See the latest by Steven Flores
TL;DR Win32_Process has been the go to WMI class for remote command execution for years. In...
By: Steven Flores
Sep 18, 2025 • 7 min read
Read Post
TL;DR WebClient is a common targeted service for NTLM relay attacks. In this post we will...
By: Steven Flores
Aug 19, 2025 • 31 min read
Read Post
Performance, Diagnostics, and WMI
Windows offers tons of useful tools that administrators can leverage to perform their daily jobs. A...
By: Steven Flores
Jul 11, 2023 • 10 min read
Read Post
Revisiting Remote Desktop Lateral Movement
It’s no secret that attackers are looking for new techniques to execute lateral movement. However, there...