Scoubi

My SANS #DFIRSummit talk is now public!

Happy #BloodHoundBasics Day from @ScoubiMtl! 🎉 Have you ever run a Cypher Query & get so many nodes you couldn't see anything? You Pinch Zoom to get a closer look and it worked fine, but you Pinch Un-zoom & the application resized. 🧵: 1/2

Think being compliant = being secure? Think again. 🤔 Hear from @ScoubiMtl at #BSidesLV as he exposes the gap between blindly following rules & security posture. Get the info on password security & what to do when "compliant" passwords fail you. ghst.ly/4o66cWk

It is with more sadness than mere words can convey that we have to report that our beloved Ozzy Osbourne has passed away this morning. He was with his family and surrounded by love. We ask everyone to respect our family privacy at this time.   Sharon, Jack, Kelly, Aimee and…

RIP Ozzy Osbourne. :(

To trigger local SYSTEM authentication for relaying to ADCS or LDAP for LPE you would usually need the printer service or EFS service to be enabled (printerbug/petitpotam). Here is an alternative without this requirement 🤠 github.com/rtecCyberSec/R…

The Tombstone lifetime (TSL) in Active Directory is the limit as to how long a deleted object can remain in AD. The original value was 60 (days). Windows versions since Windows 2003 SP2 have this set to 180 (days). Note that this also affects backups, how long a backup is valid…

Level up your skills w/ the Specter team at #SpecterBash 2025! 👻 Choose from 4 field-tested adversary tradecraft courses and learn directly from those doing the work. Details 👉 specterops.io/specter-bash

Only 3 Early Bird tickets left!!!

Tickets for #DEATHcon in Montreal are on sale now! Book now to secure your place. FYI, Virtual Tickets for round 1 are already Sold Out! eventbrite.ca/e/deathcon-mon… Additional info (like workshops) for the con can be found here : DEATHcon.io Please retweet for reach

Azure API vulnerability and built-in roles misconfiguration enable corporate network takeover token.security/blog/azures-ro…

🆕 Recent additions to LOLBAS-Project.github.io: • shell32.dll,#44 for DLL execution • PhotoViewer.dll for INetCache download • winget.exe for AWL Bypass • mmc.exe for download (via GUI) • cipher.exe for anti-forensics ➕: the #LOLBAS project now supports dark mode 😎

Tickets for "DEATHcon - Montreal On Site" go on sale July 8th at 8am. eventbrite.ca/e/deathcon-mon… Be with 50 other DE&TH aficionados for a whole weekend Nov 8-9 2025!! #DEATHcon #Workshops #DetectionEngineering #ThreatHunting

After today’s talk at #TROOPERS25 I’m releasing BitlockMove, a PoC to execute code on remote systems in the context of a loggedon user session 🔥 github.com/rtecCyberSec/B… No need to steal credentials, no impersonation, no injection needed 👌

My new tool, Invoke-PowerDPAPI is able to obtain system master keys and decrypt various DPAPI encrypted material such as credentials, vaults and local SCCM encrypted blobs for NAA credentials and task sequences. Github: github.com/The-Viper-One/… Let me know what you think 😁

At @WEareTROOPERS I dropped new research on #nOAuth, an abuse of #EntraID that allows you to spoof users in vulnerable SaaS applications. The attack is still alive and well. You can read all about it here: #Entra #M365 #infosec semperis.com/blog/noauth-ab…

The new Citrix Bleed somehow went by my attention. Now that they removed the management interfaces from the prerequisits, everything gets a new taste: doublepulsar.com/citrixbleed-2-… Thx @GossiTheDog for the neat summary.

Ghostwriter v6's new collaborative editing feature is 🔥 Alex Parrill & @cmaddalena discuss the new real-time collaborative editing for observations, findings, & report fields, enabling multiple users to edit simultaneously without overwriting each other. ghst.ly/4jVqdvG