How pass the ticket 🎫 with constrained delegation works.

#ThreatHunting #DFIR

How unconstrained delegation 🎫 is abused to escalate privileges.

#ThreatHunting #DFIR

How attackers steal Primary Refresh Tokens and access cloud resources.

#ThreatHunting #DFIR #EntraID #AzureAD

How the #XZUtils SSHD backdoor works.

#ThreatHunting #DFIR #xzbackdoor

Based on Anthony Weems POC

How the silver ticket attack works 🎫

#ThreatHunting #DFIR

⚡New Defender module on ACEResponder.com!

Have you ever wondered how to get the most out of BloodHound as a defender? Learn to turn AD chaos into opportunities with Cypher queries.

#ThreatHunting #DFIR #ActiveDirectory

aceresponder.com/learn/bloodhou…

💎How the diamond ticket attack works.

#ThreatHunting #DFIR

The Windows startup process sequence.

#ThreatHunting #DFIR

Animated attack path for the Midnight Blizzard (Nobelium) attack against #Microsoft corp environment.

#ThreatHunting #DFIR #AzureAD #EntraID

📢 New Analyst module on ACEResponder!

Investigating Entra ID Attacks

#Azure #ThreatHunting #DFIR

aceresponder.com/learn/entra-id

Windows lateral movement via RPC.

#ThreatHunting #DFIR

How I discovered a pre-auth XSS vulnerability in NorthStar C2 (CVE-2024-28741) allowing an attacker to execute commands on NorthStar C2 agents
Thank you ACE Responder and ocdsec for the inspiration
blog.chebuya.com/posts/discover…
github.com/chebuya/CVE-20…

How Azure device code phishing works.

#ThreatHunting #DFIR

Some Windows Event IDs and how they help defenders.

#ThreatHunting #DFIR

How the Illicit Consent Grant attack works.

#ThreatHunting #DFIR

How the PetitPotam 🦛 attack is used to take over domain controllers.

#ThreatHunting #DFIR

📢 New Challenge: Locked Up

Your domain is infected with ransomware. Take on a unique attack path in this beginner-friendly challenge.

#ThreatHunting #DFIR

aceresponder.com/challenge/lock…

How WMI lateral movement works 🖥️⚡️🖥️

#ThreatHunting #DFIR

Our ROTJ exploit is still in the running for taking down LockBit. 🤞

aceresponder.com/blog/exploitin…