Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management
Joined January 2017
- Tweets4.2K
- Following405
- Followers42.5K
- Likes2.3K
Pinned Tweet
The #SOCON2027 Call for Presentations is open! 🙌
Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it.
Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS
A compromised workstation shouldn’t give an attacker a path to production.
JPMorganChase’s cyber resilience guidance calls for removing standing privileges & excessive access held by service accounts & machine identities.
Agreed. Cut those Attack Paths. ghst.ly/4iATiil
Happy #BloodHoundBasics Friday from @sec_distilled! 🎉
Looking to get started with BloodHound but don't have an environment to collect from? We've got you covered with sample data for both Active Directory and Azure environments here: ghst.ly/4i9zWQd
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Where does frontier AI fit into federal cyber defense?
Join @robwinchester3 & @ne0nd0g for a webinar on AI’s defensive value, oversight and the role of experienced operators.
📆 Oct. 29 | 2 PM EDT / 11 AM PDT
💻 Virtual
Register 👉 ghst.ly/4yZPzks
What happens when Chromium becomes an offensive tool?
Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.
Go deeper with Andrew’s research 👉 ghst.ly/45S1ZgW
“It really makes it concrete and very visual.”
Sahan Fernando, CISO at Rady Children’s Health San Diego, explains how BloodHound Enterprise helps show identity risk and make the case for remediation.
Watch the latest #KnowYourAdversary: ghst.ly/4ipZ8mF
ICYMI we have a Discord server now! 🙌
Join us ⤵️
@SpecterOps now has a Discord server for the Community to gather and talk about #BloodHound #AttackPath #Offensive and #Defensive #Tradecraft #Identity and just have fun talking with like minded professionals!
Join us now at : discord.specterops.io and get a vanity 👻 role!
What comes after initial access?
Build your red team tradecraft with our team at #BHEU, from command and control to Active Directory exploitation.
Join us 7-10 December in London. Save your spot: ghst.ly/4AQLIHs
Happening now! @jaredcatkinson is speaking during the OT resilience and defense panel at #ManuSecUSA.
“That template controls that agent. Somebody else is in control of that template.”
@Icemoonhsv and @elad_shamir joined @jaredcatkinson and @JustinKohler10 to chat about agent security for #KnowYourAdversary.
👀: specterops.io/know-your-adve…
ICYMI: The #SOCON2027 CFP is open! 🎤
Share your research, technical deep dives, or lessons from the field on adversary tradecraft, identity security, and Attack Paths.
Submit a 25- or 50-minute talk by November 13: ghst.ly/4dGrZAx
An attack path can span GitHub and AWS.
@hotnops and @n0pe_sled recently joined #KnowYourAdversary to explore third party trust and paths to critical resources.
ghst.ly/4zvoVQ1
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.
🧵1/4
BloodHound users may run the below queries to identify potential impact to their environs.
Identify outbound control of ConnectWise app:
MATCH p=(sp:AZServicePrincipal)-[r]->(target)
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’
RETURN p
This week's #BloodHoundBasics courtesy of Carlo Alcantara: Table View! Because sometimes defenders think in lists. The new table view accompanies the Graph View on the Attack Paths page in BloodHound Enterprise. (1/3)
Certain fields (Platform, Attack Paths, Environment) can be searched to filter the view to specific findings. (2/3)