
@techspencei
iAccount based inUnited States
About this account
- Account based in
- United States
- Connected via
- United States App Store
Account-level information from X, not a live location or the device used for a specific post.
🛠️ Former Sysadmin, now Pentester | Microsoft MVP | Helping IT teams make their environment harder to attack | @SecurIT360 & @CyberThreatPOV
🏰AD Security Resource Kit ⬇️
Joined November 2010
- Tweets58.1K
- Following3.1K
- Followers18.6K
- Likes142K
Pinned Tweet
Active Directory has survived basically every technology trend that was supposed to make it irrelevant, until now?
What’s the point of life if you can’t prank your teammates by replacing their desktop wallpaper with a Baywatch-era picture of David Hasselhoff?
I got some grounds in my coffee this morning and that reminded me of something.
You can’t have to good without the bad. There is no light without the dark.
spencer retweeted
Saying let's do security is like saying let's do health. It's too big to start. What happens after Susie in accounting gets compromised? That's a question you can actually answer. @kamakauzy @techspence
offsec.blog/your-employee-go…
Going live soon with @Netwrix @PhillipWylie and more!! Details below!
I got invited to speak alongside these other awesome people for a @Netwrix Innovation Week panel discussion on Identity Security in the age of AI.
Long live Active Directory! 💪😄
Thursday, Oct. 22, at 1 p.m. ET
Watch live here 👇
YouTube: youtube.com/@NetWrix
Twitch: twitch.tv/netwrixtv
spencer retweeted
HTTPS://workplaceninjas.us
January 11-13 in Scottsdale, AZ, at a literal beach resort.
Grateful for the recent conversations we've had with @techspence and @alehurtadoxo
youtu.be/INz5r8a1-6w?si=EnvL…
xitter.cf/alehurtadoxo/status/21…
Definitely give them a view and a subscribe. Lots more inbound friends
I had two of the founding fathers of detection engineering on Detection Dispatch to talk about what they've been farming with the community. 🌱
LOLDrivers. LOLRMM. LOLSkills.
Catalogs that track legitimate tools and components that attackers abuse, giving us a shared place to build knowledge, hunt, and detection engineer the ways of prevention.....but the conversation went somewhere I didn't expect.
I've spent so much of my career thinking about detection that this episode genuinely had me rewiring my brain around app control/prevention....Prevention isn't a replacement for detection. We need both, and I think we need to talk a lot more about how they work together. That's the episode, you don't want to miss.
Thank you @M_haggis & @_josehelps for the laughs 🦉 🦉 🦉 🦉
Full episode dropping this weekend, subscribe to my Youtube channel to be notified 🔔
Shout out to my dude @MikeHacksThings for having me on his show! We had a great time chatting and sharing pentesting war stories 😄
youtu.be/p_GaketDENI?si=DJk6…
Please don’t tell Merill
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Time and time again these data breaches and security incidents come down to exploitation of the difficult but “basic” things no one wants to do.
spencer retweeted
We cover php, 4, & more on today’s episode of the GOAT security podcast @riskybusiness
youtu.be/6SIgPjQ9V1g
In other words…. Zero days are not always guaranteed layups.
And if you do it right I’d say a majority of zero days even are not layups
Let me paraphrase: Merill realizes that he was wrong about Active Directory all along and because of that...
He's offering FREE Active Directory security assessments. All you have to do is comment the word: AD4LIFE and he will be in touch!
Do you have an AD domain and have PHP running anywhere in your environment that has "line of sight" to you domain?
20%Yes
50%No
30%@merill needs glasses
220 votes • 13 minutesAn idiot threat actor using an LLM and a papercut exploit couldn't even get domain admin in all the AD environments he hacked (greynoise report)
No actually, you're not "one zero day away" from compromise...
Entra ID is on the internet anyone can hack it.
AD is safe because we're behind a firewall, so its okay if we open all our ports to all the internal servers...
Zero Trust boys.
You are just one zero day away from all the internet facing endpoints that connect to your AD.
If you think there aren't PHP servers connecting with line of sight to your DC I have a bridge to sell.
Fact is Entra ID is on the internet 24x7 and its still standing. Because that is how modern identity works.
spencer retweeted
A pentester says app control makes his job much harder. We'll take it. @techspence invited our founders to chat on why most teams still skip it. Always fun, won't be the last:
youtu.be/INz5r8a1-6w?si=M8jf…
Friendly reminder to IT admins about NTLM. You should:
1. Disable NTLMv1
2. Use RPC filtering on your Domain Controllers to protect against authentication coercion
3. Monitor the heck out of legacy authentication, so if something strange does happen you're more likely to know about it
Easy? Not necessarily. But if you have weak NTLM in your environment and coercion paths still available, this is trivial to abuse and results in highly privileged access.
What do you have to lose?
spencer retweeted
This was too fun thank you @techspence for having us on!
Prevention is critical! You cannot rely on detection alone to save you.
My chat with @_josehelps and @M_haggis who started @magicswordio to help change the game. 💪
Watch here > youtu.be/INz5r8a1-6w

















