https://jakestech.info/ Microsoft Technologies, Security, and Homelab 2026-07-19T15:18:43-05:00 Jacob https://jakestech.info/ Jekyll © 2026 Jacob /assets/img/favicons/favicon.ico /assets/img/favicons/favicon-96x96.png 2026-05-17T22:00:00-05:00 2026-05-17T22:00:00-05:00 https://jakestech.info/posts/snaffler/ Jacob

Objective Snaffler is a post-exploitation reconnaissance tool designed for Active Directory environments. It enumerates accessible network shares to identify sensitive information such as credentials, configuration files, scripts, and other security-relevant artifacts. The tool uses rule-based classification to reduce noise and surface high-value findings, enabling efficient identification of ...

2026-03-29T16:30:00-05:00 2026-03-29T16:30:00-05:00 https://jakestech.info/posts/LolDrivers/ Jacob

Objective The objective of this exercise is to create a custom detection rule that identifies the execution or loading of known vulnerable or malicious drivers, commonly referred to as LOLDrivers (Living Off the Land Drivers). By leveraging publicly available LOLDrivers intelligence, the detection rule enables security teams to identify potential attempts to exploit legitimate signed drivers f...

2026-03-25T06:30:00-05:00 2026-03-25T06:30:00-05:00 https://jakestech.info/posts/active_directory_krbtgt_rotation/ Jacob

Objective The KRBTGT account is used by Kerberos for ticket-granting operations within Active Directory. This guide outlines the procedure to safely rotate the KRBTGT account password twice, ensuring both the current and previous Kerberos keys are invalidated. Rotating the KRBTGT password twice is required because Active Directory maintains both a current and previous password hash. Performin...

2026-01-13T21:00:00-06:00 2026-01-13T21:00:00-06:00 https://jakestech.info/posts/ntds.di_hygiene_check_with_haveibeenpwned/ Jacob

Objective The objective of this project is to improve Active Directory security by identifying user accounts that are using passwords already exposed in known data breaches. This is achieved by safely extracting NTLM password hashes from Active Directory and comparing them against the HaveIBeenPwned dataset, without ever accessing or revealing cleartext passwords. By highlighting compromised or...

2025-04-28T12:00:00-05:00 2025-04-28T12:00:00-05:00 https://jakestech.info/posts/logic_app-client_secret_expiration_notification/ Jacob

Objective This guide demonstrates how to build an Azure Logic App that monitors Microsoft Entra ID application secrets and automatically notifies administrators before those secrets expire. The solution uses a system-assigned managed identity to authenticate to Microsoft Graph, eliminating the need to manage an application secret for the automation itself. After completing this guide, the Lo...