🛠️ Former Sysadmin, now Pentester | Microsoft MVP | Helping IT teams make their environment harder to attack | @SecurIT360 & @CyberThreatPOV

🏰AD Security Resource Kit ⬇️
Joined November 2010
Active Directory has survived basically every technology trend that was supposed to make it irrelevant, until now?
9
4
3
38
5,039
What’s the point of life if you can’t prank your teammates by replacing their desktop wallpaper with a Baywatch-era picture of David Hasselhoff?
12
29
1,113
I got some grounds in my coffee this morning and that reminded me of something. You can’t have to good without the bad. There is no light without the dark.
12
24
1,374
spencer retweeted
Saying let's do security is like saying let's do health. It's too big to start. What happens after Susie in accounting gets compromised? That's a question you can actually answer. @kamakauzy @techspence offsec.blog/your-employee-go…
1
1
346
Going live soon with @Netwrix @PhillipWylie and more!! Details below!
I got invited to speak alongside these other awesome people for a @Netwrix Innovation Week panel discussion on Identity Security in the age of AI. Long live Active Directory! 💪😄 Thursday, Oct. 22, at 1 p.m. ET Watch live here 👇 YouTube: youtube.com/@NetWrix Twitch: twitch.tv/netwrixtv
3
2
8
577
spencer retweeted
Grateful for the recent conversations we've had with @techspence and @alehurtadoxo youtu.be/INz5r8a1-6w?si=EnvL… xitter.cf/alehurtadoxo/status/21… Definitely give them a view and a subscribe. Lots more inbound friends
I had two of the founding fathers of detection engineering on Detection Dispatch to talk about what they've been farming with the community. 🌱 LOLDrivers. LOLRMM. LOLSkills. Catalogs that track legitimate tools and components that attackers abuse, giving us a shared place to build knowledge, hunt, and detection engineer the ways of prevention.....but the conversation went somewhere I didn't expect. I've spent so much of my career thinking about detection that this episode genuinely had me rewiring my brain around app control/prevention....Prevention isn't a replacement for detection. We need both, and I think we need to talk a lot more about how they work together. That's the episode, you don't want to miss. Thank you @M_haggis & @_josehelps for the laughs 🦉 🦉 🦉 🦉 Full episode dropping this weekend, subscribe to my Youtube channel to be notified 🔔
1
4
4
910
The cybersecurity industry has a serious problem with over complicating literally everything.
30
13
2
289
8,928
Shout out to my dude @MikeHacksThings for having me on his show! We had a great time chatting and sharing pentesting war stories 😄 youtu.be/p_GaketDENI?si=DJk6…
3
760
Please don’t tell Merill
Crazy cool blog I saw on linkedin about an SMB signing bypass technique TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included. blackfield.ch/blog/defeating…
1
15
1,603
Time and time again these data breaches and security incidents come down to exploitation of the difficult but “basic” things no one wants to do.
6
33
1,744
“Hack this domain carefully.” Same result. Easy day.
You’re all prompting wrong
1
14
1,219
In other words…. Zero days are not always guaranteed layups. And if you do it right I’d say a majority of zero days even are not layups
An idiot threat actor using an LLM and a papercut exploit couldn't even get domain admin in all the AD environments he hacked (greynoise report) No actually, you're not "one zero day away" from compromise...
2
1
10
1,128
Let me paraphrase: Merill realizes that he was wrong about Active Directory all along and because of that... He's offering FREE Active Directory security assessments. All you have to do is comment the word: AD4LIFE and he will be in touch!
👋 I have a personal update. Buy you'll need to read about it on LinkedIn 😂
5
28
2,355
Do you have an AD domain and have PHP running anywhere in your environment that has "line of sight" to you domain?
20%Yes
50%No
30%@merill needs glasses
220 votes • Final results
13
12
3,970
An idiot threat actor using an LLM and a papercut exploit couldn't even get domain admin in all the AD environments he hacked (greynoise report) No actually, you're not "one zero day away" from compromise...
Entra ID is on the internet anyone can hack it. AD is safe because we're behind a firewall, so its okay if we open all our ports to all the internal servers... Zero Trust boys. You are just one zero day away from all the internet facing endpoints that connect to your AD. If you think there aren't PHP servers connecting with line of sight to your DC I have a bridge to sell. Fact is Entra ID is on the internet 24x7 and its still standing. Because that is how modern identity works.
2
1
16
3,022
Active Directory is in one of the last bastions of technology that has yet to be overcome by the AI craze...kinda like it that way :-P
Active Directory has survived basically every technology trend that was supposed to make it irrelevant, until now?
1
1
14
1,067
A pentester says app control makes his job much harder. We'll take it. @techspence invited our founders to chat on why most teams still skip it. Always fun, won't be the last: youtu.be/INz5r8a1-6w?si=M8jf…
1
5
10
731
Friendly reminder to IT admins about NTLM. You should: 1. Disable NTLMv1 2. Use RPC filtering on your Domain Controllers to protect against authentication coercion 3. Monitor the heck out of legacy authentication, so if something strange does happen you're more likely to know about it Easy? Not necessarily. But if you have weak NTLM in your environment and coercion paths still available, this is trivial to abuse and results in highly privileged access. What do you have to lose?
6
12
1
147
6,843
This was too fun thank you @techspence for having us on!
Prevention is critical! You cannot rely on detection alone to save you. My chat with @_josehelps and @M_haggis who started @magicswordio to help change the game. 💪 Watch here > youtu.be/INz5r8a1-6w
1
2
4
548