iiinova — where your digital self keeps evolving

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 26/08/2026

What if you could leverage Event Tracing for Windows (ETW) to manipulate telemetry data, challenging the trust placed in endpoint detection and response (EDR) tools? 👉 Have a look at our latest blog as presented earlier at Black Hat by @olafhartong.nl: falconforce.nl/in-your-logs...

011

Olaf Hartong @olafhartong.nl · 10/06/2026

Next August, we'll host our newly designed advanced defensive engineering training at BlackHat USA in Las Vegas. Next to detection engineering we'll also cover many important defensive security topics like enrichment, lifecycle management and AI. blackhat.com/us-26/traini...

011

Olaf Hartong @olafhartong.nl · 03/04/2026

Congrats man! Well deserved! Excited for you

030

Reposted by Olaf Hartong

SpecterOps @specterops.io · 23/02/2026

BloodHound maps attack paths. But what if you graphed incident data too? 📈 At #SOCON2026, @olafhartong.nl explores enriched incident graphs in Kusto, combining BloodHound with telemetry to reveal powerful correlations. Learn more & register ➡️ ghst.ly/socon26-bsky

011

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 19/01/2026

We’re happy to join #WWHF once more. @olafhartong.nl has prepared a talk on some great #EDR (follow up) research he has been working on: “I’m In Your Logs Again; Spoofing and Causing Chaos”. Join him in-person or online on February 13! Registration: wildwesthackinfest.com

032

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 20/11/2025

Microsoft recently published a new feature for Defender for Endpoint (#MDE) called Custom Collection. @olafhartong.nl explains what Custom Collection is and how it work in his blog: falconforce.nl/microsoft-de...

132

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 11/11/2025

@olafhartong.nl presented his research at #KustoCon on using #Kusto and Kusto Graph for something magical. Olaf investigated if it was possible to do the same thing as #BloodHound, but then only using Kusto Graph. He showcased the need for attack path management. Slides: github.com/olafhartong/...

011

Olaf Hartong @olafhartong.nl · 12/10/2025

This is getting into unintentional art 😆 props to the hotel ppl following you and making sure you get these rooms.

120

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 29/09/2025

Last Friday, at BruCON 0X11, @olafhartong.nl showcased his research on how defensive tooling (#EDR) can provide attackers with opportunities for deception and disruption. Trusting your tooling blindly can be a mistake. You need to make sure you can rely on your security data.

131

Reposted by Olaf Hartong

Dirk-jan @dirkjanm.io · 17/09/2025

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-gl...

dirkjanm.io

One Token to rule them all - obtaining Global Admin in every Entra ID tenant via Actor tokens

While preparing for my Black Hat and DEF CON talks in July of this year, I found the most impactful Entra ID vulnerability that I will probably ever find. One that could have allowed me to compromise ...

98738

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 17/09/2025

BruCON 0X11 is just a few days away. @olafhartong.nl will present his talk “# I’m in your logs now, deceiving your analysts and blinding your EDR” on Friday Sept 26. Olaf will show how defensive tooling (EDRs) can provide attackers with opportunities for deception and disruption.

032

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 29/08/2025

Slides from @olafhartong.nl's talk at #bhusa (I’m in your logs now, deceiving your analysts and blinding your EDR) are available now: i.blackhat.com/BH-USA-25/Pr...

032

Olaf Hartong @olafhartong.nl · 26/08/2025

Thank you. Glad you liked the speed talk edition!

020

Olaf Hartong @olafhartong.nl · 06/08/2025

During my #BHUSA talk I've released many ETW research tools, of which the most notable is BamboozlEDR. This tool allows you to inject events into ETW, allowing you to generate fake alerts and blind EDRs. github.com/olafhartong/... Slides available here: github.com/olafhartong/...

github.com

GitHub - olafhartong/BamboozlEDR: A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes.

A comprehensive ETW (Event Tracing for Windows) event generation tool designed for testing and research purposes. - olafhartong/BamboozlEDR

02515

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 06/06/2025

It's has been 5 years already! Together with 15 Falcons, we celebrated the 5-year anniversary of FalconForce in style. We teamed up in Greece and went on an amazing trip to sunny Santorini. A trip to remember 🇬🇷 ☀️ 🦅

021

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 11/04/2025

We are proud to introduce #dAWShund to the world: a framework for putting a leash on naughty AWS permissions. dAWShund helps blue and red teams find resources in #AWS, evaluate their access levels and visualize the relationships between them. falconforce.nl/dawshund-fra... #blueteaming #redteaming

1103

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 21/03/2025

Upcoming new FalconForce Sentry Respond webinar! Register now: events.teams.microsoft.com/event/0447b5... Join us on Tuesday 1 July 2025, 16:00h CEST, to get actionable insights on on how we support #SOCs enhancing their efficiency. Facilitated by FalconForce specialists @olafhartong.nl and Henri.

013

Reposted by Olaf Hartong

Eric Capuano @eric.zip · 01/03/2025

I wanted a script I could run on a new Windows box that would install sysmon with @olafhartong.nl's configs, and set logging best practices with Zach Mathis' (Yamato Security) "EnableWindowsLogSettings" configs. So I made one! Feel free to inspect it and repurpose. gist.github.com/ecapuano/42f...

gist.github.com

A PowerShell script for installing Sysmon and enabling best-practice audit logs.

A PowerShell script for installing Sysmon and enabling best-practice audit logs. - better_event_logging.ps1

47219

Olaf Hartong @olafhartong.nl · 26/02/2025

Looking forward to it. I’ve reported that issue to Microsoft almost 3y ago, it was closed as not important for immediate fixing. Persisted on the urge with several dev teams they have a kernel patch but still are reluctant to release it 😕due to uncertainty whether it could cause disruption.

