Horizon Secured

Horizon Secured

@horizon-secured.com

Master Windows & Active Directory Security—From Defense to Attacks.

17 followers67 following30 posts

Horizon Secured
@horizon-secured.com

🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 – 𝗗𝗛𝗖𝗣 𝗜𝘀𝘀𝘂𝗲𝘀 𝗔𝗳𝘁𝗲𝗿 𝗝𝘂𝗻𝗲 𝗨𝗽𝗱𝗮𝘁𝗲𝘀 Microsoft just confirmed a bug affecting DHCP on all major Windows Server versions (2016–2025). Clients may fail to renew IPs after applying June 2025 updates. 🛠️ Fix is on the way. Stay safe, Dave #PatchTuesday #HorizonAlert

Horizon Secured
@horizon-secured.com

🚨 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 SAP is having a rough season. Another critical vulnerability just dropped — in 𝗦𝗔𝗣 𝗡𝗲𝘁𝗪𝗲𝗮𝘃𝗲𝗿 (𝟵.𝟲), involving missing authorization checks. Rated highly for a reason. There’s more in this month’s advisory, but this one definitely stands out. 📎 support.sap.com/en/my-suppor... #SAP

support.sap.comSAP Security Patch Day - June 2025SAP security Patch Day Bulletin
Horizon Secured
@horizon-secured.com

🛠️ 𝗧𝘄𝗼 𝗮𝗻𝗻𝗼𝘆𝗶𝗻𝗴 𝗯𝘂𝗴𝘀—𝗳𝗶𝗻𝗮𝗹𝗹𝘆 𝗳𝗶𝘅𝗲𝗱! ​ ✔️ Firewall profile issue on Windows Server 2025 DCs ✔️ Kerberos cert-based auth issues (WHfB, Device PKINIT) ​ Both resolved in the 𝗝𝘂𝗻𝗲 𝟮𝟬𝟮𝟱 updates ✅ ​ 📬 You can subscribe to my newsletter to get all the details as soon as possible. ​ #PatchTuesday

Horizon Secured
@horizon-secured.com

It looks like the issue was acknowledged just for ​Windows 10 22H2 and Windows 10 Enterprise LTSC 2021. I have definitely seen similar problem also on Windows 11, can somebody confirm or deny this ?

Horizon Secured reposted

martechnewser
@cheinyeanlim.bsky.social

LockBit’s dark web empire suffered a major blow after a May 2025 breach exposed internal chats, affiliate data, Bitcoin wallets, and attack details-shaking trust in the ransomware giant and fueling law enforcement investigations. #CybersecurityNews pupuweb.com/has-lockbits...

pupuweb.comHas LockBit’s Dark Web Empire Collapsed? Shocking Data Leak Exposes Ransomware Secrets - PUPUWEBWill the LockBit Hack Spell Disaster? Devastating Breach Unveils Ransomware Operation The notorious LockBit ransomware group, infamous for its
Horizon Secured
@horizon-secured.com

🚨 𝗠𝗶𝗰𝗿𝗼𝘀𝗼𝗳𝘁 𝗣𝗮𝘁𝗰𝗵 𝗧𝘂𝗲𝘀𝗱𝗮𝘆 - 𝟳 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆𝘀 𝘁𝗵𝗶𝘀 𝗠𝗮𝘆 🚨 5 exploited 4 = gain SYSTEM privileges Targets: CLFS, DWM, Defender, Visual Studio You don't have time to dig — I do. Subscribe for full alerts: 👉 horizon-secured.com/newsletter/ #CyberSecurity #ZeroDay #Infosec #PatchTuesday

Horizon Secured
@horizon-secured.com

1/4 🔒 Secure Bits 💡 𝗦𝗜𝗗 𝗛𝗶𝘀𝘁𝗼𝗿𝘆 𝗰𝗮𝗻 𝗯𝗲 𝗮 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀 𝗮𝘁𝘁𝗿𝗶𝗯𝘂𝘁𝗲. Do you use it in your environment? Originally, SID History was used during Active Directory migrations—to let migrated users access old resources by injecting old SIDs into the SIDHistory attribute.

