Jonas Bülow Knudsen
@jonas-bk.bsky.social
📤 68
📥 39
📝 6
Manager, Research @ SpecterOps
https://github.com/JonasBK/JonasBK/blob/main/README.md
reposted by
Jonas Bülow Knudsen
SpecterOps
about 2 months ago
The only conference dedicated to Attack Path Management is back! 3 tracks. Real-world case studies. Hands-on BloodHound Quest lab. Join us at
#SOCON2026
and advance your identity-first security strategy. 🎟️ Save 25% with early bird:
specterops.io/so-con
0
3
1
reposted by
Jonas Bülow Knudsen
SpecterOps
3 months ago
We've got a fresh
#BloodHoundBasics
post from
@jonas-bk.bsky.social
! Ever wondered about those obscure AD special identity groups that quietly grant permissions to every principal in your environment? With BloodHound, you can uncover compromising permissions tied to these groups. 🧵: 1/2
1
3
3
reposted by
Jonas Bülow Knudsen
Bad Sector Labs
3 months ago
DEF CON releases, PDQ SmartDeploy creds (@unsigned_sh0rt), FortiSIEM root command injection (@SinSinology), a cat themed loader (@vxunderground), fine-tune LLMs for offsec (@kyleavery_), juicing NTDS.DIT (@MGrafnetter), and more!
blog.badsectorlabs.com/last-week-in...
loading . . .
Last Week in Security (LWiS) - 2025-08-18
DEF CON releases, PDQ SmartDeploy creds (@unsigned_sh0rt), FortiSIEM root command injection (@SinSinology), a cat themed loader (@vxunderground), fine-tune LLMs for offsec (@kyleavery_), juicing NTDS....
https://blog.badsectorlabs.com/last-week-in-security-lwis-2025-08-18.html
1
3
1
reposted by
Jonas Bülow Knudsen
Fabian Bader
5 months ago
One of the results of the joined research with
@dirkjanm.io
is
entrascopes.com
Basically the yellow pages for Microsoft first party apps.
#TROOPERS25
2
25
6
I publish two blog posts today! 📝🐫 First dives into how we're improving the way BloodHound models attack paths through AD trusts:
specterops.io/blog/2025/06...
Second covers an attack technique I came across while exploring AD trust abuse:
specterops.io/blog/2025/06...
Hope you enjoy the read 🥳
loading . . .
Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound - SpecterOps
The ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make i...
https://specterops.io/blog/2025/06/25/good-fences-make-good-neighbors-new-ad-trusts-attack-paths-in-bloodhound/
5 months ago
0
18
12
reposted by
Jonas Bülow Knudsen
SpecterOps
5 months ago
Introducing the BloodHound Query Library! 📚
@martinsohn.dk
&
@joeydreijer.bsky.social
explore the new collection of Cypher queries designed to help BloodHound users to unlock the full potential of the BloodHound platform by creating an open query ecosystem.
ghst.ly/4jTgRQQ
loading . . .
Introducing the BloodHound Query Library - SpecterOps
The BloodHound Query Library is a community-driven collection of BloodHound Cypher available at https://queries.specterops.io
https://ghst.ly/4jTgRQQ
0
14
11
reposted by
Jonas Bülow Knudsen
Dirk-jan
6 months ago
Received the news today that my talk "Advanced Active Directory to Entra ID lateral movement techniques" was also accepted for
@defcon.bsky.social
🎉 hope to see everyone there!
0
27
5
reposted by
Jonas Bülow Knudsen
hotnops
6 months ago
New tricks, same impact
posts.specterops.io/update-dumpi...
loading . . .
Update: Dumping Entra Connect Sync Credentials
Recently, Microsoft changed the way the Entra Connect Connect Sync agent authenticates to Entra ID. These changes affect attacker tradecraft, as we can no longer export the sync account credentials…
https://posts.specterops.io/update-dumping-entra-connect-sync-credentials-4a9114734f71
0
6
7
reposted by
Jonas Bülow Knudsen
SpecterOps
7 months ago
It's
#BloodHoundBasics
day! 🙌 The docs got a fresh new look and live at
bloodhound.specterops.io
— now back in the GitHub repo too, so PRs are welcome! s/o
@jonas-bk.bsky.social
0
4
2
reposted by
Jonas Bülow Knudsen
SpecterOps
7 months ago
Getting started w/ Mythic? We've got you covered.
