Clément Notin [Tenable] – Medium

Clément Notin [Tenable]

Clément Notin [Tenable]
in
Tenable TechBlog

Stealthy Persistence with “Directory Synchronization Accounts” Role in Entra ID

“Directory Synchronization Accounts” Entra role is very powerful while being hidden to admins, making it a perfect stealthy backdoor 🙈

Jun 3

Stealthy Persistence with “Directory Synchronization Accounts” Role in Entra ID

Jun 3

Clément Notin [Tenable]
in
Tenable TechBlog

Stealthy Persistence & PrivEsc in Entra ID by using the Federated Auth Secondary Token-signing Cert.

How attackers can add a 2nd token-signing certificate to an Entra ID federated authentication config for stealthy persistence & privesc 🙈

Jan 31

Stealthy Persistence & PrivEsc in Entra ID by using the Federated Auth Secondary Token-signing Cert.

Jan 31

Clément Notin [Tenable]
in
Tenable TechBlog

Entra Roles Allowing To Abuse Entra ID Federation for Persistence and Privilege Escalation

Which Entra ID (ex-Azure AD) roles allow configuring federated authentication, thus allowing persistence and privilege escalation 💥

Jan 9

Entra Roles Allowing To Abuse Entra ID Federation for Persistence and Privilege Escalation

Jan 9

Clément Notin [Tenable]
in
Tenable TechBlog

Code for Reading Windows Serialized Certificates

What are Windows “serialized certificates” found on disk? Which CryptoAPI function to open them? Why can’t we enumerate them sometimes?

Jul 5, 2023

Code for Reading Windows Serialized Certificates

Jul 5, 2023

Clément Notin [Tenable]
in
Tenable TechBlog

SMB “Access is denied” Caused by Anti-NTLM Relay Protection

Explanations of the “Microsoft network server: Server SPN target name validation level” hardening policy: what it does, how to…

Jan 11, 2023

SMB “Access is denied” Caused by Anti-NTLM Relay Protection

Jan 11, 2023

Clément Notin [Tenable]
in
Tenable TechBlog

Decrypt Kerberos/NTLM “encrypted stub data” in Wireshark

I often use Wireshark to analyze Windows and Active Directory network protocols, especially those juicy RPC 😉 But I’m often interrupted in…

Sep 28, 2022

Decrypt Kerberos/NTLM “encrypted stub data” in Wireshark

Sep 28, 2022

Clément Notin [Tenable]
in
Tenable TechBlog

Don’t make your SOC blind to Active Directory attacks: 5 surprising behaviors of Windows audit…

Tenable.ad can detect Active Directory attacks. To do this, the solution needs to collect security events from the monitored Domain…

Jul 6, 2021

Don’t make your SOC blind to Active Directory attacks: 5 surprising behaviors of Windows audit…

Jul 6, 2021

Clément Notin [Tenable]

Clément Notin [Tenable]

Security researcher, working at Tenable Research https://www.tenable.com/research. Specialized in identity security (Active Directory / Entra ID)

Help
Status
About
Careers
Press
Blog
Privacy
Terms
Text to speech
Teams