View full thread
Horizon Secured
@horizon-secured.com

3/4 It’s also been abused in multi-domain environments to escalate from a child domain to the parent (𝘀𝗼𝗺𝗲𝘁𝗵𝗶𝗻𝗴 𝘆𝗼𝘂 𝘀𝗵𝗼𝘂𝗹𝗱 𝗻𝗲𝘃𝗲𝗿 𝗿𝗲𝗹𝘆 𝗼𝗻). ⚠ Even if you think you don’t use SIDHistory, regularly scan your environment for misconfigurations like this. (✅ You can use my tool ADProbe)

Horizon Secured
@horizon-secured.com

4/4 If you discover SIDHistory in your environment, it may be old migration residue or a sign of compromise. Either way → 𝗶𝗻𝘃𝗲𝘀𝘁𝗶𝗴𝗮𝘁𝗲 𝗮𝗻𝗱 𝗰𝗹𝗲𝗮𝗻 𝗶𝘁 𝘂𝗽. 👉 Have you checked your SIDHistory lately? academy.horizon-secured.com/p/adprobe #SIDHistory #CyberSecurity #ActiveDirectory #SecureBits

Horizon Secured
@horizon-secured.com

1/4 🔒 Secure Bits 💡 𝗦𝗜𝗗 𝗛𝗶𝘀𝘁𝗼𝗿𝘆 𝗰𝗮𝗻 𝗯𝗲 𝗮 𝗱𝗮𝗻𝗴𝗲𝗿𝗼𝘂𝘀 𝗮𝘁𝘁𝗿𝗶𝗯𝘂𝘁𝗲. Do you use it in your environment? Originally, SID History was used during Active Directory migrations—to let migrated users access old resources by injecting old SIDs into the SIDHistory attribute.

Horizon Secured
@horizon-secured.com

2/4 But here’s the risk 👉 𝘄𝗵𝗮𝘁𝗲𝘃𝗲𝗿 𝗦𝗜𝗗 𝘆𝗼𝘂 𝗶𝗻𝗷𝗲𝗰𝘁 𝗯𝗲𝗵𝗮𝘃𝗲𝘀 𝗹𝗶𝗸𝗲 𝗮 𝗿𝗲𝗮𝗹 𝗺𝗲𝗺𝗯𝗲𝗿𝘀𝗵𝗶𝗽. For example: If you inject the Enterprise Admins group SID (S-1-5-21-*-519) into a user’s SIDHistory, that user gets Enterprise Admin privileges without actually being in the group. —𝗶𝘁’𝘀 𝘀𝘁𝗲𝗮𝗹𝘁𝗵𝘆 𝗮𝗻𝗱 𝗽𝗼𝘄𝗲𝗿𝗳𝘂𝗹.

Horizon Secured reposted

Nathan McNulty
@nathanmcnulty.com

Oh, I should probably have mentioned that the vulnerable DSA account also has "Run as service" permissions on all your DC's.....

Nathan McNulty@nathanmcnulty.com

⚠️ If you are using SAM-R, especially with Defender for Identity, you may be vulnerable to a downgrade attack! ⚠️ This was so dangerous they are disabling SAM-R queries in the coming weeks. Only classic sensor is affected, not XDR agent sensor (3.x). learn.microsoft.com/...

Horizon Secured reposted

BleepingComputer
@bleepingcomputer.com

Forescout Vedere Labs security researchers have linked ongoing attacks targeting a maximum severity vulnerability impacting SAP NetWeaver instances to a Chinese threat actor.

bleepingcomputer.comChinese hackers behind attacks targeting SAP NetWeaver serversForescout Vedere Labs security researchers have linked ongoing attacks targeting a maximum severity vulnerability impacting SAP NetWeaver instances to a Chinese threat actor.

Horizon Secured reposted

Dare Obasanjo
@carnage4life.bsky.social

Fired employee, Davis Lu, has claimed he’s not guilty of writing a “IsDLEnabledinAD” function that checked if Davis Lu was still in the company’s Active Directory and if not deleted a bunch of files and sabotaged his former employer’s network. A crazy coincidence if true.

arstechnica.comDeveloper convicted for “kill switch” code activated upon his terminationSoftware developer plans to appeal after admitting to planting malicious code.
Horizon Secured
@horizon-secured.com

🔒 Secure Bits 💡 “The trust relationship between this workstation and the primary domain failed.” Do you really understand what this message means? Let’s break it down. 👇 #Windows #ActiveDirectory

View full thread
Horizon Secured
@horizon-secured.com

𝗤𝘂𝗶𝗰𝗸 𝗿𝗲𝗰𝗮𝗽: ▪️Secure Channel = communication protected by Session Key based on ▪️Computer Account Password. ▪️CurrVal & OldVal = help with replication, not broken trust. ▪️Rejoin is not necessary — fix it with Test-ComputerSecureChannel when possible.