@its-a-feature.bsky.social
walks through the web UI basics, login process, & how to configure your default username/password. Check it out! ▶️
ghst.ly/user-interface
Watch the full series:
ghst.ly/mythic-op
loading . . .
0
7
3
Thrilled to be speaking at
@wearetroopers.bsky.social
again this year - can’t wait to be back! 🥳
7 months ago
0
5
1
Highly recommend this one. It's a good read :)
add a skeleton here at some point
8 months ago
0
1
0
Had a blast at
#SOCON2025
! It was great to meet up with colleagues and friends 💜 The slides from my presentation are available here:
github.com/JonasBK/Pres...
8 months ago
0
4
0
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
That's all folks! 👋 Thank you to everyone who attended & presented talks during our
#SOCON2025
conference days. Our training courses kickoff tomorrow at 9AM back at Convene.
0
4
2
reposted by
Jonas Bülow Knudsen
Katie Knowles
8 months ago
Excited to be at
@specterops.bsky.social
SO-CON this week!! If you're around, I'll be presenting "Abusing AUs, Confusing the SOC" tomorrow bright & early:
1
15
7
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
If you missed the session on NTLM at
#SOCON2025
, you're in luck! Join
@tifkin.bsky.social
,
@cptjesus.bsky.social
, and
@harmj0y.bsky.social
on April 17 for a webinar discussing their research into modeling NTLM relay attacks within BloodHound. Register today! ➡️
ghst.ly/ntlm-web
0
4
2
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
Day 1 at
#SOCON2025
has wrapped! 👊 We will see you right back here tomorrow for even more great content from our speakers. Check out the agenda for Day 2 at
specterops.io/so-con
.
0
8
1
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
It’s
#BloodHoundBasics
Day! 🎉 Want to find relationships cross AD domains? Use this Cypher query: MATCH p = (x:Base)-->(y:Base) WHERE x.domain <> y.domain AND NOT COALESCE(x.system_tags, '') CONTAINS 'admin_tier_0' RETURN p LIMIT 100 (1/2)
1
1
1
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
Active Directory isn't going anywhere, but security pros lack key knowledge. 🧠 Join
@jimsycurity.adminsdholder.com
& Darryl Baker at
@bsidescharm.bsky.social
for their AD Security 101 training, which aims to give you tools to find & fix misconfigurations attackers exploit.
bsidescharm.org
0
7
3
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
The query excludes Tier Zero control to filter out legit permissions granted to groups such as Enterprise Admins. The screenshot is redacted, but can you guess the name of the group in the middle? Hint: It has something to do with emails. s/o
@jonas-bk.bsky.social
(2/2)
0
1
1
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
Accurately see what permissions are exploitable in your AD environment. Chris Thompson discusses a recent update in BloodHound that shows fewer false positives for Owns/WriteOwner edges, & introduces the new Owns/WriteOwnerLimitedRights edges. Read more:
ghst.ly/3QORQdF
loading . . .
Do You Own Your Permissions, or Do Your Permissions Own You? - SpecterOps
tl;dr: Less FPs for Owns/WriteOwner and new Owns/WriteOwnerLimitedRights edges Before we get started, if you’d prefer to listen to a 10-minute presentation instead of or to supplement reading this pos...
https://ghst.ly/3QORQdF
0
10
3
reposted by
Jonas Bülow Knudsen
Bad Sector Labs
8 months ago
Next.js auth bypass (@zhero___ + @inzo____), ServiceNow for red teamers (@__invictus_), Veeam RCE - again! (@chudyPB), ArgFuscator (@Wietze), and more!
blog.badsectorlabs.com/last-week-in...
loading . . .
Last Week in Security (LWiS) - 2025-03-24
Next.js auth bypass (@zhero___ + @inzo____), ServiceNow for red teamers (@__invictus_), Veeam RCE - again! (@chudyPB), ArgFuscator (@Wietze), and more!
https://blog.badsectorlabs.com/last-week-in-security-lwis-2025-03-24.html
0
5
2
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
Before locking in for the OSCP exam, it’s highly recommended to complete the practical lab networks.
@anam0x.bsky.social
shares his tips on how to maximize the lab experience in Part 3 of his blog series:
ghst.ly/4iDWjML
🧵: 1/4
loading . . .
