Kerberoast Guy • @RedSiege CEO • IANS Faculty • Former SANS SEC560 Author, Senior Instructor • Packers Owner #GoPackGo • Work Req: redsiege.com/contact
Joined April 2008
- Tweets 20,225
- Following 594
- Followers 17,705
- Likes 54,308
1,813 Photos and videos
Great stuff from @hardwaterhacker
In this Red Siege Knowledge Brief, CEO @TimMedin sits down with Principal Security Consultant Mike Saunders to explore a clever red team technique: concealing shellcode within image files to enable stealthy payload delivery.
youtu.be/_XKDH5rjixc?si=JEMJ…
1
605
Tim Medin retweeted
2
3
712
Tim Medin retweeted
11 Dec 2025
Don't forget to grab yer tickets for WWHF @ Mile High 2026! -> wildwesthackinfest.com/wild-…
Check out @TimMedin's talk, "Death by Dashboards : Moving the Needle on What Actually Matters," from Wild West Hackin' Fest - Deadwood 2025! youtube.com/watch?v=BgxWaLUr…
2
6
1,185
Microsoft created Get-KerbEncryptionUsage.ps1 to query the event log to see which encryption types Kerberos used within your environment.
Run this, find the ones that MUST use RC4, and burn the rest. Then figure out how to upgrade the others from RC4 or pick a great password.
"By mid-2026, ... Windows Server 2008 and later to only allow AES-SHA1 encryption. RC4 will be disabled by default and only used if a domain administrator explicitly configures an account or the KDC to use it."
microsoft.com/en-us/windows-…
5
4
1,144
"By mid-2026, ... Windows Server 2008 and later to only allow AES-SHA1 encryption. RC4 will be disabled by default and only used if a domain administrator explicitly configures an account or the KDC to use it."
microsoft.com/en-us/windows-…
2
1,462
Is there a modern equivalent of Highlighter (originally from Mandiant) that allows you to quickly rip through large text and log files? Ideally something that works on Mac or Linux.
Original: fireeye.market/apps/211376
1
3
842
Tim Medin retweeted
4 Dec 2025
Worst "pentest" report finding ever?
Title: "Internet accessible authentication prompt"
Evidence: Screenshot of a VPN login
Recommended Remediation: "Verify the business purpose for this service to be available from the Internet. This service should be disabled if there is no
business purpose for it."
The people pulling this stuff off should not only be ashamed, but should not be allowed to use computers anymore.
6
4
28
4,099
Me with my driver on every par 5
1
4
577