Publications

CyberAct cybersecurity publications

SOC, Red Team, compliance, training: our practical insights and advice, published regularly.

#domain controller security #Active Directory attack #Kerberoasting #DCSync #Golden Ticket #domain controller #Active Directory #LLMNR #SMB signing #Pass-the-Hash #Pass-the-Ticket #compromised Active Directory #Credential Guard #Mimikatz Rubeus lateral movement #Exchange Hybrid #Entra ID #Lateral Movement #Cloud Identity #Trojans #Malware #SOC #Threat Intelligence #C2 #Security Audit #Privileged Accounts #Kerberos #AD Governance #IDOR #Microservices #Blue Team #API Security #CI/CD #IPv6 #NTLM #Red Team #Network Protocols #NTLM Relay #AD Hardening #SMB #LDAP #GPO #Pentest #Network Segmentation #Remediation #Fortinet #Vulnerability Management #Vendor Risk #Firewall #Credential Management #Network Vulnerability #GPU Cracking #Patch Management #Privilege Escalation #BloodHound #Azure AD #IAM Audit #AWS IAM #Cloud Security #AWS Pentest #OAuth #Microsoft 365 #Identity #ADFS #SAML #Hybrid Identity #Tier 0 #Zero Trust #Conditional Access #Identity Attack #DPAPI #Hybrid SOC #Exchange Online #Incident Response #Exfiltration #Audit Log

Red TeamGhost IPv6: How Rogue DHCPv6 Leads to NTLM Hash Theft

A rogue DHCPv6 server can silently redirect DNS resolution across a Windows network. Here's the full attack chain explained.

Jun 22, 20266 min read

#IPv6 #NTLM #Active Directory

SOCIDOR in e-banking microservices: building a centralized authorization layer

Patching IDOR vulnerabilities endpoint by endpoint is a losing battle. Here's the architectural fix that actually scales.

Jun 22, 20266 min read

#IDOR #Microservices #Blue Team

Red TeamPingCastle: Score and Track Your Active Directory Security

PingCastle measures Active Directory security posture over time. Learn how to turn it into a continuous improvement tool, not just a one-off audit.

Jun 22, 20265 min read

#Active Directory #Security Audit #Privileged Accounts

MenacesBanking Trojans: Lifecycle and Evolution Toward MaaS

From Zeus to Qakbot, banking trojans evolved into criminal platforms. A breakdown of their lifecycle and the MaaS model.

Jun 21, 20266 min read

#Trojans #Malware #SOC

Red TeamExchange Hybrid: How an On-Prem DC Can Pivot to Entra ID

In Exchange Hybrid setups, Azure AD Connect bridges your on-premises AD and your cloud tenant — and attackers know exactly how to exploit that link.

Jun 21, 20266 min read

#Active Directory #Exchange Hybrid #Entra ID

Red TeamPass-the-Hash vs Pass-the-Ticket: anatomy of two AD attacks

Two techniques, one goal: lateral movement without knowing passwords. Technical breakdown and real limits of Credential Guard.

Jun 21, 20265 min read

#Pass-the-Hash #Pass-the-Ticket #compromised Active Directory