Horizon Secured
@horizon-secured.com

🔒 Secure Bits 💡 “The trust relationship between this workstation and the primary domain failed.” Do you really understand what this message means? Let’s break it down. 👇 #Windows #ActiveDirectory

View full thread
Horizon Secured
@horizon-secured.com

𝗙𝘂𝗻 𝗳𝗮𝗰𝘁: Windows stores two versions of the computer password in the registry: ▪️Current password (CurrVal) ▪️Previous password (OldVal) 🔎 But... this doesn't help when both passwords are already outdated across domain controllers. (OldVal mainly exists to handle replication delays)

Horizon Secured
@horizon-secured.com

𝗛𝗼𝘄 𝘁𝗼 𝗳𝗶𝘅 𝗶𝘁 𝗽𝗿𝗼𝗽𝗲𝗿𝗹𝘆? You don't need to rejoin the domain! Instead, use the PowerShell cmdlet: 𝘛𝘦𝘴𝘵-𝘊𝘰𝘮𝘱𝘶𝘵𝘦𝘳𝘚𝘦𝘤𝘶𝘳𝘦𝘊𝘩𝘢𝘯𝘯𝘦𝘭 -𝘙𝘦𝘱𝘢𝘪𝘳 -𝘊𝘳𝘦𝘥𝘦𝘯𝘵𝘪𝘢𝘭 (𝘎𝘦𝘵-𝘊𝘳𝘦𝘥𝘦𝘯𝘵𝘪𝘢𝘭) ⚡ This will reset the secure channel. ⚠️ Heads-up: You need an account with enough privileges over that computer account - not always ideal

Horizon Secured
@horizon-secured.com

🔒 Secure Bits 💡 “The trust relationship between this workstation and the primary domain failed.” Do you really understand what this message means? Let’s break it down. 👇 #Windows #ActiveDirectory

Horizon Secured
@horizon-secured.com

When a domain computer boots, it tries to establish a Secure Channel with a domain controller. This channel is protected by a Session Key — calculated using the Computer Account Password. ✅ If both sides (computer and DC) calculate the same session key → you're good. ❌ If not → you see the error

Horizon Secured
@horizon-secured.com

𝗪𝗵𝘆 𝗱𝗼𝗲𝘀 𝘁𝗵𝗶𝘀 𝗵𝗮𝗽𝗽𝗲𝗻? Most commonly when the computer tries to authenticate with an outdated password — for example, after restoring a VM snapshot older than 30 days.

Horizon Secured reposted

ransomNews
@ransomnews.online

Adding a layer: - too many people unaware of the risks

spencer@bsky.ethicalthreat.com

❌ Security theatre: - Buying tools no one configures - Policies no one enforces - Dashboards no one reads ✅ Real security: - Hardening endpoints - Restricting access based on least privilege - Testing assumptions through security assessments - Closing the gaps attackers use to hurt your org

Horizon Secured reposted

Andrea P
@decoder-it.bsky.social

I just published a blog post where I try to explain and demystify Kerberos relay attacks. I hope it’s a good and comprehensive starting point for anyone looking to learn more about this topic. ➡️ decoder.cloud/2025/04/24/f...

decoder.cloudFrom NTLM relay to Kerberos relay: Everything you need to knowWhile I was reading Elad Shamir recent excellent post about NTLM relay attacks, I decided to contribute a companion piece that dives into the mechanics of Kerberos relays, offering an analysis and …
Horizon Secured
@horizon-secured.com

🔒 Secure Bits 💡 Need different password policies in Active Directory? You can't just create two GPOs. Why? GPO password policy only applies to computers—not users. ✅ Use Fine-Grained Password Policies to target specific users or groups. Set via Active Directory Admin Center. #ActiveDirectory

Horizon Secured
@horizon-secured.com

🚨Horizon Alert – April 2025🚩 ​ 𝗢𝗻𝗲 𝗭𝗲𝗿𝗼-𝗗𝗮𝘆 – 𝗖𝗩𝗘-𝟮𝟬𝟮𝟱-𝟮𝟵𝟴𝟮𝟰 ▪️Privilege Escalation to SYSTEM ▪️Exploited in the wild ▪️Low complexity + low privileges = patch ASAP ​ Prioritize exposed/internet-facing systems. ​ 𝗦𝘂𝗯𝘀𝗰𝗿𝗶𝗯𝗲 𝘁𝗼 𝗛𝗼𝗿𝗶𝘇𝗼𝗻 𝗔𝗹𝗲𝗿𝘁 (𝗳𝗿𝗲𝗲): 👉 horizon-secured.com/newsletter/

You are up to date.