Security Researcher @ Netwrix. Spec Ops Army Vet, Ham Extra (satellites, sdr, dmr), Team Purple, Wireless Wizard, Creator of Identity Security Village
United States
Joined May 2020
- Tweets437
- Following457
- Followers516
- Likes1.1K
I break Windows.... retweeted
A proud moment for the Netwrix team.
Netwrix PingCastle has been referenced in a recently published joint Five Eyes cybersecurity advisory on detecting and mitigating Active Directory compromises — recognized as a tool defenders can use to assess and strengthen their AD security posture.
Active Directory remains one of the most targeted parts of enterprise infrastructure, and we’re honored to see PingCastle acknowledged as part of the broader defensive toolkit available to organizations worldwide.
A huge thank you to the cybersecurity community and to every defender who has trusted Newtrix PingCastle over the years.
We’ll keep building tools that help blue teams stay ahead.
Learn more about PingCastle: netwrix.com/en/products/ping…
#CyberSecurity #ActiveDirectory #PingCastle #InfoSec #BlueTeam
I break Windows.... retweeted
I'm so excited to @hthackers 2026 and the Spaceballs theme! Ticket up today and I'll see you there! ❤️🤘
Hackers Teaching Hackers Conference 2026
June 3-5 | Columbus, OH
Tickets On Sale: $275
Villages. Talks. Networking. Hacking.
2026.hthackers.com/
#HTH2026
I break Windows.... retweeted
⚠️ Hackers Can Attack Active Directory Sites to Escalate Privileges and Domain Compromise | Read more: cybersecuritynews.com/active…
Active Directory sites are designed to optimize network performance across geographically separated organizations by managing replication and authentication across multiple locations.
The vulnerability emerges because Active Directory sites can be linked to Group Policy Objects (GPOs), which control system configurations across an organization.
When attackers gain write permissions to sites or their associated GPOs, they can inject malicious configurations that compromise all computers connected to those sites, including domain controllers.
#cybersecuritynews #windows
I break Windows.... retweeted
New #AADInternals version is finally out now:
▪ Moved endpoint related stuff to new module: AADInternals-Endpoints
▪ Added blue team stuff: Get app consent info, find backdoors, convert SID<>Entra ID Object ID, find abusable dynamic groups
▪ Added red team stuff: Get ESTSAUTH cookies, export Intune certificate, invoke PS scripts as system or other users
See full change log at: aadinternals.com/aadinternal…
I break Windows.... retweeted
Do you allow your high privileged users in Entra ID (e.g. Global Admin) to register authentication methods themselves after initial setup?
Do you, to detect malicious actions, monitor the addition of e.g. passkeys and follow up with the user?
I break Windows.... retweeted
When it comes to Active Directory Security Descriptors, ignorance is NOT bliss...
it can be a full-on SLASHER FLICK of misconfigurations 🔪
This Thursday, @JimSycurity shares insights we've learned across thousands of AD & Entra ID security assessments -- Tips that can arm you to be the "sole survivor" archetype in the horror movie of securing Active Directory environments.
(After all, nobody wants to be that sacrificial lamb who yells, "I'll be right back!" before heading into the wine cellar)
🎃 The Gooey Guts of Security Descriptors: Securable Objects, All the Way Down
Thursday, October 24th @ 11 am PT / 2 pm ET
Register at bit.ly/DescriptorInnards
ALT Image shows the Trimarc logo and a headshot of Jim Sykora, Trimarc Senior Security Consultant. Text reads: Trimarc Webcast. he Gooey Guts of Security Descriptors: Securable Objects, All the Way Down Thursday, October 24th @ 11 am PT / 2 pm ET Register at https://bit.ly/DescriptorInnards
I break Windows.... retweeted
Slides from my @MCTTP_Con talk "A Decade of Active Directory Attacks - What We've Learned & What's Next" are now posted: trimarc.co/SeanTalkMCTTP2024
I break Windows.... retweeted
If you have VMware ESXi and Active Directory in your environment, take 5 minutes now & create a group in each AD domain called "ESX Admins".
