The periodic table of Windows event IDs. #ThreatHunting #DFIR

Going to release two new tools next week that will be showcased at Blackhat Arsenal USA 2025 and Defcon 33 Demo Labs 😃 1️⃣ EntraGoat - a deliberately vulnerable Entra ID environment - Built together with Jonathan Elkabas. 2️⃣ SAMLSmith - Built together with @ericonidentity

Today, together with Jonathan Elkabas, we're releasing EntraGoat - A Deliberately Vulnerable Entra ID Environment. Your own hands-on Entra lab for identity attack simulation. Built for red teams, blue teams and identity nerds. Check it out here👉 https://t.co/5qlXQiSYHS

I'm SO hyped to finally make MSSQLHound public! It's a new BloodHound collector that adds 37 new edges and 7 new nodes for MSSQL attack paths using the new OpenGraph feature for 8.0!. Let me know what you find with it! - https://t.co/Hh089SaVOS - https://t.co/geO0HXTykf

Golden dMSA: One key to rule them all Just found a new flaw in Windows Server 2025's dMSAs that lets attackers brute-force ALL managed service account passwords with 1024 attempts. This research builds on the awesome research Golden gMSA (@YuG0rd ). https://t.co/Y50240xgw5