Lukas Klein | @rantasec.bsky.social retweeted
Microsoft Threat Intelligence has observed Storm-2945, a sub-cluster of Midnight Blizzard, compromising hospitality-related networks worldwide to steal credentials, access cloud environments, and deliver malware to travelers. msft.it/6010aBX6s
Since early May 2026, the threat actor has conducted widespread but targeted traffic manipulation attacks involving networks served by captive portals. In some cases, users were redirected through actor-controlled phishing infrastructure, while other activity led to the delivery of malware on impacted systems.
Microsoft assesses Storm-2945 to be an operational sub-cluster of Midnight Blizzard and details the malware, tradecraft, and cloud-focused techniques used throughout the campaign, including device code phishing and credential theft activity targeting travelers.
Get detections, mitigation, and hunting guidance from this Microsoft Threat Intelligence blog post.
Lukas Klein | @rantasec.bsky.social retweeted
I’m looking for a Security Researcher based in the US with hands-on experience in AD, Entra ID, and the ability to vibe code their way through solving problems. Strong communication skills and the willingness to take initiative is required for this role. ats.rippling.com/netwrix-cor…
Lukas Klein | @rantasec.bsky.social retweeted
Everything you need to know about OAuth applications in Azure by @shahardorf , @WEareTROOPERS & I 😀
youtube.com/watch?v=SkFbGwwG…
BTW - you can see how happy I look when i speak about the things I love 😌
Lukas Klein | @rantasec.bsky.social retweeted
I don't usually post about Active Directory but I'm doing this for @techspence 😂
This is officially from Microsoft.
Link below 👇
Lukas Klein | @rantasec.bsky.social retweeted
Why did I leave Microsoft?
To work full time on 🔥 Maester.
Over 40,000+ tenants today rely on Maester to monitor their tenants daily.
I wanted to make sure that the tests they are running continue to be relevant and evolve as Microsoft 365 and the security landscape evolves.
So today I'm announcing the launch of Maester.Cloud
Maester Cloud is the portal companion to Maester that lets you track your results over time. It is multi tenant, runs in your cloud (or ours) and more → check out the site for all the features.
More importantly Maester Cloud is a way for me to fund the continued development of the open source Maester core and the tests in Maester.
That is our mission. In fact I worked with the core team @fabian_bader , @Thomas_Live , @MySnozzberries and @SamErde to create the Maester Manifesto (maester.cloud/manifesto). It is our promise to the community.
If you value Maester and would like to support and ensure that Maester continues to grow and be healthy, I would be beyond thrilled if your organisation can sponsor this effort.
I would also appreciate it very much if you can share this post with your network to spread awareness.
Thanks!
Lukas Klein | @rantasec.bsky.social retweeted
I’m looking for a Junior/Medior Security Researcher with some experience in AD, Entra Id, and has played around with AI here and there. Locations: Poland, USA, or UK.
Lukas Klein | @rantasec.bsky.social retweeted
Replying to @shahardorf
@shahardorf & I found a phishing campaign abusing oauth applications in Entra in more than 50 organizations! And i promise you that in this blog we explain how you can do it too! And provide all the IOCs 🤭 It's one of these blogs i would enjoy reading!
wiz.io/blog/detecting-malici…
Lukas Klein | @rantasec.bsky.social retweeted
Nice write-up by Alexander Goedeke on using MAGIC, Timesketch and Jupyter for scalable Microsoft 365 BEC investigations
What I like most is the focus on repeatable workflows and automation instead of another “AI-powered DFIR” story
Getting the right data at scale is often the hardest part
securitylog.sva.de/2026/post…
Lukas Klein | @rantasec.bsky.social retweeted
We are releasing tracebit @x33fcon - a POC sensor aiming to fingerprint implants in memory using only lowlevel runtime telemetry. No signatures, no scanning. Only pagefaults.
github.com/threathunters-io/…
Lukas Klein | @rantasec.bsky.social retweeted
This is big 🔥🔥 techcommunity.microsoft.com/…
Lukas Klein | @rantasec.bsky.social retweeted
Who knew a really long string could make an Entra ID login disappear from the logs entirely? In our #blog, @nyxgeek breaks down how overflowing #Azure's sign-in logging mechanism allowed access tokens to be issued without a single log entry. Read it now! hubs.la/Q047xTVc0
Check out GoLinHound:
- Discovers Linux & SSH attack paths
- Outputs OpenGraph JSON for BloodHound ingestion
- Integrates with SharpHound and AzureHound data to unveil cross-technology attack paths
github.com/RantaSec/golinhou…
Lukas Klein | @rantasec.bsky.social retweeted
SpecterOps released "DumpGuard" along with a detailed article on how they were able to bypass Windows Credential Guard in both privileged and unprivileged contexts. I learned a ton about Isolated LSA and friends: specterops.io/blog/2025/10/2…
Lukas Klein | @rantasec.bsky.social retweeted
Fact: Remote service and scheduled task creation bypass firewalls on DCs and Win file servers because of SMB tunnelling.
Solution: Create RPC filters that block MS-SCMR and MS-TSCH over named pipes. The latter has 3 UUIDs, so blocking the atsvc pipe is more elegant. #DSInternals
Lukas Klein | @rantasec.bsky.social retweeted
Check out Titanis, my new C#-based protocol library! It features implementations of SMB and various Windows RPC protocols along with Kerberos and NTLM.
github.com/trustedsec/Titani…
Lukas Klein | @rantasec.bsky.social retweeted
The DSInternals.RpcFilters PowerShell module for Windows RPC filter management is out! Includes support for the new OpNum matching capability of Windows Server 2025. Looking forward to community feedback.
github.com/MichaelGrafnetter…
Lukas Klein | @rantasec.bsky.social retweeted
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
Lukas Klein | @rantasec.bsky.social retweeted
Can't kill sysmon.exe anymore? Cut it off from its own log by stopping ETW logger!
LocalSystem required, of course.
Lukas Klein | @rantasec.bsky.social retweeted
Check out @elad_shamir's recent blog post to learn more about NTLM relay attacks. ⬇️ ghst.ly/4lv3E31
Lukas Klein | @rantasec.bsky.social retweeted
Catch @IzySec's recent podcast discussing Rogue Remote Desktop Protocol: open.spotify.com/episode/5AG…



























