Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management
Joined January 2017
- Tweets4.2K
- Following405
- Followers42.5K
- Likes2.3K
Pinned Tweet
The #SOCON2027 Call for Presentations is open! 🙌
Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it.
Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS
What happens when Chromium becomes an offensive tool?
Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.
Go deeper with Andrew’s research 👉 ghst.ly/45S1ZgW
“It really makes it concrete and very visual.”
Sahan Fernando, CISO at Rady Children’s Health San Diego, explains how BloodHound Enterprise helps show identity risk and make the case for remediation.
Watch the latest #KnowYourAdversary: ghst.ly/4ipZ8mF
ICYMI we have a Discord server now! 🙌
Join us ⤵️
@SpecterOps now has a Discord server for the Community to gather and talk about #BloodHound #AttackPath #Offensive and #Defensive #Tradecraft #Identity and just have fun talking with like minded professionals!
Join us now at : discord.specterops.io and get a vanity 👻 role!
What comes after initial access?
Build your red team tradecraft with our team at #BHEU, from command and control to Active Directory exploitation.
Join us 7-10 December in London. Save your spot: ghst.ly/4AQLIHs
Happening now! @jaredcatkinson is speaking during the OT resilience and defense panel at #ManuSecUSA.
“That template controls that agent. Somebody else is in control of that template.”
@Icemoonhsv and @elad_shamir joined @jaredcatkinson and @JustinKohler10 to chat about agent security for #KnowYourAdversary.
👀: specterops.io/know-your-adve…
ICYMI: The #SOCON2027 CFP is open! 🎤
Share your research, technical deep dives, or lessons from the field on adversary tradecraft, identity security, and Attack Paths.
Submit a 25- or 50-minute talk by November 13: ghst.ly/4dGrZAx
An attack path can span GitHub and AWS.
@hotnops and @n0pe_sled recently joined #KnowYourAdversary to explore third party trust and paths to critical resources.
ghst.ly/4zvoVQ1
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.
🧵1/4
BloodHound users may run the below queries to identify potential impact to their environs.
Identify outbound control of ConnectWise app:
MATCH p=(sp:AZServicePrincipal)-[r]->(target)
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’
RETURN p
This week's #BloodHoundBasics courtesy of Carlo Alcantara: Table View! Because sometimes defenders think in lists. The new table view accompanies the Graph View on the Attack Paths page in BloodHound Enterprise. (1/3)
Certain fields (Platform, Attack Paths, Environment) can be searched to filter the view to specific findings. (2/3)
SpecterOps retweeted
I will be @BSidesNYC tomorrow at the @SpecterOps booth!
Come talk to us and if you are wearing a #SpecterOps or #BloodHound t-shirt, I might have something special for you (very limited).
See you tomorrow! :)
“We have to assume that it will take us some time to patch.”
Sahan Fernando, CISO at @radychildrens, discusses balancing security remediation with patient care in the latest episode of #KnowYourAdversary.
👀: ghst.ly/4zvoVQ1