u/Infosecsamurai

Dropped a new episode this week covering ShieldBreak, a privilege-escalation exploit from NightMare Eclipse (MSNightmare) that exposes vulnerabilities in Windows kernel protection mechanisms and privilege-boundary enforcement.

On the red team side, we walk through the exploitation workflow from low-privilege user to SYSTEM and how attackers leverage this for post-compromise privilege escalation and persistence.

On the blue team side, we break down detection — process and kernel activity indicating exploitation, Windows Error Reporting artifacts, Alternate Data Streams tied to ShieldBreak, and deployable detection rules.

Covers T1548, T1134, and T1547 with the full red vs. blue format.

Reference: https://github.com/MSNightmare/ShieldBreak

Video: https://youtu.be/latQbTJDAPo

Happy to discuss exploitation techniques or answer questions about detection in the comments.

Dropped a new episode this week covering CertiGhost — a critical vulnerability in Windows Certificate Services that allows attackers to forge certificates and achieve persistent lateral movement across AD infrastructure without needing credentials.

On the red team side, we walk through the full exploitation chain: how to leverage CertiGhost to issue rogue certificates for domain controllers and service accounts, then use those certificates to move laterally and establish persistence across your entire environment.

On the blue team side, we break down detection — what certificate issuance anomalies look like in CA logs, what unusual certificate requests fire, and how to build alerting around PKI exploitation.

Covers T1649 and T1550.003 with the full red vs. blue format.

Resources:

• CertiGhost PoC: https://github.com/aniqfakhrul/CVE-2026-54121
• NetExec: https://github.com/Pennyw0rth/NetExec

Video: https://youtu.be/srH-SlkL2tA

Happy to discuss the exploitation techniques or answer questions about the tradecraft in the comments.

New episode of The Weekly Purple Team covering Pass-the-Ticket, and I wanted to share it here since it might be useful for people working on detection coverage for T1550.003. In this episode, we are Stealing Kerberos Tickets Past Defender and Credential Guard using AutoPtT

Video: https://youtu.be/s5nd8u4EKFI

What's covered:

• Enumerating logon sessions and cached Kerberos tickets on Windows 11
• Using AutoPtT to export a TGT by LogonId — it's a standalone PtT tool (C#/C++/Crystal/Python/Rust) built as an alternative to Rubeus/Mimikatz for this specific attack
• Taking that exported ticket and reusing it for authentication from a Linux box, not just staying inside the Windows ecosystem
• Detection side: what telemetry actually surfaces this LSASS access patterns, abnormal logon session behavior

Reference:
https://github.com/ricardojoserf/AutoPtT

Also touched on Credential Guard and Defender as mitigations — Credential Guard blocks the classic LSASS-memory extraction path, but it's not comprehensive coverage for PtT broadly, and rollout consistency across a fleet is worth double-checking rather than assuming.

Curious if others here are seeing PtT attempts that specifically try to pivot off-host post-export, or if most of what you're catching is still contained to the Windows side.

I have been experimenting with using Claude Sonnet + OpenClaw to see how far natural-language prompts can go for driving actual offensive tooling, and it went further than I expected. No MCP, no RAG — just Claude Code and OpenClaw wired together.

What it's doing so far:

• A single prompt kicks off a Kerberoasting attack.
• Another prompt runs Certipy and enumerates ADCS misconfigurations/vulnerabilities
• On the defensive side, it also helped reverse an obfuscated PowerShell Empire beacon

The interesting part isn't any individual technique (nothing here is new tradecraft), it's watching the model chain together multi-step, tool-driven workflows from a single prompt — deciding what to run, parsing output, and adjusting next steps.

I recorded the full setup (deploying OpenClaw, Slack integration, configuring search, and the actual attack/analysis prompts) here if anyone wants to reproduce it: https://youtu.be/a1rNQ3GbGnQ

Curious if others here have been playing with similar AI-driven tooling for engagements — what's held up well vs. where it's fallen flat for you?