corpus.blog
43,659 blogs · 5,563,491 posts Claim your blog
Record · corpus.blog/posts/01a0876c-48c7-7397-8ce9-155207824ad4

Tear Down The Castle - Part 1

dfir.ch · published 19 January 2025

A record is what was published and who pointed at it. The text of the post is not held here: read it at the source, or at its Wayback capture.

Read the post at dfir.ch Wayback capture
0blogs citing
First cited
—
Most recent
—
Rank this month
not ranked
External links
19
Words captured
1,963

Cited by

No blog we hold has cited this post yet.

Links from this post

Link
Host
https://www.pingcastle.com/
pingcastle.com
https://posts.specterops.io/certified-pre-owned-d95910965cd2
posts.specterops.io
https://www.ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-misconfigured-certificate-template-to-domain-admin
ired.team
https://techcommunity.microsoft.com/t5/microsoft-security-experts-blog/total-identity-compromise-microsoft-incident-response-lessons-on/ba-p/3753391
techcommunity.microsoft.com
https://cloud.google.com/blog/topics/threat-intelligence/tracking-apt29-phishing-campaigns/?hl=en
cloud.google.com
https://www.splunk.com/en_us/blog/security/hunting-for-malicious-powershell-using-script-block-logging.html
splunk.com
https://github.com/search?q=repo%3Aelastic%2Fdetection-rules+powershell.file.script_block_text+language%3ATOML&type=code&l=TOML
github.com
https://github.com/Ascotbe/Kernelhub/blob/e55eb366bab445539ff16c63d3831ed4af91c92f/Windows/CVE-2021-42287/sam-the-admin/sam_the_admin.py
github.com
https://riskinsight-wavestone.com/en/2021/06/microsoft-adcs-abusing-pki-in-active-directory-environment/
riskinsight-wavestone.com
https://m365internals.com/2022/11/07/investigating-certificate-template-enrollment-attacks-adcs/
m365internals.com
https://blackhillsinfosec.com/abusing-active-directory-certificate-services-part-one/
blackhillsinfosec.com
https://services.google.com/fh/files/misc/active-directory-certificate-services-hardening-wp-en.pdf
services.google.com
https://github.com/jakehildreth/Locksmith
github.com
https://www.synacktiv.com/publications/a-dive-into-microsoft-defender-for-identity.html
synacktiv.com
https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/group-managed-service-accounts/group-managed-service-accounts/group-managed-service-accounts-overview
learn.microsoft.com
https://x.com/malmoeb/status/1627214815012716546
x.com
https://www.calcomsoftware.com/ensure-turn-on-powershell-script-block-logging-is-set-to-disabled/
calcomsoftware.com
https://blog.talosintelligence.com/talos-year-in-review-2022/
blog.talosintelligence.com
https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
exploit.ph
Elsewhere on dfir.ch (1)