Marc André Tanner
@brain-dump.org
Information security, operating systems, text editors github.com/martanne
My #SOCON2026 talk is online. I cover how DevOps platforms like GitLab become key junctions in identity-based attack paths: secret exposure, cross-cloud OIDC federation, over privileged runners and bots. Also: lots of "uhms." www.youtube.com/watch?v=La6j...
Mapping GitLab Attack Paths into BloodHound with OpenGraph | SO-CON 26
YouTube video by SpecterOps
youtube.com
WinGet can be more than a package manager. We show how .𝚠𝚒𝚗𝚐𝚎𝚝 configs + a self-referencing LNK become a viable initial access payload when Microsoft Store is enabled. Includes detection queries & mitigation tips. blog.compass-security.com/2026/03/wing... #RedTeam #Windows #LOLBins #InitialAccess
Last week presented at an university alumni event, this week successfully used during a red teaming engagement.
🧭 Navigation complete! The team from Compass Security just charted a course straight into @home_assistant Green at #Pwn2Own. They head off to the disclosure room to spill how they did it. #P2OIreland
Curious why I was rebooting random laptops? Credit goes to Rairii for the original research and Thomas from @neodyme.io for the initial PoC.
Compass Security@compass-security.com · last yr.In his latest blog post, Marc Tanner @brain-dump.org shows how to bypass BitLocker using BitPixie (CVE-2023-21563) and signed Microsoft components only. Check out the blog post for a PoC and a demo. #BitLocker #RedTeam blog.compass-security.com/2025/05/bypa...
Last week I had a fantastic experience at @specterops.bsky.social's #SOCON2025 and subsequent IDOT training. It was a great opportunity to get in touch with leading experts. Apparently I also bugged them enough to merge my small BloodHound contribution. github.com/SpecterOps/B...
www.microsoft.com/en-us/securi...
Storm-2372 conducts device code phishing campaign | Microsoft Security Blog
Microsoft Threat Intelligence Center discovered an active and successful device code phishing campaign by a threat actor we track as Storm-2372. Our ongoing investigation indicates that this campaign ...
microsoft.com
Avoid LDAP monitoring by leveraging local registry data with certipy parse! Check out our latest pull request and read Marc Tanner’s (@brain-dump.org) blog post: blog.compass-security.com/2025/02/stea...
