Blog Post
Stealing OAuth Tokens Through Microsoft's Front Door
A sideloaded package turns a Microsoft-signed binary into an OAuth token theft tool. No phishing domain, no spoofed UI, no browser. Here's how to detect it.
Blog Posts By This Author
All Categories
- Read more about Stealing OAuth Tokens Through Microsoft's Front Door
- Read more about AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable KeyBlog Post
AD Rights Management Service (Part 2): Extraction, Offline Decryption, and the Unrotatable Key
An AD RMS Service Group account exports the AD RMS Server Licensor Certificate private key. That 1172-byte key decrypts every document the deployment ever protected, offline, and keeps doing so after the deployment is rebuilt.
- Read more about AD Rights Management Service (Part 1): Architecture, Deprecation, and ReconnaissanceBlog Post
AD Rights Management Service (Part 1): Architecture, Deprecation, and Reconnaissance
Active Directory Rights Management Services still ships in Windows Server 2025, years after Microsoft began steering customers to the cloud, and it remains fully supported on-premises. Part 1 maps the AD RMS trust model (the Server Licensor Certificate, the license flow, the SOAP surface) and shows how to discover an RMS deployment, fingerprint an AD RMS-protected file, and trace the path to that certificate's private key.
- Read more about From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never WillBlog Post
From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
ldapnomnom claims it leaves no Windows audit logs. This post shows why Event 1644 misses LDAP Ping and where defenders can still catch it.
- Read more about When "Moderate" Means "Sometimes"Blog Post
When "Moderate" Means "Sometimes"
The same NTLM leakage primitive that got patched in the Snipping Tool exists in Windows Explorer's search: handler. No CVE. No fix. If your patching relies on CVE coverage, you have a blind spot.
- Read more about dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025Blog Post
dMSA Ouroboros: Self-Sustaining Credential Extraction in Windows Server 2025
A fully patched Windows Server 2025 domain is vulnerable to dMSA Ouroboros—a self-sustaining credential extraction technique requiring only standard delegated permissions. Learn how it works, why remediation fails, and how to detect it.