Getting the Most Value Out of the OSCP: The PEN-200 Labs - SpecterOps
How to leverage the PEN-200 simulated black-box penetration testing scenarios for maximal self-improvement and career success. Disclaimer: All opinions expressed in this article are solely my own. I h...
https://ghst.ly/4iDWjML
1
6
3
reposted by
Jonas Bülow Knudsen
hotnops
8 months ago
What's the purpose of the x-ms-DeviceCredential header if the device id claim is already included in the user access token? It seems redundant
0
1
1
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
Happy
#BloodHoundBasics
day! This week we are looking at how BloodHound classifies Tier Zero. Q: Why is not just the DA group Tier Zero but also all members? A: BloodHound classifies a few default Tier Zero assets, then adds more w/ logic from known attack techniques. 1/8
1
5
3
reposted by
Jonas Bülow Knudsen
werdhaihai
8 months ago
Super excited to be speaking at SO‑CON 2025 on March 31st with my coworker Lance Cain. We’re diving into an example attack path from real-life red team assessments by Lance Cain, Dan Mayer, myself, and the entire
@specterops.bsky.social
crew.
specterops.io/so-con/
#SOCON2025
#redteam
0
4
1
reposted by
Jonas Bülow Knudsen
XPN
8 months ago
On PTO and bored, so playing around with MCP by exposing Mythic APIs to Claude and seeing what the result. Attempting to have it emulate threat actors while operating Apollo in a lab... would make a good sparring partner :D
www.youtube.com/watch?v=ZooT...
loading . . .
Mythic MCP - Claude Sonnet driving Mythic (Apollo)
YouTube video by Adam Chester
https://www.youtube.com/watch?v=ZooTlwajQT4
1
20
6
reposted by
Jonas Bülow Knudsen
SpecterOps
8 months ago
Part 2 of Nathan Davis' Getting Started with BloodHound Enterprise series just dropped! Check out the latest post on understanding & contextualizing Tier Zero, & ensuring you have an accurate depiction of the Attack Paths that exist in your BHE tenant.
ghst.ly/4kEebbK
loading . . .
Getting Started with BHE — Part 2 - SpecterOps
Contextualizing Tier Zero TL;DR An accurately defined Tier Zero provides an accurate depiction of Attack Path Findings in your BHE tenant. Different principals (groups, GPOs, OUs, etc.) have different...
https://ghst.ly/4kEebbK
0
6
1
reposted by
Jonas Bülow Knudsen
Bad Sector Labs
8 months ago
Evilginx Pro (
@mrgretzky.breakdev.org
), Pre-auth RCE in a CMS (
@chudypb.bsky.social
), GOAD ADCS, YouTube email disclosure (
@brutecat.com
), SAML parser bug (
ulldma.bsky.social
), and more!
blog.badsectorlabs.com/last-week-in...
loading . . .
Last Week in Security (LWiS) - 2025-03-17
Evilginx Pro (@mrgretzky), Pre-auth RCE in a CMS (@chudyPB), GOAD ADCS (@M4yFly), YouTube email disclosure (@brutecat), SAML parser bug (@ulldma.bsky.social/@
[email protected]
), and more!
https://blog.badsectorlabs.com/last-week-in-security-lwis-2025-03-17.html
0
6
3
reposted by
Jonas Bülow Knudsen
Andrea P
9 months ago
KrbRelayEx-RPC tool is out! 🎉 Intercepts ISystemActivator requests, extracts Kerberos AP-REQ & dynamic port bindings and relays the AP-REQ to access SMB shares or HTTP ADCS, all fully transparent to the victim ;)
github.com/decoder-it/K...
loading . . .
GitHub - decoder-it/KrbRelayEx-RPC
Contribute to decoder-it/KrbRelayEx-RPC development by creating an account on GitHub.
https://github.com/decoder-it/KrbRelayEx-RPC
0
9
10
reposted by
Jonas Bülow Knudsen
SpecterOps
9 months ago
Happy
#BloodHoundBasics
day! Tired of the old 'Enable SMB signing everywhere' rec that isn't actually practical? BloodHound can help you convert that massive IT project into a doable risk mitigation effort, focused on those systems truly vulnerable to relay attacks. 🧵: 1/2
1
6
2
reposted by
Jonas Bülow Knudsen
hotnops
9 months ago
Has anyone heard of anyone actually setting up WHFB certificate trust? it's gotta be a MS troll
0
1
1
reposted by
Jonas Bülow Knudsen
SpecterOps
9 months ago
#SCCM
forest discovery accounts can be decrypted—even those for untrusted forests. If the site server is a managed client, all creds can be decrypted via Administration Service API. Check out our latest blog post from
@unsignedsh0rt.bsky.social
to learn more.
ghst.ly/4buoISp
loading . . .
