Last Friday, at BruCON 0X11, @olafhartong.nl showcased his research on how defensive tooling (#EDR) can provide attackers with opportunities for deception and disruption. Trusting your tooling blindly can be a mistake. You need to make sure you can rely on your security data.

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-gl...

BruCON 0X11 is just a few days away. @olafhartong.nl will present his talk “# I’m in your logs now, deceiving your analysts and blinding your EDR” on Friday Sept 26. Olaf will show how defensive tooling (EDRs) can provide attackers with opportunities for deception and disruption.

COFFing out the Night Soil aff-wg.org/2025/09/10/c... A COFF-focused Crystal Palace update: * internal COFF normalization & section group merging * Crystal Palace can now export COFF * I added COFF merging to the spec language too Linker stuff.

Slides from @olafhartong.nl's talk at #bhusa (I’m in your logs now, deceiving your analysts and blinding your EDR) are available now: i.blackhat.com/BH-USA-25/Pr...

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs. github.com/olafhartong/... Slides available here: github.com/olafhartong/...

It's has been 5 years already! Together with 15 Falcons, we celebrated the 5-year anniversary of FalconForce in style. We teamed up in Greece and went on an amazing trip to sunny Santorini. A trip to remember 🇬🇷 ☀️ 🦅

We are proud to introduce #dAWShund to the world: a framework for putting a leash on naughty AWS permissions. dAWShund helps blue and red teams find resources in #AWS, evaluate their access levels and visualize the relationships between them. falconforce.nl/dawshund-fra... #blueteaming #redteaming

Upcoming new FalconForce Sentry Respond webinar! Register now: events.teams.microsoft.com/event/0447b5... Join us on Tuesday 1 July 2025, 16:00h CEST, to get actionable insights on on how we support #SOCs enhancing their efficiency. Facilitated by FalconForce specialists @olafhartong.nl and Henri.

I wanted a script I could run on a new Windows box that would install sysmon with @olafhartong.nl's configs, and set logging best practices with Zach Mathis' (Yamato Security) "EnableWindowsLogSettings" configs. So I made one! Feel free to inspect it and repurpose. gist.github.com/ecapuano/42f...

For the fourth consecutive year, we will be back in Las Vegas to facilitate our Advanced Detection Engineering in the Enterprise training! Get your ticket before May 25. More information and registration: www.blackhat.com/us-25/traini... #detectionengineering #training

We held our first webinar and had a great time presenting our insights in delivering and maintaining high-fidelity bespoke detection content! Did you miss it? Or forgot to make a note? We got you covered with the recording and a PDF with the slides: falconforce.nl/webinar-sent...

It’s amazing to realize that it has been 5 years already! So proud of the team of amazing individuals who I learn from and enjoy working with every day 🥂🎉🥳

Today at 4PM CET / 3PM GMT / 10AM EST / 7AM PST, we'll host a webinar on our Managed Detection Engineering service. There is still time to join! events.teams.microsoft.com/event/700051... Looking forward to seeing you there.

n our latest blog, we follow Arnau (www.linkedin.com/in/arnauorte...) on his journey to leverage #WinRM plugins for lateral movement. A deep rabbit hole that ultimately led to a custom plugin, #BOF and a solid detection in our #FalconFriday repository 🦅 falconforce.nl/exploring-wi...

Achievement unlocked, my first blog with SpecterOps 🤗 This post looks at ADFS OAuth2 support, Device Registration, Enterprise PRT, and a brain dump of things that I didn’t want to leave sat on Notion. buff.ly/4j41VQU

Adding to my ETW research toolkit, a tiny program to consume information from a provider with as little overhead as possible. PockETWatcher, a tool to get the essential information from a ETW provider to the CLI or a JSON file github.com/olafhartong/...

While working on some ETW research I whipped up this dirty script to enumerate registered Trace logging providers and more importantly their DACLs which I needed mostly. gist.github.com/olafhartong/...

FalconHound 1.4.2 is out! * Added Managed identity authentication for Azure based inputs (KeyVaults, MDE, Sentinel, GraphAPI) * Added report command line option and actions * Added HTML output option Grab it here > github.com/FalconForceT...

