🧰 Windows Server

The items that name it 8

• From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths
  writeup2026-10-30
• Inside an Oracle Database SQL Injection Attack | Huntress
  writeup2026-08-05

  Underlying OS of the compromised server; attacker pivoted from Oracle database (oracle.exe) to OS-level command execution with SYSTEM permissions

• AI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
  writeup2026-07-08

  Domain-joined Windows Server accessed via RDP using pre-compromised credentials.

• From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
  writeup2026-06-24

  Domain Controller role; Windows Filtering Platform (WFP) generates Event 5156 for TCP connections to LSASS.exe

• The Devil, Eight Million Emails, and a Whole Lot of Milk | Phishing Stager Exposed
  writeup2026-06-15It is written here as Windows Server (RD Session Host / terminal server).

  The compromised host; ran RD Session Host, RDWeb Access portal, and RD Gateway role, exposed directly to the internet

• nikaiw/VMkatz
  repo2026-05-22

  target OS for credential extraction, x86 PAE + x64

• Oh my .. ! - Suspicious network traffic detected including Ransomware
  writeup2025-01-22It is written here as Windows server (unspecified).

  Customer server thought not internet-exposed but found to actually be internet-facing on port 25 (SMTP)

• Two in a row - You mitigated wrong (Kentico CMS RCE)
  writeup2024-03-06

  Host running the compromised IIS/Kentico installation; PrintNotifyPotato.exe placed in C:\ProgramData for privilege escalation