Arun Kumar

LSASS (Local Security Authority Subsystem Service) is the Windows process that handles interactive logons and manages authentication-related secrets in memory. Because it sits at the center of Windows authentication, attackers often try to access or dump LSASS memory to steal credentials or reusable secrets. This guide focuses on defensive detection, triage, and response—what to look…

1) What is a “shadow admin” in AD? A shadow admin is any user, group, or service principal that can achieve admin outcomes—such as modifying privileged group membership, controlling GPOs, resetting admin credentials, or replicating directory secrets—without being a direct member of obvious privileged groups. Why they’re hard to spot They hide in structure…

Responding to AD Security Incidents in Real Time (Active Directory IR Playbook) Active Directory is both your identity backbone and (when compromised) your blast radius amplifier. “Real-time response” in AD isn’t about heroics—it’s about making fast, reversible, evidence-safe moves that stop privilege spread while you preserve the truth of what…