No sleep for us! We will facilitate a 3-day workshop version of our Advanced Detection Engineering in the Enterprise training at #insomnihack in Switzerland. Registration is open! Information and registration: insomnihack.ch/workshops/ad... #detectionengineering #training #purpleteam

Upcoming FalconForce Sentry Detect webinar! Register now: events.teams.microsoft.com/event/700051... Join us on Wed 22 January 2025, 16:00h CET, to get actionable insights on how we deliver and maintain high-fidelity bespoke detection content. Facilitated by @olafhartong.nl and Henri (x.com/0xffhh).

Detection Engineering is sometimes hard, and may fail. Still a lot of things can be learned by the process. In this blog I cover a lot. I had a detection, currently it's broken but MS is on it :D medium.com/falconforce/...

At this year's #DEATHCon I was fortunate enough to present my workshop on #Kusto graph semantics. Now I release it for free to everybody. #KQL #Security #Kraph

Good lineup of books! www.humblebundle.com/books/hackin...

🛡️Windows Firewall and WFP are only two ways to silence an #EDR agent. 📢In my latest blog post I discuss another network based technique to prevent data ingest and ways to detect it. And if you want even more, checkout part 2 released by @Cyb3rMonk Link in the post

Anyone else experiencing ‘random’ missing events in MicrosoftGraphActivityLogs? As an example, we ran azurehound 6 times from 2 machines and only get results for 3 runs. Of which the volume of events differs immensely. All actions were identical. Also in different tenants we had the same result.

Really Logitech? Why would I want AI in my mouse driver….

It was fun speaking at the first KustoCon. All videos are up on YouTube. www.youtube.com/playlist?lis... I’m converting my talk into a blog at the moment so you don’t have to listen to me 😆 that will be out in the next week or two.

We are happy to announce our collaboration with Division5 in hosting our Advanced Detection Engineering in the Enterprise training in Brisbane, Australia in Feb 2025. Learn more from @olafhartong.nl on detection engineering. Register via: division5.io/ADEitE2025.h...

Do you want to work with @bellingcat.com to develop open source research tools? ✨ Our Tech Fellowship is open now! 👇 www.bellingcat.com/bellingcat-t... (I can't promise you'll look as diligent as the model in this image, but I can promise we'll review your application 📃👀)

Crazy storm today, so much fun doing over 40kph on the beach.

The DEATHCon crew has been putting together all the feedback and catching up on sleep this week, but we're already excited to think about how to make it even better next year, with more in-person locations around the world!

Scrum teams assemble! Many companies have incorporated an agile #SDLC into their operations. With using DevOps also come new risks. In this new series of blogs, we have a look into #Azure #DevOps #security from an attacker’s and defender’s perspective. falconforce.nl/azure-devoop...

A quick tour of new functions in BARK that support Azure Key Vault tradecraft research, including a walk-through of how an adversary may chain these functions together as part of an attack path: posts.specterops.io/azure-key-va...

@DEATHCon2024 has kicked off in Europe. In Amsterdam @fabian_bader is hosting a live workshop on Kusto Graph Semantics

We're excited to announce the release of ProcDump 1.0 for Mac. ProcDump functionality is now available on Windows, Linux, and macOS. Get the tools at sysinternals.com. See what's new on the Sysinternals Blog:

On Monday February 3 to Thursday February 6, 2025 we'll be facilitating our Advanced Detection Engineering training in the beautiful Brisbane. Come join us! Hosting and registration kindly facilitated by Division5 division5.io/ADEitE2025.h...

FalconHound just got some new features, v1.2.0 is out! - added CrowdStrike Falcon LogScale / Humio query support - added Azure Data Explorer output support - added source skipping option with the -skip flag -improved some queries Grab it here! github.com/FalconForceT...

FalconHound - A blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log aggregation tool github.com/FalconForceT...

Happy Friday! Another blog in the #MDE internals series is out. I dove into Live Response action telemetry after we used it in a red team and wanted to build detections medium.com/falconforce/... I wrote DefenderHarvester to collect telemetry and much more from the service APIs