Running LAPS Around Cleartext Passwords

Thomas Elling demonstrates querying Active Directory through SQL Server's OLE DB ADSI provider with OPENQUERY and OPENROWSET, adding new PowerUpSQL functions that automate AD recon from SQL servers.

Shows how to find systems where Domain Admins are likely logged in by querying the ServicePrincipalName attribute over LDAP, with a PowerShell module to automate the process.

Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.

NetSPI security experts share key insights from DEF CON 33's "Access Everywhere" theme, from networking with hackers to expanding security expertise through sessions and workshops.

Part one on pivoting across AWS Organizations: account boundaries, the 'easy win' of attacker-created member accounts, and abuse of trusted access, delegated administration and IAM Access Analyzer.