cog retweeted
10 years ago today CAPE Sandbox was released...
Today we are proud to announce its desktop partner-project CAPEsolo: github.com/CAPESandbox/CAPEs… 🎉
All the power of the sandbox in a desktop application 💪
pip install capesolo
cog retweeted
My story of recovering cleared RDP logs from a completely unrelated EVTX file: dfir.ru/2026/01/26/windows-e… #DFIR
1> meet Jason, he works in cyber security
2> oh Kool, my clients don't care about security
Me: lol yea that's how it starts
Tell someone they put the artificial in intelligence and watch them take a second to process the burn
cog retweeted
👋 How do you find all the global admins in an M365 tenant?
You are going to want to bookmark this 💀
✍️ Answer
If you use the portal it's easy (just go to the Roles blade)
But if you need to use the API (take a deep breath 👇)
1️⃣ Check the license on the tenant
2️⃣ In an Entra ID Free or P1 tenant
→ /roleAssignments
3️⃣ In Entra ID Premium tenants
3️⃣•1️⃣ Get all PIM Eligible global admins
→ /roleEligibilityScheduleInstances
3️⃣•2️⃣ Get all PIM Permanently Active users and use assignmentType = Assigned to filter out 'Eligible' users that are currently activated.
→ /roleAssignmentScheduleInstances
4️⃣ If any of these are groups, then iterate through the group to get all members inside the group
We use this frequently in Maester for finding privileged users.
Full code at github.com/maester365/maeste…
Or you can simply use this in your scripts 👇
🔥 Install-Module Maester -AllowPrerelease
🌟 Get-MtRoleMember -Role GlobalAdministrator
ALT Illustration showing how to get all the global admins in a tenant.
The most concise definition of cybersecurity is the following:
Cybersecurity is a thing nerds do with computers.
cog retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
cog retweeted
A lightweight tool that injects a custom assembly proxy into a target process to silently bypass ETW scanning by redirecting ETW calls to custom proxy github.com/EvilBytecode/Ebyt…
cog retweeted
Microsoft has released security updates that fully protect customers using SharePoint Subscription Edition and SharePoint 2019 against the risks posed by CVE-2025-53770, and CVE-2025-53771. These vulnerabilities apply to on-premises SharePoint Servers only. Customers should apply these updates immediately to ensure they’re protected.
We are actively working on updates for SharePoint 2016.
Full guidance and detection details are available in our blog: msft.it/6010sDzSE
cog retweeted
Microsoft is aware of active attacks targeting on-premises SharePoint Server customers, exploiting a variant of CVE-2025-49706. This vulnerability has been assigned CVE-2025-53770.
We have outlined mitigations and detections in our blog. Our team is working urgently to release a security update and will share more details as they become available. Read the full guidance in our blog: msft.it/6013s8oCc
cog retweeted
The domain Kerberos service account, KRBTGT (adsecurity.org/?p=483), is an important account since it is used to sign & encrypt Kerberos tickets. The account is disabled and the password doesn't change except when moving from Windows 2000/2003 to Windows Server 2008 (or newer).
This is a highly privileged account and if an attacker can gain knowledge of the account's password hash (or password), they can create forged Kerberos tickets (aka Golden Tickets: adsecurity.org/?p=1640).
Most AD forests have this account lingering with old passwords. The KRBTGT account stores two passwords, the current one and the previous one and checks them both to validate Kerberos tickets. This means that to ensure that the KRBTGT passwords are fully changed, the password must be changed twice. If an attacker can capture a DC backup that is as old as one of the KRBTGT account passwords (say 15 years), then they can compromise the environment even if the backup is 15 years old!
We can use the "msds-keyversionnumber" attribute to determine how many times the KRBTGT password has changed. The formula n - 2 works to calculate how many times the password has changed. If this value is 2 it hasn't changed since it was originally set when the domain was created. If the value is 9, then it has changed 7 times (9 - 2 = 7).
Sometimes this value is very large, like 100003. In that case we just use the last digit (3) to calculate the number of times it has changed: n - 2 = 1, so it has changed 1x.
We recommend changing the password once, then waiting at least a week, and then changing the password again. When you set the password, a process on the DC actually changes the KRBTGT password to a fully random password.
PowerShell code to report on the KRBTGT account for the current domain:
$DomainKRBTGTAccount = Get-ADUser 'krbtgt' -Server $DomainDC -Properties DistinguishedName,'msds-keyversionnumber',Created,PasswordLastSet
$DomainKRBTGTAccount | Select DistinguishedName,Created,PasswordLastSet,'msds-keyversionnumber' | Format-Table -AutoSize
#ActiveDirectorySecurityTip