020

Olaf Hartong @olafhartong.nl · 26/02/2025

I believe the stack covering westeu has longer running issues. Ingestion delays have been significantly higher there for over a year. This is also the region where they have a huge client pool so I have a gut feeling that region needs some more hardware or restructuring due to the success.

130

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 14/02/2025

For the fourth consecutive year, we will be back in Las Vegas to facilitate our Advanced Detection Engineering in the Enterprise training! Get your ticket before May 25. More information and registration: www.blackhat.com/us-25/traini... #detectionengineering #training

151

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 23/01/2025

We held our first webinar and had a great time presenting our insights in delivering and maintaining high-fidelity bespoke detection content! Did you miss it? Or forgot to make a note? We got you covered with the recording and a PDF with the slides: falconforce.nl/webinar-sent...

051

Olaf Hartong @olafhartong.nl · 25/01/2025

Thanks man, that means a lot. So are we 😄 We’re building something we think is super useful and hope to release that this year.

110

Olaf Hartong @olafhartong.nl · 24/01/2025

Now I want that based on my region for in my office. Beautiful

010

Olaf Hartong @olafhartong.nl · 24/01/2025

It’s amazing to realize that it has been 5 years already! So proud of the team of amazing individuals who I learn from and enjoy working with every day 🥂🎉🥳

281

Olaf Hartong @olafhartong.nl · 22/01/2025

Today at 4PM CET / 3PM GMT / 10AM EST / 7AM PST, we'll host a webinar on our Managed Detection Engineering service. There is still time to join! events.teams.microsoft.com/event/700051... Looking forward to seeing you there.

events.teams.microsoft.com

Microsoft Virtual Events Powered by Teams

040

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 20/01/2025

n our latest blog, we follow Arnau (www.linkedin.com/in/arnauorte...) on his journey to leverage #WinRM plugins for lateral movement. A deep rabbit hole that ultimately led to a custom plugin, #BOF and a solid detection in our #FalconFriday repository 🦅 falconforce.nl/exploring-wi...

061

Olaf Hartong @olafhartong.nl · 13/01/2025

This also accidentally mitigates several domain fronting opportunities for adversaries that could leverage several Microsoft.com subdomains for a long time.

010

Reposted by Olaf Hartong

XPN @xpnsec.com · 07/01/2025

Achievement unlocked, my first blog with SpecterOps 🤗 This post looks at ADFS OAuth2 support, Device Registration, Enterprise PRT, and a brain dump of things that I didn’t want to leave sat on Notion. buff.ly/4j41VQU

buff.ly

ADFS — Living in the Legacy of DRS

It’s no secret that Microsoft have been trying to move customers away from ADFS for a while. Short of slapping a “deprecated” label on it…

23618

Olaf Hartong @olafhartong.nl · 05/01/2025

At least I’m happy to see them use the metric system, the only proper standard.

100

Olaf Hartong @olafhartong.nl · 04/01/2025

Obviously, there are way more mature tools like SilkETW, Sealighter and ETWInspector. These tools are amazing. I just needed something fast and with basic CLI output while doing research on providers and certain events. This was just easier than reconfiguring them constantly.

020

Olaf Hartong @olafhartong.nl · 04/01/2025

Adding to my ETW research toolkit, a tiny program to consume information from a provider with as little overhead as possible. PockETWatcher, a tool to get the essential information from a ETW provider to the CLI or a JSON file github.com/olafhartong/...

github.com

GitHub - olafhartong/PockETWatcher: a tiny program to consume an ETW trace for research

a tiny program to consume an ETW trace for research - olafhartong/PockETWatcher

11910

Olaf Hartong @olafhartong.nl · 03/01/2025

Yes! I’m probably going with Keith on the Wednesday and have the Saturday after open, would love to hang!

130

Olaf Hartong @olafhartong.nl · 03/01/2025

While working on some ETW research I whipped up this dirty script to enumerate registered Trace logging providers and more importantly their DACLs which I needed mostly. gist.github.com/olafhartong/...

072

Olaf Hartong @olafhartong.nl · 30/12/2024

FalconHound 1.4.2 is out! * Added Managed identity authentication for Azure based inputs (KeyVaults, MDE, Sentinel, GraphAPI) * Added report command line option and actions * Added HTML output option Grab it here > github.com/FalconForceT...

github.com

Releases · FalconForceTeam/FalconHound

FalconHound is a blue team multi-tool. It allows you to utilize and enhance the power of BloodHound in a more automated fashion. It is designed to be used in conjunction with a SIEM or other log ag...

01810

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 20/12/2024

No sleep for us! We will facilitate a 3-day workshop version of our Advanced Detection Engineering in the Enterprise training at #insomnihack in Switzerland. Registration is open! Information and registration: insomnihack.ch/workshops/ad... #detectionengineering #training #purpleteam

012

Reposted by Olaf Hartong

FalconForce @falconforce.nl · 17/12/2024

Upcoming FalconForce Sentry Detect webinar! Register now: events.teams.microsoft.com/event/700051... Join us on Wed 22 January 2025, 16:00h CET, to get actionable insights on how we deliver and maintain high-fidelity bespoke detection content. Facilitated by @olafhartong.nl and Henri (x.com/0xffhh).

031

Olaf Hartong @olafhartong.nl · 16/12/2024

Detection Engineering is sometimes hard, and may fail. Still a lot of things can be learned by the process. In this blog I cover a lot. I had a detection, currently it's broken but MS is on it :D medium.com/falconforce/...