DirectoryRanger

24/7 Active Directory Incident Response Contact: Tel. +49 (0) 6221 7569637 E-mail: incident-response@ernw.de

TROOPERS26: Integrating Incident Analysis and Digital Forensics Tooling for Automated Compromise Detection, via @Insinuator insinuator.net/2026/06/troope…

Microsoft Defender for Office 365 (8) Threat Explorer & Real-Time Detection cyberboo.substack.com/p/microsoft-de… (9) Automated Investigation & Response (AIR) cyberboo.substack.com/p/microsoft-de… (10) Attack Simulation Training cyberboo.substack.com/p/microsoft-de… (11) SecOps Guide -IR with MDO cyberboo.substack.com/p/microsoft-de…

Improving Your Simple Windows Domain for Offensive Testing: Elastic Defend EDR redsiege.com/blog/2026/07/i…

Microsoft-Analyzer-Suite. collection of PowerShell scripts for analyzing data from Microsoft 365 and Microsoft Entra ID github.com/LETHAL-FORENSI…

SharePoint Is on Fire Again: What CISA's CVE-2026-45659 Warning Means, and How to Hunt It threathunter.ai/blog/sharepoin…

WDAC / AppLocker Bypass Recon Scripts gist.github.com/AlloySecureGro…

Railway. LSHIY. Different Auth Flows, but the Same Lesson We Keep Skipping huntress.com/blog/condition…

From Windows Telemetry to Arrest: How Microsoft’s GDID Helped Connect the Dots darkatlas.io/blog/from-wind…

Full writeup of the Windows GDID Global Device Identifier fully reverse engineered github.com/SmtimesIWndr/g…

Excited to share our research on Process Parameter Poisoning with Max Hirschberger! We detail a novel process injection technique using parameters as an attack surface & released ⁠p3-loader⁠ (PoC). sensepost.com/blog/2026/proc… github.com/Orange-Cyberde… #Malware #WindowsIntetnals

Decided to put my money where my mouth is. We built a thing. Give it a go. github.com/AlloySecureGro…

Windows Rootkits and Bootkits Guide, by @artem_i_baranov github.com/ArtemBaranov/W…

Abusing Printers to Compromise Active Directory In many organizations, sysadmins are only focused on servers and workstations. But printers sit on the same network. They are rarely monitored with the same level of attention as more "important" systems. Many of those printers store AD user credentials which can be extracted in plaintext to attack the DC. Even if the AD is well secured, these creds can be used to poison shares with LNK files. Even print jobs themselves can become a target especially when they contain confidential information. Unfortunaly, many of the IoT devices in the corporate environments are outdated and aren't taken seriously. We also mentioned how you can fix that. hackers-arise.com/iot-hacking-ab… @three_cube @_aircorridor #iot #pentesting

Entra ID User App Config Abuse cyberdom.blog/entra-id-user-…

The AD Forest As A Security Boundary And the Impact of Trusts on That Security Boundary – The Revisited Still (In)Secure Sequel, by @JsQForKnowledge jorgequestforknowledge.wordpress.com/2026/07/09/the…

Time for KDS Root keys secrets by @MGrafnetter at @WEareTROOPERS

Identity round table at @WEareTROOPERS with @kfosaaen @sapirxfed @Thomas_Live @DrAzureAD @ericonidentity @4ndr3w6S @JsQForKnowledge @thomas_elling

Windows Privilege Escalation 01: Initial Enumeration niklas-heringer.com/penetration-te… 02: Running through PrivEsc Paths from Zero niklas-heringer.com/skills-lab/win…

RID-500 is AD's best break-glass account... and you should disable it!🙃 @JsQForKnowledge shared counterintuitive wisdom at #TROOPERS26 - All-powerful and cannot get locked out. - Disabled = more secure. - Disabled bypassed when booting in Safe Mode With Networking. Sources in🧵

I have no idea how to summarize these crazy 3 days, I think this picture says everything. until next time @WEareTROOPERS 🥂