See the latest by Steven Flores
TL;DR: Win32_Process has long been the go-to WMI class for remote command execution. In this post we...
By: Steven Flores
Sep 18, 2025 • 7 min read
Read Post
TL;DR WebClient is a common targeted service for NTLM relay attacks. In this post we will...
By: Steven Flores
Aug 19, 2025 • 31 min read
Read Post
Performance, Diagnostics, and WMI
Windows offers tons of useful tools that administrators can leverage to perform their daily jobs. A...
By: Steven Flores
Jul 11, 2023 • 10 min read
Read Post
Revisiting Remote Desktop Lateral Movement
It’s no secret that attackers are looking for new techniques to execute lateral movement. However, there...