How an adversary simulation really works, phase by phase: defining objectives, threat modelling, PRE-ATT&CK and ATT&CK, demonstrating impact, and delivering a report that speaks the language of the business.
Vulnerability Assessment, Pentest, Red Team, BAS, physical intrusion, ransomware simulation… It’s not a menu where you pick the flashiest dish: it’s a staircase. This guide helps you figure out which step you’re on and what makes sense to hire right now.
What Red Teaming is (and what it isn’t), how it differs from a vulnerability assessment and a pentest, when it makes sense, and how its success is measured.
ADCS relay with ntlmrelayx generates certificates that certipy v5 rejects with ‘Object SID mismatch’. The root cause is KB5014754: modern DCs require the certificate to contain the user’s SID in a Microsoft-proprietary extension. ntlmrelayx doesn’t include it. Here’s why and how to fix it.
Almost all Active Directory enumeration goes through LDAP (389/636), which is precisely the most watched channel in the domain. ADWS is a side door on port 9389 that accepts the same LDAP queries but is barely monitored. How it works under the hood, why its OPSEC is so good, and why it isn’t invisible.
Veeam Backup: what would happen if this protection solution became the entry point for a malicious actor? Two approaches to dump the SAM and extract DPAPI master keys while evading AV/EDR, using Veeam as a pivot toward critical services.