Knowledge Base.

Hashcatalyst: Automating password cracking

Kerberoasting Under Fire: How Group Managed Service Accounts Can Save the Day

From Shadows to Signals: Hunting Pass-the-Hash Attacks

NTLM is (finally) Dying

From File Deletion to Domination: Exploiting Cisco’s VPN Clients for Privilege Escalation

Detecting AD CS subjectAltName (SAN) Abuse Using KQL

KQL & LOLBAS Detection Ideas

The PATH to PWNAGE

OneRuleToRuleThemStill: New and Improved

IMDS Hardening

Logstash, Sentinel, Round Two…

Logstash, Meet Sentinel… Sentinel, Meet Logstash!