.co/YtdnOj7tg5
Kerberoasting is possible when an Active Directory account has a Kerberos Service Principal Name (SPN) associated with it. In order to enable Kerberos authentication for an application, the associated service account needs a SPN. Kerberoasting takes advantage of the fact that one can request a service ticket using the SPN associated with a target service account and take that Kerberos service ticket offline to attempt to crack it.

Attackers are most likely to attempt Kerberoasting on the accounts with passwords that are about 5 years and older since they are more likely to have poor passwords, though attackers may just attempt kerberoasting all AD accounts that have SPNs.

For more information on how Kerberoasting works as well as detecting Kerberoasting, read this article: https://t.co/JNnLrihOpt

I wrote a short PowerShell script that identifies all accounts with SPNs as well as Active Directory admin accounts with SPNs (leverages the Active Directory PowerShell module):
https://t.co/whYaotZJJw

TO DO LIST:
Remove SPNs from AD Admin accounts associated with people since they shouldn’t have any SPNs associated with them.

If the default domain administrator account is listed here, work to remove the SPN associated with it. This account should never have a SPN.

Remove SPNs from the other accounts associated with people since they shouldn’t have any SPNs associated with them.

Identify service accounts identified as AD Admin accounts (those that are members of Administrators, Domain Admins, or Enterprise Admins). Remove accounts that don’t belong and leave only those accounts that require these privileges (should be a minimal to 0 list of service accounts).

Identify the AD Admin accounts that have old passwords (> 5 years) and put together a plan to change those passwords, preferably with a password of >25 characters.

Identify the other accounts that have old passwords (> 5 years) and put together a plan to change those passwords, preferably with a password of >25 characters.

IMPORTANT NOTE: Ignore the krbtgt account with regard to these directions as this is required to be configured this way for AD Kerberos to work.
The KRBTGT account requires special attention: https://t.co/pRejsodGWq

Reference:
https://t.co/f9pxadubiv

[DFIR Radar @DFIR_Radar]

CISA's first dedicated cyber decoy guide maps tripwires, honeytokens, and breadcrumbs to MITRE ATT&CK and Engage, giving critical infrastructure defenders a structured playbook against LOTL and post-compromise activity.

- CISA's 22-page "Using Cyber Decoys to Strengthen Detection and Response" targets a core detection gap: adversaries using valid credentials and native tools bypass signature-based controls entirely. Decoys generate high-fidelity, low-noise alerts precisely because legitimate users should never touch them, making any interaction an immediate IOC rather than a triaged event.

- Three decoy classes get practical treatment: tripwires (any access triggers an alert), honeytokens (fake credentials, files, URLs, and records placed across servers, workstations, cloud repos, and identity systems), and breadcrumbs (artifacts that lure adversaries toward controlled environments). The guide ties each to MITRE Engage goals: Expose, Affect, and Elicit.

- The water and wastewater sector walkthrough shows the full ATT&CK gap-analysis workflow: map your assets, overlay adversary TTPs, identify where coverage is weak (phishing detection, PowerShell LOTL, cloud-backup exfiltration), then place decoys at those intersections. Red team or purple team exercises then validate alert fidelity before real adversaries arrive.

Practitioner takeaway: start with Expose operations.

#DFIR_Radar

[spencer @techspence]

If you’re an IT admin and you run CrowdStrike in your environment, listen to this episode and check these settings in your tenant.

Heck, transcribe this and have your AI do it for all I care, just do it, this week, please.

https://t.co/hjVj0SkmhQ

[Bert-Jan 🛡️ @BertJanCyber]

This is quite a good document to evaluate which Event Logs you are missing. It highlights the recommended Event IDs for AD CS, AD FS, Entra Connect and Domain Controllers.

https://t.co/yq8hxTm8HF

[Nathan McNulty @NathanMcNulty]

OK, so this is actually a pretty big deal 🥳

Microsoft removed the Entra P1 license requirement to export logs from Entra to Azure Storage or Event Hub

Even better, Azure Data Explorer offers up to 100GB free data ingestion from these - a huge win for small/low resource orgs

[spencer @techspence]

What breaks when NTLM is disabled and what are the most likely blockers you may have?

See screenshots below..

And here’s a good source of info for NTLM deprecation procedures.

https://t.co/C4MWQMOJfp

[BlackRoomSec @blackroomsec]

OUT TODAY: CISA, CCCS, NSCS-UK, NCSC-NZ "Detecting and Mitigating Active Directory Compromises" outlining 17 most common techniques used by adversaries:

https://t.co/VPmQu3XbeG

Get on this please.

CC: @techspence

[Sean Metcalf @PyroTek3]

Here are some key Conditional Access policies that @TechBrandon & I put together. You should also have a "catch-all" policy that applies to all users and devices you have in your environment.

Brandon also wrote a PowerShell script to help you check what you have against what you should have:
https://t.co/J4V61dQfT5

[spencer @techspence]

I strongly recommend getting your AD domain to NTLM level 5 as quickly as possible. At least 3 for DCs bare minimum (which is the default).

[DFIR Radar @DFIR_Radar]

The Hugging Face incident reconstructed ~17,600 agent actions spanning Kubernetes, AWS, VPN, and source control. The TTPs shifted; the objectives did not: discovery, credential abuse, privilege escalation, lateral movement.

#DFIR_Radar

[DFIR Radar @DFIR_Radar]

FalconForce open-sourced FalconDash, an Azure Workbook that queries SecurityAlert via KQL make-series to surface noisy Sentinel detections.

#DFIR_Radar