Every mature blue team eventually builds detection for SharpHound. The LDAP-sweep signature is well-understood: a single source account issuing hundreds of q...
SCEP is the protocol that quietly issues a large share of the certificates on a modern network. Every MDM-enrolled phone, every Intune or Jamf device, and ev...
The Certificate Enrollment Web Service (CES) forwards a SAN AdditionalContext ContextItem to the CA as a SAN request attribute. Where EDITF_ATTRIBUTESUBJECTA...
Why U2U, and why the acceptor side
Everyone who studies Kerberos authorization studies the PAC. It is where the group memberships live, it is what the KDC signs, and it is what a decade of del...
Executive Summary
The gap LocalKDC fills
Why baseline before Windows
The gap IAKerb fills
This box is rated hard difficulty on HTB. It involves us using given credentials to attack a linked MSSQL server, enabling xp_cmdshell to grant command execu...