The bypass of LDAP Signing Through Reauthentication described in @SpecterOps blog also works with pure Kerberos relay. too ;-)

Implemented SMB "reauth" from @aas_s3curity in my KreRelayEx tool too :-)

Tiny OS from scratch. Console looks like an IBM 3270 running TSO. Divide by zero? ABEND S0C9. READY
😅

To prove you are not a robot prove you're a stupid human 😆

In July, Microsoft fixed CVE-2026-50343, a Windows privilege escalation bug reported by Calif and 9 others, dubbed “Dark Elevator”.

But was it really fixed?

Ask @tiraniddo

projectzero.google/2026/09/window…

Finally got LocalKDC working on W11 insider, now let's see... 😅

Works also for loopback authentication

Been digging deep into the Windows Endpoint Security Platform (WESP) in Win11 25H2, definitely one of the most fascinating security features Microsoft has built in a while.

The concept is neat: compile rules to decision graphs in user mode, hand them to wesp.sys, and let the kernel evaluate them in-path while telemetry streams asynchronously in the background.

I did an AI-assisted reverse engineering dive into the whole stack (wesp.sys, espclient.dll, and wesp_elam.sys), documented the wire protocols, disposition tables, and the enforcement gate, and built esptool, a research harness with 118 XML rule docs so anyone can test live telemetry and in-kernel blocking.

Repo: github.com/marcosd4h/wesp…

Tech doc: github.com/marcosd4h/wesp…

Thanks to @yarden_shafir for putting this on my radar

AI may eventually become the new Cold War: everyone keeps building more powerful systems because they can’t afford to let the other side get ahead. Chip manufacturers may become the equivalent of uranium supplier controlling access to the resource that makes the race possible

askWAM - Requests Microsoft Entra access tokens silently through Windows Web Account Manager (WAM) by @_dirkjan

github.com/dirkjanm/askWAM

A new O'Reilly bestseller!

Super cool research from my colleague Shai Laron on new attack paths to Active Directory that can lead to full domain takeover 😜 . It was presented at Black Hat and he will be speaking again at DEF CON this weekend.
Don't miss this 💪 :
semperis.com/blog/identity-…

Although this is a well-known topic, it's still one of my favorites. I put together a concise reference covering the most dangerous Windows privileges, how they can be abused, and why you should think twice before assigning them 👉 semperis.com/blog/windows-p…

Turning an idea into something more concrete: importing vulnerable GPOs into Neo4j/BH and creating dedicated relationship edges to make GPO-based attack paths easier to visualize.

I just wrote a new blog on bypassing CA policies in Entra ID that have a resource exclusion, and why you probably want to enable baseline enforcement if you have such policies. Enjoy!

dirkjanm.io/bypassing-cond…

Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't!
Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated.
New post: managedpriv.com/blog/acl-canon…

MSRC stories? I have several.
One of the funniest: I submitted a vuln and was told it didn't meet the bar. Blogged about this finding. A few months later, someone else submitted the exact same vuln and suddenly it was confirmed, awarded a bounty, and assigned a CVE. 🤦‍♂️

I think a lot of people publishing 0-days for childish reasons are mostly chasing visibility.

Turns out that the fix for the CVE-2020-17103 , the Cloud Filter HsmOsBlockPlaceholderAccess driver bug reported by @tiraniddo was never ported to Windows 11 / Server 2025 and still not fixed. LPE from user to SYSTEM 🤦‍♂️

Server 2019 before patch (CVE-2020-17103 , december 8th 2020) is vulnerable, after patch not. The patch was ported on 2022 too