BloodHound's OpenGraph is 🔥🚀 This is how we rapidly developed a customer specific attack primitive for BloodHound that we call "ManagerOf" 👇

I publish two blog posts today! 📝🐫 First dives into how we're improving the way BloodHound models attack paths through AD trusts: specterops.io/blog/2025/06... Second covers an attack technique I came across while exploring AD trust abuse: specterops.io/blog/2025/06... Hope you enjoy the read 🥳

Easily find and share BloodHound Cyphers on queries.specterops.io Released with ~90 new Cypher queries, go check them out! @joeydreijer.bsky.social and I spent many hours creating it and we hope you find it useful. All feedback is appreciated :)

**Every** BloodHound Enterprise tenant I've checked has multiple Non Tier Zero principals with the rights required for BadSuccessor. Luckily a 2025 DC is still rare. Often helpdesk has GenericAll, misconfig'ed to apply on the OU itself, instead of only inheriting to principals within.

Shout out (skud ud) to @embar.io Best CTF DJ. #tdcnetctf

BloodHound has 4 new edges: 𝗖𝗼𝗲𝗿𝗰𝗲𝗔𝗻𝗱𝗥𝗲𝗹𝗮𝘆𝗡𝗧𝗟𝗠𝗧𝗼𝗦𝗠𝗕, ...𝗧𝗼𝗟𝗗𝗔𝗣, ...𝗧𝗼𝗟𝗗𝗔𝗣𝗦, ...𝗧𝗼𝗔𝗗𝗖𝗦 [ESC8] They combine 𝗰𝗼𝗲𝗿𝗰𝗶𝗼𝗻 and 𝗿𝗲𝗹𝗮𝘆𝗶𝗻𝗴, allowing Auth. Users to compromise computers. Read this excellent post by Elad Shamir if you are unfamiliar with those terms or want to know how to mitigate.

I had a great time at @specterops.bsky.social #SOCON2025 in Arlington/DC! I'm grateful I get to meet all you awesome people; community members and Specters. Huge thanks to the many speakers and trainers 💙 See you next year!

In Part 1 of my Intune Attack Paths series, I discuss the fundamental components and mechanics of Intune that lead to the emergence of attack paths: posts.specterops.io/intune-attac...

Merry Christmas from us to you 🎄🎁💙 We launched Trending Topics today, and you can find it by tapping the search icon on the bottom bar of the app or the right sidebar on desktop.

The Misconfiguration Manager DETECT section has been updated with fresh guidance to help defensive operators spot the most prolific attack techniques. Check out the blog post from @bouj33boy.bsky.social to learn more. ghst.ly/3VJ5y4F

It's that time of year again everybody! I want to know YOUR thoughts on Mythic! What did you like? What could be improved? What would you like to see next? Why do you or don't you use it? If you could change something, what would it be? www.surveymonkey.com/r/MythicPlan... I'm all ears :)

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

ShadowHound - brand new .ps1 SharpHound alternative that supports LDAP and ADWS Outputs data in ldapsearch format that can be converted to BH JSON with BOFHound. blog.fndsec.net/2024/11/25/s...

355 to go!

Awesome new addition to krbrelayx by Hugow from Synacktiv: www.synacktiv.com/publications...

RCP Firewall and LDAP Firewall workshop by Sagie Dulce and Dekel Paz. youtube.com/watch?v=hJyI...

PowerHuntShares is a useful tool by Scott Sutherland (_nullbind), and the v2 looks amazing. I gotta test the experimental "Share Graph". www.netspi.com/blog/technic...

SO-CON CFP submitted! Get yours in before tomorrow's deadline. specterops.io/so-con/

Tier list of AD tiers

Join our webinar on Thurs when Jonas Knudsen, Lee Christensen, and I will present pt. 4 of "What Is Tier Zero", covering: - MS Exchange On-Premises - ADCS - Insights from isolating Tier Zero with BloodHound Enterprise customers Watch live or register for on-demand at ghst.ly/4eSssxL