Phying News
P非影 中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Beyond Tier Zero

specterops.io | blog | #active-directory | #identity-security | #red-team | #lateral-movement | #hybrid-cloud | #attack-path-management | #tier-zero

Summary

SpecterOps argues identity risk now extends beyond Tier Zero, as attackers increasingly use legitimate credentials and trusted relationships to reach backups, regulated data, and other critical workloads.
Published
Collected

original ↗

Related coverage

blog · projectblack.io
Should I Azure AD Sync/Entra Cloud Sync Domain Admins?
Syncing Domain Admins into Entra ID lets attackers pivot from compromised on-prem AD to the cloud, and back via password writeback. CIS and Microsoft advise keeping privileged admin accounts cloud-only.
blog · semperis.com
How to Redefine Cyber Resilience: Start by Rethinking Hybrid Identity Protection
Semperis argues AI-driven attacks are outpacing identity teams as machine identities outnumber human ones 10:1, and urges building organization-wide cyber resilience around hybrid identity protection before the next crisis.
blog · netspi.com
Auto-Dumping Domain Credentials using SPNs, PowerShell Remoting, and Mimikatz
Introduces Invoke-MassMimikatz-PsRemoting, which combines SPN discovery, PowerShell Remoting, and Invoke-Mimikatz to harvest credentials from many domain systems automatically.
blog · netspi.com
Running LAPS Around Cleartext Passwords
Explains how Microsoft LAPS stores local admin passwords in LDAP, and how incorrect delegation on ms-MCS-AdmPwd can expose cleartext credentials that aid lateral movement.
blog · netspi.com
5 Ways to Find Systems Running Domain Admin Processes
Details five ways to find systems running Domain Admin processes: checking locally, querying domain controllers for sessions, scanning remote tasks, NetBIOS enumeration, and token spraying.
blog · specterops.io
AI for Offensive Security: What Works, What Does Not, and How to Adopt It
SpecterOps maps where AI helps offensive security (recon, tooling, vuln discovery) and where it still fails, stressing that results hinge on the harness: context, tools, state, independent validation, and human judgment.
back