AS-REP Roasting でユーザを取得後、 WriteDacl で DCSync し SYSTEM を取得

We analyze a series of attacks on educational institutions that were fully automated during the post-exploitation phase using the CyberStrikeAI penetration testing framework.

Microsoft describes two intrusions starting with Teams help-desk impersonation and Quick Assist access, then diverging into AD CS ESC1 certificate abuse or…

Un atacante pide replicar Active Directory sin ser un DC y el evento 4662 lo delata. Mirá la línea de tiempo, el comando de detección y los falsos positivos.

For over a decade, Windows Server 2012 and its far more popular sibling, Windows Server 2012 R2, have been the quiet workhorses of the enterprise datacenter. If you hated the touch-first Metro Start…

A China-based company that sells cybersecurity services is now accused of something else: supplying hackers with tools, infrastructure and stolen access. On October 8, 2026, the FBI, CISA, NSA and…

All-Rust Active Directory exploitation framework: LDAP/SMB/Kerberos enumeration, attack-graph pathfinding, Kerberoasting, NTLM relay, ticket forging, DCSync, and reporting in one static binary.

Kerberoasting detection and defense guide: spot abnormal Kerberos ticket requests, harden service accounts, and reduce Active Directory credential risks.

スパイ活動を専門とする脅威グループNightEagle(APT-Q-95としても追跡されている)は、活動範囲をアジア地域の標的からロシアの組織へと拡大しており、Active Directoryドメインコントローラーの侵害を最終目的とする多段階の侵入手口を用いています。 このキャンペーンは、企業侵害においてよく見られな

Kaspersky GERT reported that NightEagle (APT-Q-95) expanded its operations from Asia to Russian businesses, using stolen VPN credentials, GhostContainer on Microsoft Exchange, and multiple tunneling and lateral-movement techniques. The campaign also involved BlueKeep exploitation, DCSync-related activity, and tooling hosted under disguised GitHub repositories to maintain access and move across internal networks. #NightEagle #APTQ95 #GhostContainer #MicrosoftExchange #BlueKeep #DCSync

Tomeo. Article de vulgarisation technique à destination d'un public professionnel. 🎯 Contexte L'article décrit en détail le mécanisme d'une attaque DCSync, une technique d'exfiltration de credentials ciblant les contrôleurs de domaine Active Directory (AD).

Threat actors are increasingly abusing Active Directory replication to impersonate domain controllers and steal password hashes from enterprise networks. This technique, known as a DCSync attack, can…

An operator weaponized CVE-2026-15409 two days after disclosure, extracting LDAP credentials and running DCSync against Active Directory via SonicWall appliances.

At a Glance Category Details Actor or Group Unattributed threat actor (Chinese-language artifacts observed) Activity Type Mass vulnerability scanning, credential harvesting, DCSync attacks Targets or Victims UK local government, healthcare, education, and finance sectors Scale 250 targets identified, 168 configurations exposed, 5 domains compromised Jurisdiction Status Under investigation by local authorities and security firms Source Hunt.io Threat Intelligence Executive Summary…

脅威アクターが、ドメインコントローラーになりすましてエンタープライズネットワークからパスワードハッシュを抽出する、「DCSync」と呼ばれるステルス性の高いActive Directory悪用手法を利用するケースが増えています。 Trellixが報告したDCSyncは、脆弱なサーバーを突いたり目立つマルウェアを展開し