Look.Think.Do; Co-founder @OrphanedLand, #OrientalRockOrchestra, #TenRoot
| Github | https://github.com/yossisassi/ |
| Github | https://github.com/yossisassi/ |
Fun fact: ThinkPads are call ThinkPads because there used to be actual IBM Think pads. Made out of paper.
(I found mine on eBay, they pop up from time to time)
https://techcrunch.com/2025/10/27/apple-says-u-s-passport-digital-ids-are-coming-to-wallet-soon/
spectactular!
now when someone breaks into your icloud account because 2fa wasnt on, they can get your passport!
oh shit who would have thought that if you just stop paying ransoms they'd stop demanding them
Slides & tools demonstrated from my talk @ 'The Hack Summit' 2025 - The 'Hacktive' Directory toolkit: domain-wide forensics for exploitation/persistence indicators - YossiSassi/...
While at it - I updated my forensic investigation script for getting add/remove members from AD groups, and added identifying temporary members (TTL operations) - a particularly elusive operation. does not appear in logs and no replication metadata removeDate:
https://github.com/YossiSassi/Get-ADGroupChanges
e.g: if I added a DA for 5 minutes- It didn't receive admincount=1 and the removal won't appear in monitoring products, only the add. updated tool identifies there was an addition of temporary member that expired
PowerShell module for managing Time-Based Group Membership - temporarily add/get group members using the TTL optional feature of AD. Includes functions to test the pre-requisites, add a TTL member ...
