Getting Started with WMI Weaponization – Part 2

Explains WMI event-driven persistence through filter, consumer, and binding triples, contrasting polled intrinsic events with push-based extrinsic events for launching commands on user logon.

Introduces PowerUpSQL discovery functions that enumerate SQL Server instances from local, network, and domain perspectives, an essential first step for data hunting or privilege escalation.

Releases a PowerShell tool that uses Microsoft's userrealm API to enumerate ADFS federated domains, inspired by the Office365 SAML assertion vulnerability research.

With only the Public role, native SQL Server functions can enumerate AD users, groups, and computers; NetSPI ships PowerShell and Metasploit modules automating this via direct connections or SQLi.

NetSPI's DEF CON 33 talk shows how Azure resources supporting Entra ID authentication expose tenant IDs, letting attackers map cloud resources back to specific organizations at scale.

Part two of the AWS Organizations series shows how trusted access and delegated administration can be abused for pivoting, plus a new Pacu module for enumeration and defensive guidance.