Windows internals, identity, cloud security, and the edges between defence and exploitation.
When a Windows access check fails, it is natural to start with the object being accessed. That is usually the right first move. The file, registry key, process, service, object path, ACL, and protection level can all be the answer. But they are only one side of the access check. Windows also needs a precise model of the caller. Who is asking? Which groups count? Which privileges are actually…
Administrator is powerful on Windows, but it is not the highest trust level on the machine. That becomes obvious the first time an elevated tool hits a process it cannot fully inspect. In Process Explorer, ordinary processes feel familiar: modules, handles, threads, token details, memory, image paths, loaded DLLs. Administrative tools can usually expose a lot of process state. Then click one of…
CreateProcess does far more than start a program: it builds enough process state, loader state, and subsystem state for execution to become possible. The easy version of process creation is: Program A calls CreateProcess , then Program B starts running. That is true in the same way that “I turned the key and the car moved” is true. Useful enough for daily life, but it skips the interesting…
Moving SYSVOL deserves a cautious, well-tested runbook because the directory is central to Group Policy and domain logon behavior. The junction points, replication state, backups, and rollback plan matter more than the file copy itself. Preparation Quickly confirm AD replication is ok. This might seem counterintuitive because SYSVOL uses DFSR which is separate to general AD replication, but a…
When using dnSpy to make a small managed-code change, the simplest edit is often to replace an instruction with a no-op rather than rewriting an entire method. This note explains that workflow while keeping the focus on controlled lab changes and repeatable verification. Sometimes the code you are looking at in dnSpy cannot be edited and recompiled cleanly. You know the small change you want to…
This note covers converting ETL traces to EVTX-style event logs in near real time for Azure App Proxy front-end logging. The broader lesson is to preserve the original telemetry, document the conversion pipeline, and be clear about which fields survive the transformation. Ensure that the front end logs from the Azure Application Proxies are flowing into the SIEM via Windows Event Forwarding (WEF)…
This post documents a suspected WordPress backdoor investigation. It is split into two useful tracks: the operational lessons from finding and cleaning up a compromised site, and a technical analysis of the malicious PHP so the indicators and tradecraft can be understood. This appears to be “Smilodon” malware. Example post:…
Search is a strong Active Directory lab for attackers and defenders because it rewards disciplined enumeration more than tool memorization. The useful habit is to keep asking which identity has which right over which object, then prove the path before escalating. Before going too far: if you are new to this type of content, I’d encourage you to use ippsec’s really high-quality YouTube video rather…
This post describes a certificate-enrollment pattern for domain-joined Linux workstations that need to authenticate with machine-account Kerberos and request workstation certificates from Microsoft AD CS. The main moving parts are CES/CEP, Kerberos delegation, certificate templates, Linux domain join and keytab handling, and client-side enrollment tooling. We will cover the detail a little further…
Shadow Credentials abuse targets the msDS-KeyCredentialLink attribute and the way Active Directory supports key trust authentication. The blue-team priority is simple: understand who can write that attribute, how those rights are inherited, and what telemetry exists when a new key credential appears. Elad Shamir’s post on Shadow Credentials is the right place to read the details of this…