Decrypting the Forest From the Trees - SpecterOps
TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is a managed client, service account credentials can be decrypted via ...
https://ghst.ly/4buoISp
1
22
15
reposted by
Jonas Bülow Knudsen
Wild West Hackin' Fest
9 months ago
Here we go, folks... our Call for Papers, Tools, and Workshops is open for WWHF - Deadwood 2025! Submit your talk here:
wkf.ms/4bA0S7T
0
5
8
reposted by
Jonas Bülow Knudsen
_RastaMouse
9 months ago
[BLOG] I had a series in mind like "Rubeus' Hidden Secrets" or something like that. Basically, highlighting features of the tool that seem less well known. I'm starting off with a basic one for getting crackable hashes from cached service tickets.
rastamouse.me/kerberoastin...
loading . . .
Kerberoasting w/o the TGS-REQ
Kerberoasting is a technique that allows an attacker to extract the encrypted part of a TGS-REP and brute force it offline to recover the plaintext password of the associated service account. The most...
https://rastamouse.me/kerberoasting-without-tgs-reqs/
0
19
6
reposted by
Jonas Bülow Knudsen
David McGuire
9 months ago
Thrilled to announce
@specterops.bsky.social
has raised Series B funding to tackle Identity Attack Paths! Identity security matters more now than ever. And we're just getting started. Read more:
ghst.ly/seriesb-blog
loading . . .
Fueling the Fight Against Identity Attacks - SpecterOps
When we founded SpecterOps, one of our core principles was to build a company which brought unique insight into high-capability adversary tradecraft, constantly innovating in research and tooling. We ...
https://ghst.ly/seriesb-blog
0
5
1
reposted by
Jonas Bülow Knudsen
Jason
9 months ago
We’re excited to keep pushing forward in eliminating Identity Attack Paths! As orgs grow more complex, Identity Risk is a top concern for security leaders. Proactively shutting down attack paths is the most direct way to reduce the risk of a major breach.
add a skeleton here at some point
0
7
1
reposted by
Jonas Bülow Knudsen
SpecterOps
9 months ago
BIG NEWS: SpecterOps raises $75M Series B to strengthen identity security! Led by Insight Partners with Ansa Capital, M12, Ballistic Ventures, Decibel, and Cisco Investments.
ghst.ly/seriesb
#IdentitySecurity
#CyberSecurity
(1/6)
1
16
10
reposted by
Jonas Bülow Knudsen
Phillip Wylie
9 months ago
Andy Robbins: The Evolution of Bloodhound
podcasters.spotify.c...
loading . . .
Andy Robbins: The Evolution of Bloodhound by Phillip Wylie Show
About The Guest:Andy Robbins is the Principal Product Architect at SpecterOps and one of the original 13 founding members of the company. He has a background in pen testing and red teaming and is the co-creator of Bloodhound, a popular open-source tool for attack path mapping in Active Directory environments. Summary:Andy Robbins, the Principal Product Architect at SpecterOps, joins host Phillip Wylie to discuss the evolution of Bloodhound, a tool for attack path mapping in Active Directory environments. Andy shares the origin story of Bloodhound and how it was developed to solve the problem of finding attack paths in complex environments. He explains the graph theory behind Bloodhound and how it visualizes data to help practitioners and defenders understand and mitigate security risks. Andy also discusses the recent release of Bloodhound Community Edition (CE) and the improvements it brings, including faster data ingest, query times, and a friendlier user experience. He highlights the focus on practical attack primitives and abuse primitives in Bloodhound and the goal of making attack paths a non-issue for organizations. Andy concludes by sharing valuable advice for those looking to advance in the industry, emphasizing the importance of understanding and solving real problems and being loyal to people rather than companies. Key Takeaways: Bloodhound is a tool for attack path mapping in Active Directory environments, using graph theory to visualize data and identify security risks. Bloodhound Community Edition (CE) brings improvements such as faster data ingest, query times, and a friendlier user experience. Bloodhound focuses on practical attack primitives and abuse primitives to solve real security problems and make attack paths a non-issue for organizations. Quotes: "If we give people an excellent experience for free, then enough of those people will choose to become paying customers that we have a viable business." - Andy Robbins "The industry as a whole is very young, but the capability of visualizing data problems and data security problems in this way is also relatively brand new." - Andy Robbins "We focus on attack paths or risk that emerges out of a combination of the mechanics of a system, the configurations of that system, and the behaviors of users or identities in that system." - Andy Robbins Socials and Resources: https://twitter.com/_wald0 https://twitter.com/SpecterOps https://specterops.io/ https://bloodhoundenterprise.io/ https://github.com/SpecterOps/BloodHound
https://podcasters.spotify.com/pod/show/phillip-wylie0/episodes/Andy-Robbins-The-Evolution-of-Bloodhound-e2de0v2?utm_source=bluesky&utm_medium=social&utm_campaign=fedica-Episode-Reposts
0
10
3
reposted by
Jonas Bülow Knudsen
SpecterOps
9 months ago
📝 Submit your feedback and share how your company employs Attack Path Management in our survey.
