This account assembles and disseminates information related to Active Directory and Windows security.
Joined December 2017
- Tweets17.2K
- Following108
- Followers37.3K
- Likes767
Pinned Tweet
24/7 Active Directory Incident Response Contact:
Tel. +49 (0) 6221 7569637
E-mail: [email protected]
DirectoryRanger retweeted
Starting on November 4th, Entra ID users will be able to create agent identity blueprints unless this capability is disabled. I strongly recommend you disable this capability so you don't have users creating agent identity blueprints.
There's a setting to turn this off in Entra ID under User Settings: "Users can register agent blueprints".
Switch it to "No" to prevent users from being able to do this.
Agent identity blueprints are templates that define identity configuration and credentials for AI agents. This is similar in capability to app registrations but for agent identities.
Allowing all users to create blueprints has similar risk to allowing all users to register applications (default is enabled as well). When a user creates an agent identity blueprint, they become the owner of it until removed. This provides full control access to the blueprint.
Agent ID Developer and Agent ID Administrator will still have the ability to create them.
More details here (including searching for existing blueprints):
lazyadmin.nl/office-365/micr…
DirectoryRanger retweeted
''GitHub - epersic/DLLParty: Demonstration of the DLL party process injection technique''
#infosec #pentest #redteam #blueteam
github.com/epersic/DLLParty/
DirectoryRanger retweeted
If you want to detection which devices in your estate have PHP installed and are exposed to the internet using #XDR use this KQL
CVE-2026-109618 & CVE-2026-109619
DirectoryRanger retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
DirectoryRanger retweeted
🦛🦛🦛Microsoft patched PetitPotam this October: EFSR now only resolves local paths. This means WebDAV to LDAP Coercion is fixed!
Remaining methods for clients are WSP (coercing SMB) and PrinterBug (coercing RPC), but both cannot be relayed to LDAP 💀💀💀
DirectoryRanger retweeted
Microsoft patched PetitPotam in their latest update, EFSRPC now validates shares locally, killing WebDAV coercion
💀
Added a check to NetExec’s enum_cve module to detect if a host already has the fix (CVE-2026-102217), so you can quickly spot what’s still exploitable 🔥
DirectoryRanger retweeted
Some cool content just added to the upcoming AI Security Summit:
static.ernw.de/summits/ai-se…
DirectoryRanger retweeted
Token Theft in Microsoft Entra ID, by @insinuator
Part 1: Threat Landscape and Attack Techniques insinuator.net/2026/08/token…
Part 2: Continuous Access Evaluation insinuator.net/2026/09/token…
Part 3: Token Protection insinuator.net/2026/10/token…
DirectoryRanger retweeted
BSI seziert Windows Hello: Wo Microsofts Anmeldung an Grenzen stößt
heise.de/news/BSI-seziert-Wi…
DirectoryRanger retweeted
Content updates have been applied to the AI Security Summit schedule.
You can find the up to date plan on static.ernw.de/summits/ai-se….
See you November 5!
DirectoryRanger retweeted
Have you ever wondered what the schema of nested fields like AdditionalFields, RawEventData, AuthenticationDetails is? There was no real docs until now
Based on real (lab) data I generated a breath of synthesized samples and schemas. Happy detection engineering #KQL #XDR #KUSTO
DirectoryRanger retweeted
Broadcom 802.11 SDK Detection Toolkit, from @qkaiser, after his Hexacon talk
github.com/qkaiser/broadcom-…
DirectoryRanger retweeted
I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today.
youtube.com/watch?v=Q36aL_HI…
DirectoryRanger retweeted
Powershell Mayhem Edition
PowerShell can be used for maximum disruption. It can wipe licenses, disable hardware and corrupt the Master Boot Record.
Restricted Language Mode is a must on workstations where users don’t need PowerShell in the first place.
In our article we showed why: hackers-arise.com/powershell…
@three_cube @_aircorridor
CloudKeyVaultEvents: Azure Key Vault Logs, Schema and KQL Hunting, by. @BertJanCyber #DFIR
kqlquery.com/posts/cloudkeyv…
Does DLL Side Loading work in 2026?
youtube.com/watch?v=szXFXvaX…
New version of @DidierStevens' onedump.py (to list files embedded inside OneNote files) #DFIR
github.com/DidierStevens/Bet…
Microsoft Defender for Cloud Apps Deep Dive
Part 1 Introduction. Securing the Cloud Era cyberboo.substack.com/p/micr…
Part 2 Cloud Discovery and Shadow IT cyberboo.substack.com/p/micr…
Part 3 - Connected Apps, SSPM and Sensitive Data cyberboo.substack.com/p/micr…
DirectoryRanger retweeted
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.
🧵1/4
Building a malware sandbox on Hyper-V: the problems nobody documents
threatlabsandbox.com/blog/ma…
