Practical writing from real IR work — proactive hardening, reactive response, and everything in between. No vendor angles, no theoretical frameworks.
Microsoft is retiring Entra's built-in SMS and voice authentication and auto-enabling passkeys. The timeline, what the system-managed passkey profile and unlimited snoozes mean in practice, and the steps I'd take now.
In October 2026 a stolen ConnectWise Cloud Backup (SkyKick) credential reached hundreds of Microsoft 365 tenants. My analysis from the identity side: why MFA, Conditional Access and GDAP didn't help, the Graph app permissions that make a vendor app Global Admin, and how to find them in your tenant.
New edges and Edge Filtering sections, pathfinding that follows every edge in the database, Tier Zero icon fixes, a federated identity credential panel and fixed documentation links.
Restricting access to the Microsoft Entra admin center doesn't stop standard users enumerating your directory. What the toggle really does, and the Conditional Access and app controls that actually close the gap.
I forked BloodHound Legacy 4.3.1 so it reads BloodHound CE data - ADCS objects, local groups, new attack-path edges and Tier Zero markers - keeping large environments readable.
Golden Ticket and Silver Ticket attacks are still effective because attackers exploit misconfigurations, not vulnerabilities. Learn how these Kerberos forgeries work and how to detect them.
Pass-the-Hash still works in 2026 because NTLM is still enabled by default. Here's how to disable it and stop lateral movement attacks.
Built-in AD mechanisms designed to protect privileged accounts - routinely misconfigured, occasionally abused, and almost always misunderstood.
AD Connect sync, Pass-Through Authentication, seamless SSO - each one is a bridge that can be crossed the wrong way. Most defenders don't know they exist until an incident reveals them.
Kerberoasting exploits TGS ticket requests for SPN accounts. Learn how attackers crack service account passwords offline and what you can do to stop it.
Three tiers, a Control Plane, and real organizational friction. How to implement EAM in an enterprise that wasn't designed for it - the Tier 0 assets people miss, the things that break, and why it's worth doing anyway.
How to run BloodHound proactively, write Cypher queries that surface real risk, and turn graph data into a remediation backlog your team can actually work through.
Threat actor eviction from Active Directory is one of the hardest IR problems. The decisions made in the first 48 hours determine whether you succeed - or give the attacker a way back.
4624, 4768, 4769, 4771, 4776 - and about a dozen others. A practical guide to the Windows event logs that reveal Kerberoasting, AS-REP roasting, lateral movement, and DCSync in progress.
A walk-through of a real intrusion pattern - credential theft, lateral movement, Kerberoasting, and DCSync. Sanitized, but this is what it actually looks like from the IR side.
Privileged access management without the enterprise price tag. What actually works, in plain terms, with implementation notes from real deployments.
Conditional Access is powerful and frequently misconfigured. The policies worth enabling, the gaps that leave accounts exposed, and how to test without locking yourself out.
No posts match that filter.