Publications

CyberAct cybersecurity publications

SOC, Red Team, compliance, training: our practical insights and advice, published regularly.

#domain controller security #Active Directory attack #Kerberoasting #DCSync #Golden Ticket #domain controller #Active Directory #LLMNR #SMB signing #Pass-the-Hash #Pass-the-Ticket #compromised Active Directory #Credential Guard #Mimikatz Rubeus lateral movement #Exchange Hybrid #Entra ID #Lateral Movement #Cloud Identity #Trojans #Malware #SOC #Threat Intelligence #C2 #Security Audit #Privileged Accounts #Kerberos #AD Governance #IDOR #Microservices #Blue Team #API Security #CI/CD #IPv6 #NTLM #Red Team #Network Protocols #NTLM Relay #AD Hardening #SMB #LDAP #GPO #Pentest #Network Segmentation #Remediation #Fortinet #Vulnerability Management #Vendor Risk #Firewall #Credential Management #Network Vulnerability #GPU Cracking #Patch Management #Privilege Escalation #BloodHound #Azure AD #IAM Audit #AWS IAM #Cloud Security #AWS Pentest #OAuth #Microsoft 365 #Identity #ADFS #SAML #Hybrid Identity #Tier 0 #Zero Trust #Conditional Access #Identity Attack #DPAPI #Hybrid SOC #Exchange Online #Incident Response #Exfiltration #Audit Log

SOCM365 Persistence: Exchange Online Rules and Silent Email Exfiltration

After an M365 breach, attackers weaponize Exchange Online rules to silently exfiltrate emails. How to detect them through the Unified Audit Log?

Jun 30, 20266 min read

#Exchange Online #Microsoft 365 #Incident Response

Red TeamFrom Compromised AD to Microsoft 365: Anatomy of a Hybrid Attack

One poorly secured workstation can compromise an entire Microsoft 365 tenant. Here is how the attack chain unfolds, step by step.

Jun 27, 20266 min read

#Active Directory #Entra ID #Lateral Movement

GouvernanceEntra ID Conditional Access: the silent gaps that break Zero Trust

Forgotten IP exclusions, service accounts outside policies, sessions never re-evaluated: here's how a Zero Trust deployment can be bypassed from within.

Jun 26, 20266 min read

#Entra ID #Zero Trust #Conditional Access

Red TeamGolden SAML: When ADFS Becomes the Master Key to Your Cloud

Stealing the ADFS signing certificate lets attackers forge valid SAML tokens for any federated user — bypassing MFA entirely.

Jun 25, 20266 min read

#ADFS #SAML #Active Directory

SOCOAuth Abuse in Microsoft 365: One Click to Persistent Access

An attacker can access your M365 emails and files without a password through a malicious OAuth app. Here's how it works and how to stop it.

Jun 24, 20266 min read

#OAuth #Microsoft 365 #Azure AD

Red TeamAWS IAM Misconfigurations: Privilege Escalation Paths and Audit Tools

IAM wildcards, unconstrained assumable roles, unrotated root keys: how these misconfigs lead to full AWS account takeover.

Jun 23, 20266 min read

#AWS IAM #Privilege Escalation #Cloud Security