DirectoryRanger (@DirectoryRanger) header
DirectoryRanger (@DirectoryRanger) profile picture

DirectoryRanger

@DirectoryRanger

This account assembles and disseminates information related to Active Directory and Windows security.

ernw.de
Joined December 2017
  • Tweets17.2K
  • Following109
  • Followers37.4K
434Media
Photo by DirectoryRanger (@DirectoryRanger)Photo by DirectoryRanger (@DirectoryRanger)Photo by DirectoryRanger (@DirectoryRanger)Photo by DirectoryRanger (@DirectoryRanger)Photo by DirectoryRanger (@DirectoryRanger)Photo by DirectoryRanger (@DirectoryRanger)
24/7 Active Directory Incident Response Contact: Tel. +49 (0) 6221 7569637 E-mail: [email protected]
2
25
1
136
103,701
DirectoryRanger retweeted
Enno Rey (@Enno_Insinuator) profile picture
Enno Rey@Enno_InsinuatorOct 25
Upcoming Incident Analysis Trainings (Basic & Advanced) by @ERNW_ITSec hm-ts.de/seminare/courses/in…
Image from Enno Rey (@Enno_Insinuator)
1
3
22
2,068
Replying to @_dirkjan @DirectoryRanger
Welcome to the club! I don’t need any AI to achieve the same results, but that’s what VM snapshots are for.
1
1
1,238
DirectoryRanger retweeted
SpecterOps (@SpecterOps) profile picture
SpecterOps@SpecterOpsOct 23
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇 ghst.ly/3VSdm7h
Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication

Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication

An LDAP signing bypass let attackers relay NTLM to domain controllers even with signing required. Why the October 2026 patch matters.

specterops.io
Raj Patel (@GrayHatKiller) profile pictureRaj Patel@GrayHatKillerOct 23
1/2 LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced. Patched in October. Blog: specterops.io/blog/2026/10/2… PoC: github.com/grayhatkiller/swi…
Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication

Signed, Sealed, and Relayed, NTLM-style: Bypassing LDAP Signing Through Reauthentication

An LDAP signing bypass let attackers relay NTLM to domain controllers even with signing required. Why the October 2026 patch matters.

specterops.io
57
1
182
11,732
DirectoryRanger retweeted
Peter Gabaldon (@PedroGabaldon) profile picture
Peter Gabaldon@PedroGabaldonOct 24
I've just implemented Administrators group's WRITE_DAC permission abuse technique in my custom Windows SAM dumper github.com/PeterGabaldon/Wha…
Image from Peter Gabaldon (@PedroGabaldon)
1
18
80
4,423
DirectoryRanger retweeted
Dirk-jan (@_dirkjan) profile picture
Dirk-jan
@_dirkjanOct 25
Current research status
Image from Dirk-jan (@_dirkjan)
17
79
3
1,579
31,066
DirectoryRanger retweeted
🕳 (@sekurlsa_pw) profile picture
🕳@sekurlsa_pwOct 24
xbz0n.sh/blog/adcs-complete-… In GOAD
Breaking ADCS: ESC1 to ESC16 Attack Techniques

Breaking ADCS: ESC1 to ESC16 Attack Techniques

Let's talk about Active Directory Certificate Services. If you've been doing red team work for any length of time, you've probably heard about ADCS attacks. ...

xbz0n.sh
20
98
4,360
DirectoryRanger retweeted
Fabian Bader (@fabian_bader) profile picture
Fabian Bader@fabian_baderOct 24
Replying to @jonoberheide
Why not just use a "virtual" passkey approach where you intercept the Javascript and then use some code to circumvent UV altogether. For Entra ID I build this into github.com/f-bader/TokenTact…
GitHub - f-bader/TokenTacticsV2: A fork of the great TokenTactics with support for CAE and token...

GitHub - f-bader/TokenTacticsV2: A fork of the great TokenTactics with support for CAE and token...

A fork of the great TokenTactics with support for CAE and token endpoint v2 - f-bader/TokenTacticsV2

github.com
1
5
1
28
3,999
DirectoryRanger retweeted
Enno Rey (@Enno_Insinuator) profile picture
Enno Rey@Enno_InsinuatorOct 22
BSI seziert Windows Hello: Wo Microsofts Anmeldung an Grenzen stößt heise.de/news/BSI-seziert-Wi…
BSI seziert Windows Hello: Wo Microsofts Anmeldung an Grenzen stößt

BSI seziert Windows Hello: Wo Microsofts Anmeldung an Grenzen stößt

Das BSI hat Windows Hello for Business analysiert und Schwächen bei der biometrischen Anmeldung aufgedeckt – besonders ohne Enhanced Sign-in Security.

