X-Technobro

[Nicolas Krassas @Dinosn]

New Kerberos Abuse Path Discovery - Constrained Delegation without Protocol Transition against SPN-less accounts https://t.co/UZ0WNafGZ4

[Raj Patel @GrayHatKiller]

A fork of ntlmrelayx is available here https://t.co/xagreQ5zZU with the LDAP signing bypass implemented. If anyone wants a quick win to fully compromise a domain…here you go!

[Jose Enrique Hernandez @_josehelps]

Two more EDR killers just landed on LOLDrivers, both from Jehad Abudagga's (@j3h4ck) KillerLand research.

Same BYOVD play: load a signed driver, hand it a PID, and let the kernel terminate the security tools for you.

https://t.co/PSp2WqUIEM

[SpecterOps @SpecterOps]

New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇

https://t.co/jNcQOmH72U

[db @whokilleddb]

While looking for MSBuild alternatives, I came across VisualStudio's TextTransform utility which can execute C# code embedded in `.tt` files - something I haven't seen in the wild before, so naturally, I had to make a tool around it to run shellcode ;)

https://t.co/98CD8P8YuR

[SpecterOps @SpecterOps]

What happens when Chromium becomes an offensive tool?

Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.

Go deeper with Andrew’s research 👉 https://t.co/xjatICDFfF

[aas @aas_s3curity]

I wrote up a way to defeat enforced SMB signing for relay.

It abuses a documented SMB re-authentication behavior.

I'm surely missing nuance and prior art. Corrections welcome.

Writeup:
https://t.co/qzF9MUF9MJ

PoC:
https://t.co/O0UN4gdVfJ

[Abdul Mhanni @abdo_mhanni]

Crazy cool blog I saw on linkedin about an SMB signing bypass technique

TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.

https://t.co/G3MWUMfA0f

[RedTeam Pentesting @RedTeamPT]

🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!

Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀

[byteMe @0xby7e_me]

New post: Writing a Beacon Object File from scratch in C.

COFF internals, dynamic import resolution, and building a privilege enumeration BOF - no frameworks, no wrappers.

Plus why execute-assembly lights up every EDR while BOFs barely register.

https://t.co/fuAJKeDaJ0

[Panos Gkatziroulis 🦄 @ipurple]

A Beacon Object File (BOF) for Cobalt Strike and Mythic C2 that implements COM hijacking for persistence on Windows systems. https://t.co/zk2M2iXgB7

[DirectoryRanger @DirectoryRanger]

Token Theft in Microsoft Entra ID, by @insinuator
Part 1: Threat Landscape and Attack Techniques https://t.co/jIgt0hXSJD
Part 2: Continuous Access Evaluation https://t.co/F6SepUh9nL
Part 3: Token Protection https://t.co/RVADmlcm2X

[Rich Warren @buffaloverflow]

But it doesn't just affect Intune + NSIS - any MDM solution that allows users to self-install apps, and other installer packaging frameworks could also be vulnerable.

Details on the @AmberWolfSec blog:
https://t.co/YU5sIVt1Gh

[BriPwn @BriPwn]

🟣 Weekly Purple Team: DLL Sideloading

Adaptix Beacon hidden inside python315.dll. Legit process, malicious payload, C2 up and running.

Then we show you how to catch the sideload 👀

Red vs. blue breakdown 🎥
https://t.co/geN1ARn6JJ

#PurpleTeam #RedTeam #BlueTeam #DLLSideloading #AdaptixBeacon #C2 #DetectionEngineering #MITREATTACK #CyberSecurity

[cr3ghost @cr3ghost]

If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this.

The team at @SpecterOps has built one of the best FREE security research archives online.

The rabbit hole covers:

- Active Directory + Kerberos
- Entra ID + Azure
- Okta + identity providers
- BloodHound + attack paths
- SCCM / Configuration Manager
- Red team tradecraft
- Detection engineering
- Lateral movement
- Credential access
- OAuth + token security
- Browser persistence
- AWS + cloud attack paths
- Kubernetes security
- Software supply chain attacks
- Adversary simulation
- Purple teaming
- Threat hunting
- AI-assisted offensive security

There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations.

They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security.

Blog:
https://t.co/HRO177M5lY

Free Tradecraft Academy:
https://t.co/5DIk2Mmtwi

Huge credit to the @SpecterOps team for publishing so much of this openly.

#RedTeam #ActiveDirectory #Infosec

[Panos Gkatziroulis 🦄 @ipurple]

Some additional strategic moves from @_CobaltStrike!

The @OutflankNL acquisition was a key step, and offering this course as a Cobalt Strike add-on is another indicator that, with sufficient customisation, Cobalt Strike remains effective in 2026.

A good reminder to everyone who claimed Cobalt Strike was dead because of signatures and detections.

[Abdul Mhanni @abdo_mhanni]

With PR 2325, you can now expand your ESC8 relay targets in impacket to include CES web enrollment endpoints 🚀

https://t.co/6yJcxWZHxG

[SEKTOR7 Institute @SEKTOR7net]

Carefully crafted LDAP tactics to stay under the AD detection radar.

A post by Baptiste Crépin.

Source: https://t.co/ORGbGNLUrC

#redteam #blueteam #offcoding

[Panos Gkatziroulis 🦄 @ipurple]

Index of all known BOFs https://t.co/cZHmDkkYbH #redteam

[Swissky @pentest_swissky]

Active Directory Attack Architecture Map v2.0
https://t.co/e7ldgRVBRJ