Chad Duffey

Same user, same file, one process gets access and the other doesn’t.

Open Process Explorer as administrator and click through a few processes.

The easy version of process creation is: Program A calls CreateProcess, then Program B starts running.

Moving SYSVOL is a little tricky because the folder you can see isn’t the whole story.

If you’ve used dnSpy to make a small change to a binary, you’ll know the usual drill: find the method, right-click, edit, compile.

The ask: Ensure that the front end logs from the Azure Application Proxies are flowing into the SIEM via Windows Event Forwarding (WEF).

Search takes a fairly winding route through AD: a password in a web image, another in a spreadsheet, a client certificate, and finally a managed service account with more access than it ought to have.

I recently discovered what appeared to be a backdoor installed in my WordPress site.

This came from a recent project requirement: domain-joined Linux workstations needed to use their machine accounts to authenticate with Kerberos and request workstation certificates from Microsoft Certificate Services.

The bit that bothers me about Shadow Credentials is how little needs to change for the person whose account is being used.