heise.de
3
5
1,475
24/7 Active Directory Incident Response Contact: Tel. +49 (0) 6221 7569637 E-mail: [email protected]
2
25
1
136
103,701
DirectoryRanger retweeted
RedTeam Pentesting (@RedTeamPT) profile picture
RedTeam Pentesting@RedTeamPTSep 21
🚨 Rocket Remote Desktop encrypts users' saved credentials with their Windows SIDs. Every user with access to a Windows client on which the client software is installed has access to the database, where these credentials are saved. No fix available yet. redteam-pentesting.de/en/adv…
RedTeam Pentesting - Insecure Storage and Weak Encryption of Credentials in Rocket Remote Desktop

RedTeam Pentesting - Insecure Storage and Weak Encryption of Credentials in Rocket Remote Desktop

Attackers with access to a computer with Rocket Remote Desktop can read the credentials of the global database. With these credentials, they can view and decrypt the saved credentials of all users...

redteam-pentesting.de
1
22
65
6,037
DirectoryRanger retweeted
DirectoryRanger (@DirectoryRanger) profile picture
DirectoryRanger@DirectoryRangerOct 5
Token Theft in Microsoft Entra ID (Part 3 of 4): Token Protection insinuator.net/2026/10/token…
1
5
19
2,697
Field Notes: Reconstructing an Attacker’s Workflow, by @malmoeb #DFIR dfir.ch/posts/field_note_att…

Field Notes: Reconstructing an Attacker’s Workflow

Introduction During a recent incident, we recovered several PowerShell scripts the attacker had left behind on disk. Instead of reconstructing every action from individual event log entries, file-s...

dfir.ch
1
11
1,532
ripgrep as a lolbin hexacorn.com/blog/2026/10/25…
1
6
1,241
Hunting the Invisible Trust Boundary: Detecting Third-Party OAuth App Abuse in Microsoft Entra ID mitiga.io/blog/connectwise-b…
Hunting Third-Party App Abuse in Entra

Hunting Third-Party App Abuse in Entra

Stolen ConnectWise app credentials gave attackers app-only access to Microsoft 365. A six-part method for hunting third-party app abuse in Entra ID.

mitiga.io
2
14
58
3,645
Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In. ridgelinecyber.com/blog/brea…
Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In.

Your Break-Glass Account Is Excluded From Every Policy. It Still May Not Get You In.

Excluding emergency access accounts from Conditional Access doesn't exempt them from Microsoft's mandatory MFA. Check the method, the exclusions and the alert.

ridgelinecyber.com
10
36
2,623
The AD Forest As A Security Boundary And the Impact of Trusts on That Security Boundary – The Revisited Still (In)Secure Sequel, by @JsQForKnowledge jorgequestforknowledge.wordp…
(2026-07-09) The AD Forest As A Security Boundary And The Impact Of Trusts On That Security Bound...

(2026-07-09) The AD Forest As A Security Boundary And The Impact Of Trusts On That Security Bound...

Unidirectional forest or external trust are unfortunately still vulnerable in W2K25 DCs/Domains. Read here what to do!

jorgequestforknowledge.wordpress.com
8
1
35
1,949
Windows Rootkits and Bootkits Guide, by @artem_i_baranov github.com/ArtemBaranov/Wind…
WindowsRootkitsGuide/rootkits_bootkits_v2_1.pdf at main · ArtemBaranov/WindowsRootkitsGuide

WindowsRootkitsGuide/rootkits_bootkits_v2_1.pdf at main · ArtemBaranov/WindowsRootkitsGuide

Contribute to ArtemBaranov/WindowsRootkitsGuide development by creating an account on GitHub.

github.com
1
21
109
4,297
Investigating WMI Permanent Event Subscription Persistence #DFIR forensicfocus.com/articles/i…
Investigating WMI Permanent Event Subscription Persistence - Forensic Focus

Investigating WMI Permanent Event Subscription Persistence - Forensic Focus

Vitalii offers a hands-on DFIR deep dive into WMI ActiveScriptEventConsumer persistence, from registration and execution to memory artifacts, Sigma detection, and cleanup.

forensicfocus.com
11
55
3,099
DirectoryRanger retweeted
DirectoryRanger (@DirectoryRanger) profile picture
DirectoryRanger@DirectoryRangerOct 17
Token Theft in Microsoft Entra ID, by @insinuator Part 1: Threat Landscape and Attack Techniques insinuator.net/2026/08/token… Part 2: Continuous Access Evaluation insinuator.net/2026/09/token… Part 3: Token Protection insinuator.net/2026/10/token…
2
35
121
8,275
DirectoryRanger retweeted
Florian Hansemann (@CyberWarship) profile picture
Florian Hansemann@CyberWarshipOct 24
''EDR Evasion: Process Injection Without WriteProcessMemory'' #infosec #pentest #redteam #blueteam zerosalarium.com/2026/09/edr…
EDR Evasion: Process Injection Without WriteProcessMemory

EDR Evasion: Process Injection Without WriteProcessMemory

Technique performs Windows process code injection by leveraging a Windows named pipe, it does not use VirtualAllocEx and WriteProcessMemory

zerosalarium.com
6
72
344
15,574
Load more