ghst.ly/4hItRYV
loading . . .
BloodHound Community Survey
Take this survey powered by surveymonkey.com. Create your own surveys for free.
https://ghst.ly/4hItRYV
0
1
1
reposted by
Jonas Bülow Knudsen
SpecterOps
9 months ago
⚡️ FedRAMP High authorization 👥 Community-driven improvements 🔮 Future outlook Join
@davidmcguire.bsky.social
, Jared Atkinson, & Justin Kohler to learn about the latest updates to BloodHound Enterprise & Community Edition! Register:
ghst.ly/mar-webinar-...
1
3
1
reposted by
Jonas Bülow Knudsen
Dirk-jan
9 months ago
It appears Microsoft quietly mitigated most of the risk of the "Intune company portal" device compliance CA bypass by restricting the scope of Azure AD graph tokens issued to this app, making them almost useless for most abuse scenarios. Thx
@domchell.bsky.social
for the heads up.
0
29
9
reposted by
Jonas Bülow Knudsen
Dirk-jan
9 months ago
Normally you can't auth to Entra ID connected webapps with bearer tokens. But if Teams can open SharePoint/OneDrive with an access token, I guess so can we. roadtx now supports opening SharePoint with access tokens in the embedded browser 😀
loading . . .
1
19
8
reposted by
Jonas Bülow Knudsen
SpecterOps
10 months ago
Happy
#BloodHoundBasics
Day! Did you know BloodHound started with just 3 node types and a few edges? Today, it supports 36 node types and 113 edge types, uncovering a vast array of attack paths. Explore more in our docs ➡️
ghst.ly/3WSKoS7
s/o
@jonas-bk.bsky.social
0
4
2
reposted by
Jonas Bülow Knudsen
XPN
10 months ago
I’ll be talking on the second day of SO-CON 2025 (last slot), so if you’re around, consider checking out the British dude babbling on about SQL Server!
0
15
2
reposted by
Jonas Bülow Knudsen
Dirk-jan
10 months ago
ROADtools update: I just released roadlib v1.0! This version drops the adal dependency, all auth flows are now implemented natively 🎉 This was mostly a personal goal, but it helps with adding new features, such as forcing MFA during device code auth independent of CA policies 😀
2
31
11
reposted by
Jonas Bülow Knudsen
SpecterOps
10 months ago
Your
#cybersecurity
career starts here! Join our "Hack the Hiring Process" webinar hosted by Technical Recruiting Manager Steffany Velasquez get the inside scoop on landing internships and full-time roles with our expert team. Register today! 👉
ghst.ly/febwebinar-b...
0
2
1
The BloodHound team is expanding! 🐶 We're searching for a passionate individual with BloodHound CE experience to take on a Product Manager role and drive the future of BloodHound CE
job-boards.greenhouse.io/specterops/j...
loading . . .
Staff Product Manager- BloodHound CE
Remote, United States
https://job-boards.greenhouse.io/specterops/jobs/7844906002
10 months ago
1
0
0
reposted by
Jonas Bülow Knudsen
SpecterOps
10 months ago
#DYK
: CMPivot queries can be used to coerce SMB authentication from
#SCCM
client hosts. Check out Diego Lomellini's latest blog post, which shares a simple, yet effective way to execute this.
ghst.ly/4hnsA9W
loading . . .
Further Adventures With CMPivot — Client Coercion
TL:DR
https://ghst.ly/4hnsA9W
0
5
2
you reached the end!!
feeds!
log in