PowerShell

Found this while browsing: EntraFalcon by Compass Security. A lightweight PowerShell tool that scans your Microsoft Entra ID tenant and generates an interactive HTML report covering privileged objects and role assignments, risky or misconfigured service principals, guest user exposure, Conditional Access gaps, and general identity posture findings. No extra app registration needed — it uses your existing authenticated session via Microsoft Graph PowerShell. That makes it quick to run in environments where creating new app registrations requires approval. ...

What it does Extracts BitLocker recovery keys from all locally protected volumes and saves them to a timestamped file at C:\Temp\BitLockerKeys_YYYYMMDD_HHMMSS.txt. Useful for: Auditing BitLocker key availability before a device is reprovisioned Manual verification when keys have not escrowed correctly to Entra ID / Intune Local key recovery in offline or unmanaged environments Requirements Windows 10/11 or Windows Server with BitLocker module available PowerShell run as Administrator BitLocker active on at least one volume Source Script available on GitHub: ...

Overview Certighost is an Active Directory Certificate Services vulnerability disclosed on July 24, 2026 by researchers H0j3n and aniqfakhrul. It allows a low-privileged domain user to impersonate a Domain Controller and achieve full domain compromise, including DCSync and krbtgt extraction. Patched in the July 2026 Patch Tuesday as CVE-2026-54121. If your Enterprise CA has not been updated, patch now. CVE: CVE-2026-54121 Researchers: H0j3n, aniqfakhrul Patched: July 14, 2026 Disclosed: July 24, 2026 Impact: Full domain compromise from low-privileged user Affected component: Active Directory Certificate Services - Enterprise CA Background AD CS is Microsoft’s PKI implementation. It issues X.509 certificates used for authentication. A client requests a certificate from an Enterprise CA, then presents it to the KDC via PKINIT to obtain a Kerberos TGT. ...

Symptom When attempting to uninstall FortiClient via Add/Remove Programs or an MDM platform, the uninstaller throws an error similar to: “The network resource is unavailable” or “Windows Installer cannot find the original package” This happens because the Windows Installer is looking for the original FortiClient.msi in a path that no longer exists. Option 1 — Force Uninstall via GUID Step 1 — Get the product GUID Open PowerShell as Administrator: ...

1. The Reality of Active Directory Every AD environment accumulates history. Migrations, acquisitions, staff turnover, legacy applications — they all leave traces. The result is almost always the same: enabled accounts that nobody remembers, service accounts with passwords set years ago, and exceptions that were “temporary” and never cleaned up. This is exactly the low-hanging fruit attackers look for first. Why spend time trying to break into a well-protected account with MFA when there is a 20-year-old enabled account sitting next to it — or a service account with a 5-year-old password and access to something critical? ...

1. The Problem — RMM Tools as Ransomware Infrastructure Remote Monitoring and Management (RMM) tools like AnyDesk are legitimate software used by IT teams worldwide. That legitimacy is exactly why ransomware groups abuse them — they blend into normal enterprise traffic and are often missed by security controls focused on known malware signatures. According to the Ransomware Tool Matrix, 32 ransomware groups use AnyDesk for persistence — making it the most abused tool in the RMM category. The technique is simple, reliable, and requires no custom malware. ...

1. Overview CVE-2026-26128 is a Kerberos authentication reflection bypass discovered by Synacktiv that completely bypasses the patch introduced for CVE-2025-33073. It allows an attacker to obtain SYSTEM-level access on most Windows builds. CVE CVE-2026-26128 Discovered by Synacktiv Patched March 2026 Patch Tuesday Related CVE-2025-33073, CVE-2025-58726, CVE-2026-24294 Impact Local Privilege Escalation → SYSTEM Affected All Windows versions except Windows 11 24H2 (default config) 2. Background The broader context of this vulnerability sits within a chain of authentication reflection research: ...

1. What is NTLM Coercion? NTLM coercion is an attack technique where an adversary with network access forces a Windows machine — typically a Domain Controller — to authenticate against an attacker-controlled host. That authentication travels in NTLM format and can be captured and relayed (NTLM relay) to access other domain resources, or cracked offline. The classic scenario: The attacker runs a coercion tool (Coercer, PetitPotam, PrinterBug) against a DC. The DC automatically attempts to authenticate against the attacker’s IP. The attacker captures the NTLMv2 hash and relays or cracks it. Depending on privileges, this can lead to full domain compromise. 2. Common Coercion Vectors Vector Protocol Notes Print Spooler (MS-RPRN) RPC / SMB Most historically exploited EFS (MS-EFSRPC) RPC Requires EFS to be active DFS (MS-DFSNM) RPC / SMB Common on DCs with DFS enabled WebClient (WebDAV) HTTP Requires the service to be running 3. What Changed in Windows Server 2025 Windows Server 2025 (and Server 2022 23H2 onwards) introduced significant changes that reduce the default attack surface: ...

1. Summary A publicly disclosed technique, referred to as “Onelogon”, demonstrates a bypass of the Zerologon (CVE-2020-1472) remediation on Active Directory Domain Controllers. The bypass does not target a new flaw in the Netlogon Remote Protocol (MS-NRPC) itself — it targets legacy compatibility exceptions that administrators may have left enabled after the original Zerologon patch cycle (August 2020 – February 2021). Where these exceptions are present and misconfigured, an attacker can re-establish an unauthenticated or weakly authenticated Netlogon secure channel, impersonate a computer account, and in some documented cases escalate to full domain compromise (credential dumping via DCSync-style replication, extraction of NTDS.dit). ...