Joined July 2021
Lukas Klein | @rantasec.bsky.social retweeted
Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers. msft.it/6010aBX6s Since early May 2026, the threat actor has conducted widespread but targeted traffic manipulation attacks involving networks served by captive portals. In some cases, users were redirected through actor-controlled phishing infrastructure, while other activity led to the delivery of malware on impacted systems. Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and details the malware, tradecraft, and cloud-focused techniques used throughout the campaign, including device code phishing and credential theft activity targeting travelers. Get detections, mitigation, and hunting guidance from this Microsoft Threat Intelligence blog post.
6
68
10
167
110,976
Lukas Klein | @rantasec.bsky.social retweeted
I’m looking for a Security Researcher based in the US with hands-on experience in AD, Entra ID, and the ability to vibe code their way through solving problems. Strong communication skills and the willingness to take initiative is required for this role. ats.rippling.com/netwrix-cor…
2
13
1
34
10,555
Lukas Klein | @rantasec.bsky.social retweeted
Everything you need to know about OAuth applications in Azure by @shahardorf , @WEareTROOPERS & I 😀 youtube.com/watch?v=SkFbGwwG… BTW - you can see how happy I look when i speak about the things I love 😌
6
31
162
7,669
Lukas Klein | @rantasec.bsky.social retweeted
I don't usually post about Active Directory but I'm doing this for @techspence 😂 This is officially from Microsoft. Link below 👇
8
35
3
241
29,925
Lukas Klein | @rantasec.bsky.social retweeted
Why did I leave Microsoft? To work full time on 🔥 Maester. Over 40,000+ tenants today rely on Maester to monitor their tenants daily. I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves. So today I'm announcing the launch of Maester.Cloud Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features. More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester. That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community. If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort. I would also appreciate it very much if you can share this post with your network to spread awareness. Thanks!
40
157
17
584
64,104
Lukas Klein | @rantasec.bsky.social retweeted
I’m looking for a Junior/Medior Security Researcher with some experience in AD, Entra Id, and has played around with AI here and there. Locations: Poland, USA, or UK.
1
7
15
2,371
Lukas Klein | @rantasec.bsky.social retweeted
Replying to @shahardorf
@shahardorf & I found a phishing campaign abusing oauth applications in Entra in more than 50 organizations! And i promise you that in this blog we explain how you can do it too! And provide all the IOCs 🤭 It's one of these blogs i would enjoy reading! wiz.io/blog/detecting-malici…
8
51
1
186
25,934
Lukas Klein | @rantasec.bsky.social retweeted
Nice write-up by Alexander Goedeke on using MAGIC, Timesketch and Jupyter for scalable Microsoft 365 BEC investigations What I like most is the focus on repeatable workflows and automation instead of another “AI-powered DFIR” story Getting the right data at scale is often the hardest part securitylog.sva.de/2026/post…
28
129
13,785
Lukas Klein | @rantasec.bsky.social retweeted
Who knew a really long string could make an Entra ID login disappear from the logs entirely? In our #blog, @nyxgeek breaks down how overflowing #Azure's sign-in logging mechanism allowed access tokens to be issued without a single log entry. Read it now! hubs.la/Q047xTVc0
5
112
8
453
160,188
Lukas Klein | @rantasec.bsky.social retweeted
SpecterOps released "DumpGuard" along with a detailed article on how they were able to bypass Windows Credential Guard in both privileged and unprivileged contexts. I learned a ton about Isolated LSA and friends: specterops.io/blog/2025/10/2…
2
60
216
12,894
Lukas Klein | @rantasec.bsky.social retweeted
Fact: Remote service and scheduled task creation bypass firewalls on DCs and Win file servers because of SMB tunnelling. Solution: Create RPC filters that block MS-SCMR and MS-TSCH over named pipes. The latter has 3 UUIDs, so blocking the atsvc pipe is more elegant. #DSInternals
1
35
2
191
14,231
Lukas Klein | @rantasec.bsky.social retweeted
Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM. github.com/trustedsec/Titani…
14
182
17
544
92,884
Lukas Klein | @rantasec.bsky.social retweeted
The DSInternals.RpcFilters PowerShell module for Windows RPC filter management is out! Includes support for the new OpNum matching capability of Windows Server 2025. Looking forward to community feedback. github.com/MichaelGrafnetter…
2
3
18
1,316
Lukas Klein | @rantasec.bsky.social retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
138
899
112
3,174
481,822
Lukas Klein | @rantasec.bsky.social retweeted
Can't kill sysmon.exe anymore? Cut it off from its own log by stopping ETW logger! LocalSystem required, of course.
2
17
97
7,549
Lukas Klein | @rantasec.bsky.social retweeted
Check out @elad_shamir's recent blog post to learn more about NTLM relay attacks. ⬇️ ghst.ly/4lv3E31
6
6
1,698