Daniel Heinsen

doin thangs @specterops

[Daniel Heinsen @hotnops]

Pasting API keys in an LLM makes me feel kinda gross, so I created agentcordon. It's an agentic key vault that's:
✅Agent agnostic
✅Cedar policies for clear authorization
✅Fully auditable
✅Remote MCP Support

[Daniel Heinsen @hotnops]

https://t.co/Gu1ZWYu3rm

[Daniel Heinsen @hotnops]

Pasting API keys in an LLM makes me feel kinda gross, so I created agentcordon. It's an agentic key vault that's:
✅Agent agnostic
✅Cedar policies for clear authorization
✅Fully auditable
✅Remote MCP Support

[Max Harley @0xdab0]

HEY EVERYONE. THE BLOG POST IS OUT.
I put an LLM in an AMSI provider and some cool stuff came out. Really excited to finally have this released.

[Garrett @unsigned_sh0rt]

See you all next week...excited to present with @breakfix at #BHEU! 💣

[SpecterOps @SpecterOps]

The Azure AD Broker plays a key role in Entra ID sign-in & token handling, but how well do we really understand it?

@winternl_t unpacks its on-disk cache, how to decode it, & the security implications. 🔐 https://t.co/eC86G7QFzy

[SpecterOps @SpecterOps]

Credential Guard was supposed to end credential dumping. It didn't.

@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.

Read for more ⤵️ https://t.co/mYPHg1mTKj

[Logan Goins @_logangoins]

I feel like @YuG0rd's briefly mentioned new dMSA account takeover mechanism in his last blog didn't get enough attention. A new account takeover mechanism is on the horizon. I wrote a blog detailing it, releasing with a new BOF I wrote called BadTakeover

https://t.co/fyUkDYKAeP

[Garrett @unsigned_sh0rt]

WSFC misconfigurations can turn your domain into one big fustercluck. I'm sharing fustercluck today as part of my #BHUSA presentation. The README summarizes the issues and a detailed blog is coming soon. https://t.co/JJ4gNVV0WO

[SpecterOps @SpecterOps]

MSSQLHound leverages BloodHound's OpenGraph to visualize MSSQL attack paths with 7 new nodes & 37 new edges, all without touching the SharpHound & BloodHound codebases.

@_Mayyhem unpacks this new feature in his blog post. 👇 https://t.co/ZvZt45UrOa

[Daniel Heinsen @hotnops]

The best creds are the ones you simply ask for =)
https://t.co/rKyYylLC01

[Daniel Heinsen @hotnops]

@cnotin Medium post updated, thank you!

[Daniel Heinsen @hotnops]

This post goes more into Entra Connect tradecraft and how partially synced objects can be hijacked for cross domain attacks.
https://t.co/fRfdfhXKhb

[Dirk-jan @_dirkjan]

Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃

[Daniel Heinsen @hotnops]

i'm on the internet this week. head over to https://t.co/ToS2K9CitP to hear me talk about tokens and conditional access

[Daniel Heinsen @hotnops]

A new fun way to set shadow credentials
https://t.co/RvkQRa9aNV

[Chris Thompson @_Mayyhem]

Want to move laterally from C2 on an Intune admin's workstation to any Intune-enrolled device? Check out Maestro (https://t.co/u6BPKhlEnK), a new(ish) tool I wrote for those situations, and this blog post to walk you through how: https://t.co/Sibp8uhzSa

[Daniel Heinsen @hotnops]

my workshop tomorrow in a nutshell

[SpecterOps @SpecterOps]

Don't miss our next webinar w/ @hotnops, which will showcase how Apeman can quickly identify Attack Paths by solving AWS CTF challenges. Each challenge will highlight a common misconfiguration & how Apeman can help identify them.

Register today ▶️ https://t.co/Tz4nN0LWWQ

[TrustedSec @TrustedSec]

Let's take a ride in the Wayback machine! In our new #blog, @nyxgeek takes a look at time-based user enumeration in #Azure, its origins dating back to 2014, and the release of a new tool called Autodiscover Enumerator. Read it now! https://t.co/67MKPHbYA9