Hacker at @OutsiderSec. Researches AD and Azure (AD) security. Likes to play around with Python and write tools that make work easier.
Joined December 2017
- Tweets 2,508
- Following 206
- Followers 29,864
- Likes 4,464
183 Photos and videos
I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-global…
138
903
3,185
475,260
Releasing Tunnel Vision Toolkit, part of my @x33fcon talk on Microsoft Global Secure Access.
Includes BOFs to assist in engagements where you face GSA, plus a rogue client that lets you connect to internal resources from unmanaged devices.
github.com/ar0x4/tunnel-visi…
2
36
85
9,620
Dirk-jan retweeted
Jun 11
just wrapped up @OutsiderSec’s Offensive Entra ID training with @_dirkjan. He is in fact #thegoat 🐐
it was literally the best Entra ID training going into the nitty gritty details including agent identity blueprints 🔥
1
12
1,428
Dirk-jan retweeted
Implementing a 22-step WebAuthn validation flow is hard — even for co-authors of the spec. At #BHUSA, I'll be presenting "Pass-the-Passkey": a new family of attacks bypassing phishing-resistant MFA. Replay. Relay. Tamper. Spoof. 3 new vulns. 20 attacks. 5 OSS tools.
Jun 4
#BHUSA will be here before we know it.
This year our team will share the tradecraft, research, & attack path insights shaping modern offensive & defensive security.
🎓 5 hands-on trainings
🎤 3 technical briefings
🛠️ 5 Arsenal sessions
Learn more: specterops.io/black-hat/
4
16
2,818
Dirk-jan retweeted
May 14
@sannemaasakkers and @_dirkjan on stage together at @NorthSec_io talking about threat actors using researcher knowledge in cloud attacks
1
26
3,128
And now you don't 🙃
Now I see you @_dirkjan 😁
Blog post including ROADrecon detection based on AADGraphActivityLogs is coming very soon(tm)
8
35
260
30,398
Dirk-jan retweeted
May 6
If you came to SOCON, you may have seen the fireside chat on Ouroboros (if you weren't too busy counting my "urm"s 😝). The blog post is now live, detailing how we can use Dev-Tunnels for lateral movement, and allow pivoting from GitHub/Entra ID access. specterops.io/blog/2026/05/0…
6
49
188
27,622
Dirk-jan retweeted
May 8
I published a new "security research" post, and for once, it’s not about Windows 😅
This time I took a look at the myAudi connected vehicle platform and its APIs..🤓
Curiosity drives security research, no matter the target
Read it here 👇
decoder.cloud/2026/05/08/oh-…
2
11
29
4,043
One month to go until the next public edition of my Entra ID course in The Hague. Working on some roadrecon and roadtx updates from my backlog, and new content on agent identities!
Tickets are still available via events.outsidersecurity.nl/e…
2
10
52
4,321
Dirk-jan retweeted
May 4
Today is a good day! #AADGraphActivityLogs are finally there!
@_dirkjan: We finally get the opportunity to hunt you down 🛡️
Schema: learn.microsoft.com/en-us/az…
4
28
142
14,097
Dirk-jan retweeted
Apr 30
🛸 👽 We have published this year's agenda with the talks for the AREA41 security conference 2026 🛸 👽
We are excited - hope you too!
➡️ Check them out at: a41con.ch/#schedule
📅 June 18-19. 2026, Zürich
🎫 Ticket sale May 5th @ 13:00 pretix.eu/DC4131tickets/A41-…
9
14
2,031
Dirk-jan retweeted
More talks for the @WEareTROOPERS #TROOPERS26 AD & Entra ID Security Track accepted, featuring @kidtronnix, @LeGuideDuSecOps, @_dirkjan, @DrAzureAD, @al3x_n3ff & others
linkedin.com/feed/update/urn…
7
39
14,225
Looks like the conference agenda for the next few months is filled in! First up will be @NorthSec_io in Montreal, where I'll talk with @sannemaasakkers about cloud research versus real-world attacks.
1
1
20
3,062
Last but not least I'll also be back at @WEareTROOPERS at the end of June. Especially excited for that one as it's kind of full circle from my first real conference talk ever in 2019 to this one in 2026. Looking forward to seeing everyone at one of these conferences 😀.
1
4
909
Dirk-jan retweeted
📢 You already know FOCI, BroCI, and all the OAuth2.0 flows? But do you already know the secret token providers of Entra ID?
In my latest research post I explore how you can, hidden from the Defenders, request new access token.
cloudbrothers.info/en/avoid-… #EntraID #DefenderXDR
3
60
196
44,598