Ryan @ryanlancial

i do stuff with things Joined September 2010

Tweets

273
Followers

67
Following

164
Likes

1K

Ryan @ryanlancial

5 years ago

not mine, merry holidays🥃

0 0 0 0 0

View Details

Ryan @ryanlancial

5 years ago

drankin’ 🥃

0 0 0 0 0

View Details

Lesley Carhart @hacks4pancakes

5 years ago

Wow, this is a pretty good SMS-based phish. Don’t think I’ve seen this pretext before.

59 93 437 0 10

View Details

Ryan @ryanlancial

6 years ago

@delcastillo81 🍻

0 0 0 0 0

View Details

Question: How do I detect BloodHound running in my environment? Answer: It depends! Next Tuesday @jaredcatkinson and I will explore how SharpHound works and dive deeply into one of the "louder" collection methods. Register for this free webinar here: specterops.zoom.us/webinar/regist…

2 24 104 0 11

View Details

Ryan @ryanlancial

6 years ago

@_wald0 @jaredcatkinson 🙏

0 0 0 0 0

View Details

Walter.Legowski @SadProcessor

6 years ago

@jsnover Pls RT to help @jsnover save humanity...

3 3 18 0 0

View Details

Lee Holmes @Lee_Holmes

6 years ago

We've updated this post to give additional context and guidance for folks being asked to disable PowerShell. Check it out and let us know what you think!

Lee Holmes @Lee_Holmes

9 years ago

Defending Against PowerShell Attacks: Building the ultimate attacker honeypot. blogs.msdn.microsoft.com/powershell/201…

17 331 636 0 76

4 67 164 0 35

View Details

Andy Robbins @_wald0

7 years ago

#BloodHound 3.0 is here! BloodHound: bit.ly/GetBloodHound Blog: bit.ly/3bu3chl Webinar deck: bit.ly/3837gTx Webinar recording coming soon #BloodHound 3.0 shirt: (all profits go to @MDAorg) customink.com/fundraising/th…

20 379 669 0 55

View Details

Andy Robbins @_wald0

7 years ago

Join me and @CptJesus on Tuesday, February 11th as we unveil #BloodHound 3.0! We will demo new attack primitives, performance improvements, and changes in the GUI. Register for the webinar here (recording available afterwards): specterops.zoom.us/webinar/regist…

6 141 335 0 24

View Details

Ryan @ryanlancial

7 years ago

Right in the feels

Audie @_odddie_

7 years ago

Live footage of managing technical debt:

17 132 353 0 9

0 0 1 0 0

View Details

Mathias R. Jessen @IISResetMe

7 years ago

For my fellow Active Directory defenders out there: Admin Account Schema Extensions for AD blog.iisreset.me/admin-account-…

10 57 143 0 31

View Details

Darkoperator | 🇺🇦 @Carlos_Perez

7 years ago

Last month has been me going deep in to Sysmon, to help write configs I wrote a VSCode extension for Sysmon Config files marketplace.visualstudio.com/items?itemName… #Sysmon #ThreatDetection #threathunting

7 79 216 0 22

View Details

Walter.Legowski @SadProcessor

7 years ago

Just on time for the weekend... A little post about #BloodHound & Cypher for the Blues... [Contains some #PowerShell Tools] insinuator.net/2019/10/blue-h…

3 68 140 0 27

View Details

Sean Metcalf @PyroTek3

7 years ago

THIS! I have spoken a few times about Splunk Universal Forwarder & other agents having unexpected capability (install/run code). Best to run in low privilege mode (or use Windows Event Forwarding, WEF, on sensitive systems to move events).

0 11 65 0 5

View Details

Sean Metcalf @PyroTek3

7 years ago

Faking an AD account password change is possible (including on the krbtgt account), but detectable. Check "User must change password at next logon", Apply, uncheck, Apply. Boom, password last set date is changed, but the actual password is not. UnicodePWD = password attribute

10 150 398 0 51

View Details

Ryan @ryanlancial

7 years ago

Hey @SpecterOps, thanks for being good.🥃

0 0 4 0 0

View Details

Nick Carr @ItsReallyNick

7 years ago

📺 DerbyCon #StateOfTheHack continues... We're joined by Microsoft security's @n0x08 who shares the global scale issues that he & his awesome @msftsecresponse teammates tackle (spoiler: we're all doomed 💥). Also stop dropping POCs/exploits on Fridays 🛑🙏 pscp.tv/w/cFFLWzFlVmpZ…

1 3 13 0 0

View Details

Andy Robbins @_wald0

7 years ago

The video and deck for my and @CptJesus's @DerbyCon talk, "BloodHound: Head To Tail" are now online: Deck: docs.google.com/presentation/d… Video: youtube.com/watch?v=fqYoOo… Shout outs to @kevin_robertson @_nullbind @kfosaaen @egru @harmj0y @elad_shamir @TimMedin @gentilkiwi @PyroTek3

4 188 365 0 54

View Details

Mathias R. Jessen @IISResetMe

7 years ago

.@PyroTek3: "Start with the basics, make sure you rotate local admin passwords on domain members" LAPS is not perfect, but it's easy to deploy and still 100 x better than your 5 year old gpp password 🙄 microsoft.com/en-us/download…