DirectoryRanger
@DirectoryRanger
Followers
35K
Following
731
Media
386
Statuses
16K
This account assembles and disseminates information related to Active Directory and Windows security.
Joined December 2017
24/7 Active Directory Incident Response Contact: Tel. +49 (0) 6221 7569637 E-mail: incident-response@ernw.de
1
15
83
#TROOPERS25 AD & Entra ID Security track resources, on the @ERNW_ITSec blog @Insinuator Featuring @Jonas_B_K @martinhaller_IT @TEMP43487580 @JsQForKnowledge @fabian_bader @_dirkjan @ShitSecure @DrAzureAD @kazma_tw @subat0mik @unsigned_sh0rt @ericonidentity
https://t.co/dmbl9iZSPj
1
34
87
.@MCTTP_Con 2025 was a great event, thanks again @CyberWarship for so many things! Slides & transcript of my keynote can be found in this @Insinuator post: https://t.co/Wq0GQFDDWq
0
2
8
Ready to make your mark? At AEG, we turn ambition into action. Let’s bring your dreams to life. Join us
0
0
4
That's a very interesting new training from the fine folks of @ERNW_ITSec Research: https://t.co/5ZzFeGCIli
2
6
5
The #mcttp event is over and I am on my way home. Thanks again for having me this year again. Special thanks to @CyberWarship and Sonja for taking care of us during October fest. Truly amazing event and I finally got to meet @Enno_Insinuator and @DrAzureAD IRL. Also awesome to
1
4
23
Commonly Abused Administrative Utilities: A Hidden Risk to Enterprise Security, by @HobbsDale
https://t.co/onHGZAxw3h
blackhillsinfosec.com
Organizations tend to focus a significant amount of their efforts on external threats, such as phishing and ransomware, but they often overlook one of the most dangerous attack vectors on their...
0
9
38
Sliding into your DMs: Abusing Microsoft Teams for Malware Delivery https://t.co/pdQBNqHmcY
permiso.io
Malware delivery through Microsoft Teams is an emerging threat. Discover how attackers exploit external chats, which regions they target, and key IOCs defenders must track.
0
3
27
Malicious Encoded PowerShell: Detecting, Decoding & Modeling https://t.co/D2VJlJYizw
detect.fyi
The challenges and insights from dealing with this PS one-liner
0
22
86
Prefetch Files in Windows Forensics #DFIR
https://t.co/Rk5sdPEzhP
salvationdata.com
Discover how prefetch files provide crucial evidence in Windows forensics. Learn how they help investigators reconstruct user activity.
0
19
67
New post: Jigsaw RDPuzzle: Piecing Attacker Actions Together
0
13
31
Domain Admin shouldn’t logon to workstations. Here’s one way to restrict DA logins to workstations: Create a GPO… Computer Config → Windows Settings → Security Settings → Local Policies → User Rights Assignment → ‘Deny log on locally’ & ‘Deny log on through RDP’ → add
34
66
540
Active Directory Hardening Series Part 1 Disabling NTLMv1 https://t.co/9gla1vtQ18 Part 2 Removing SMBv1 https://t.co/KOqpamarcW Part 3 Enforcing LDAP Signing https://t.co/oW2Ymvu1ZW Part 4 Enforcing AES for Kerberos
techcommunity.microsoft.com
Disabling Kerberos RC4 is a top priority for many organizations today but identifying devices that don't support AES has been very challenging. In this...
3
165
695
Highly recommend everyone read the latest @MsftSecIntel blog, especially if you are involved in identity or cloud security. It details how threat actors can pivot between both your on-premises and cloud identity planes and cause destruction across both. Without proper guardrails
4
77
293
Fleet dashcams for commercial vehicles. Full integration with telematics for video exceptions, driver coaching and accident video. Live view. In &/or Out recording.
0
0
1
🚨 Microsoft admins, are your conditional access policies weak? 😱 @fabian_bader shares some common bypasses in our latest https://t.co/v0cFtrPykt podcast episode! 🔒 Dive into this thread for must-know insights to secure your tenant! 🧵👇 #Cybersecurity #MicrosoftEntra
2
36
163
The Windows Registry Adventure, contd., by @j00ru
#5: The regf file format https://t.co/rxLCJvSVxe
#6: Kernel-mode objects https://t.co/8Iir8GMuEt
#7: Attack surface analysis https://t.co/1Xj8GASqbq
#8: Practical exploitation of hive memory corruption
0
2
5
The Windows Registry Adventure, by @j00ru
#1: Introduction and research results https://t.co/sp1c4x5SA8
#2: A brief history of the feature https://t.co/Wt6YK9v2nn
#3: Learning resources https://t.co/tIte5saaOA
#4: Hives and the registry layout
2
31
114
Registry Hive #DFIR
https://t.co/cnWPAAMimg Data Types https://t.co/n0BLXidPBk DT cont. https://t.co/XHQ6jrkfLc DT 4 https://t.co/2WMfh3O1Zk DT 5 https://t.co/nwqogub4XP DT 6 https://t.co/RzO6DmJypl DT 7 https://t.co/PNOubac5dO DT 8
ogmini.github.io
A good reminder that we always, always need to test/verify. Looks like my assumption from a previous post about the identifier for each CompositeValue types was wrong! They do not ascend in order.
0
14
53