Make sure that the "ESX Admins" group is in a top-level administrative OU that only your AD admins manage.
#QuickFix
In today's WTF?!?!? moment
When a ESXi server is domain-joined, it assumes any "ESX Admins" group & its members should have full admin rights.
So.... anyone who can create & manage a group in AD, can get full admin rights to the VMware ESX hypervisors!
microsoft.com/en-us/security…
I break Windows.... retweeted
Hacker Summer Camp is just a couple weeks away & the Trimarc crew will be there!
Trimarc Activities:
* Office Hours (me)
* Lightning Talks (@TechBrandon & me)
* Microsoft Identity security Meet-up
Want to join us?
Signup here: trimarcsecurity.com/vegas-sh…
*limited availability
I break Windows.... retweeted
One thing we highlight with customers during assessments are agents installed on DCs. I’ve seen a poorly configured Tanium query hang every DC - effectively a DoS since AD doesn’t work if you can’t talk to a DC.
It’s time to talk about what agents are on DCs & the risks
1) scenario 1 - devices affected did not have BitLocker and you could delete/rename the sys file.
2) scenario 2 - devices had BitLocker enabled and used an on-premises domain storage - your DC needed recovering first (hopefully you could boot that!)
3) scenario 3 your servers were not bitlockered (common) and keys were held in Intune
4) scenario 4 - your recovery keys are not centrally stored and you can't find them (cry)
and obviously many other combinations....
Honestly... and it depends but for general purpose business do you actually want Full Disk Encryption on your servers?
let's say they are on a SAN.... in a building... with lots of physical access controls... you might say: actually I'm ok with not having FDE on VMs
(you might not)
either way... whenever a fix involves SAFE mode or mounting a disk from another VM/server - you know when it's more than one or two devices it's a BAD day!
I really do feel for everyone that's responding.
I was honestly glad that I had a [REDACTED] cyber incident I'm working on vs having to deal with this....
Hugs to all responders! #CrowdStrike #BSOD #Hell
I break Windows.... retweeted
Tomorrow is a VERY big day here at Trimarc. First we slide into Grand Rapids to sponsor @GrrCON. Say hello to @PyroTek3 & @DFIRdeferred @ our booth.
AND
@TechBrandon’s webcast, Top 5 AD Assessment Findings 2pm ET. Register here!
attendee.gotowebinar.com/reg…
I break Windows.... retweeted
Want to create great phishing links using an open-redirect on google.com? While they don't last forever, they are a great way to trick unsuspecting victims into clicking a legit looking URL before expiring! gist.github.com/ustayready/3… Follow the 🧵for how it works..
I break Windows.... retweeted
Did you come play with us, hacking AD, @hthackers ? We’ve got some videos up on the @TrimarcSecurity YouTube to help continue your training. Check out the @TrimarcISV training videos at:
youtube.com/playlist?list=PL…
I break Windows.... retweeted
Hacking Azure? Don't miss creds in Runbooks!
Get-AzAutomationAccount|foreach{Get-AzAutomationRunbook $_.ResourceGroupName $_.AutomationAccountName|foreach{Export-AzAutomationRunbook $_.ResourceGroupName $_.AutomationAccountName $_.Name}}
I break Windows.... retweeted
Wanna have lunch with us & interrogate our Active Directory, Azure, Purple Team, & Virtualization experts? (Wanna ask now? Hit us in this thread)
Trimarc Ask Us Anything
Tomorrow 10/7 at 12pm ET
Twitch.tv/TrimarcSecurity
Come hang out in chat & judge us on our home office spaces.
I break Windows.... retweeted
Are you at #TEC2022 ? Join me tomorrow to find out how you can make your life easier using Azure AD features for your on-premises needs! 3:30PM Salon A/B
