SpecterOps

Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management

[SpecterOps @SpecterOps]

The #SOCON2027 Call for Presentations is open! 🙌

Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it.

Submit a 25- or 50-minute session proposal by November 13: https://t.co/B7rs3dAeZt

[SpecterOps @SpecterOps]

A compromised workstation shouldn’t give an attacker a path to production.

JPMorganChase’s cyber resilience guidance calls for removing standing privileges & excessive access held by service accounts & machine identities.

Agreed. Cut those Attack Paths. https://t.co/9qorCkgZ9B

[SpecterOps @SpecterOps]

Happy #BloodHoundBasics Friday from @sec_distilled! 🎉

Looking to get started with BloodHound but don't have an environment to collect from? We've got you covered with sample data for both Active Directory and Azure environments here: https://t.co/5q4FOKFUtK

[SpecterOps @SpecterOps]

New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇

https://t.co/jNcQOmH72U

[Raj Patel @GrayHatKiller]

1/2

LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.

Patched in October.

Blog: https://t.co/dUHIN6JfaE
PoC: https://t.co/xT98z64V96

[SpecterOps @SpecterOps]

Where does frontier AI fit into federal cyber defense?

Join @robwinchester3 & @ne0nd0g for a webinar on AI’s defensive value, oversight and the role of experienced operators.

📆 Oct. 29 | 2 PM EDT / 11 AM PDT
💻 Virtual

Register 👉 https://t.co/SWPw4W4Ude

[SpecterOps @SpecterOps]

What happens when Chromium becomes an offensive tool?

Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.

Go deeper with Andrew’s research 👉 https://t.co/xjatICDFfF

[SpecterOps @SpecterOps]

“It really makes it concrete and very visual.”

Sahan Fernando, CISO at Rady Children’s Health San Diego, explains how BloodHound Enterprise helps show identity risk and make the case for remediation.

Watch the latest #KnowYourAdversary: https://t.co/hVGyRjayaS

[SpecterOps @SpecterOps]

ICYMI we have a Discord server now! 🙌

Join us ⤵️

[Scoubi @ScoubiMtl]

@SpecterOps now has a Discord server for the Community to gather and talk about #BloodHound #AttackPath #Offensive and #Defensive #Tradecraft #Identity and just have fun talking with like minded professionals!

Join us now at : https://t.co/kIXOs1cshx and get a vanity 👻 role!

[SpecterOps @SpecterOps]

What comes after initial access?

Build your red team tradecraft with our team at #BHEU, from command and control to Active Directory exploitation.

Join us 7-10 December in London. Save your spot: https://t.co/odSxiN5v6u

[SpecterOps @SpecterOps]

Happening now! @jaredcatkinson is speaking during the OT resilience and defense panel at #ManuSecUSA.

[SpecterOps @SpecterOps]

“That template controls that agent. Somebody else is in control of that template.”

@Icemoonhsv and @elad_shamir joined @jaredcatkinson and @JustinKohler10 to chat about agent security for #KnowYourAdversary.

👀: https://t.co/Iop1NVIYx9

[SpecterOps @SpecterOps]

ICYMI: The #SOCON2027 CFP is open! 🎤

Share your research, technical deep dives, or lessons from the field on adversary tradecraft, identity security, and Attack Paths.

Submit a 25- or 50-minute talk by November 13: https://t.co/1acXOkfTdZ

[SpecterOps @SpecterOps]

An attack path can span GitHub and AWS.

@hotnops and @n0pe_sled recently joined #KnowYourAdversary to explore third party trust and paths to critical resources.

https://t.co/77KyCb5acu

[SpecterOps @SpecterOps]

Identify paths from the impacted service principal to Tier Zero. 

MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t)) 
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ 
  AND t.system_tags CONTAINS ‘admin_tier_0’

[SpecterOps @SpecterOps]

PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.

🧵1/4

[Huntress @HuntressLabs]

RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick).

We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵

[SpecterOps @SpecterOps]

BloodHound users may run the below queries to identify potential impact to their environs.

Identify outbound control of ConnectWise app:
MATCH p=(sp:AZServicePrincipal)-[r]->(target) 
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’ 
RETURN p

[SpecterOps @SpecterOps]

This new view also includes updates to the underlying API which now tracks history of findings & remediations. Filtering & sorting the columns now provides a way to track progress over time, giving you insight into when a finding first appeared & when it was last seen. (3/3)

[SpecterOps @SpecterOps]

This week's #BloodHoundBasics courtesy of Carlo Alcantara: Table View! Because sometimes defenders think in lists. The new table view accompanies the Graph View on the Attack Paths page in BloodHound Enterprise. (1/3)

[SpecterOps @SpecterOps]

Certain fields (Platform, Attack Paths, Environment) can be searched to filter the view to specific findings. (2/3)