NTLM relays failing because of EPA? 😒 Nick Powers & @tw1sm.bsky.social break down how to enumerate EPA settings across more protocols + drop new tooling (RelayInformer) to make relays predictable. Check out their blog for more: ghst.ly/4rqwpRs

How does PingOne’s architecture shape real attacker movement? In our new #KnowYourAdversary, @andyrobbins.bsky.social & @pingidentity.com’s Bjorn Aannestad discuss RBAC, environment design, & cross-platform risks. ghst.ly/3Xd9o6D Visit booth #736 at #GartnerIAM to learn about PingOneHound.

Learn to map attack telemetry & build resilient detections. Join our Tradecraft Analysis course at #SOCON2026 to uncover telemetry layers & identify detection choke points. Save your spot in-person + get a free conf. pass → ghst.ly/socon-2026

In today’s installment of #BloodHoundBasics from Carlo Alcantara: Easily manage your custom cypher queries. Support for importing and exporting cypher queries was added recently in BloodHound v8.2.0 — now with drag and drop!

AI tooling and MCP servers are entering enterprises fast, often faster than security teams can assess the risks. During a recent engagement, @xpnsec.com found a new Claude Code vuln (CVE-2025-64755) while exploring MCP abuse paths. 👀 Read the details: ghst.ly/49ybl4W

Identity is the new battleground. Jared Atkinson talks with CyberWire Daily about how attackers chain misconfigurations and identity relationships to reach critical assets, and how Attack Path Management stops them. 🎧: ghst.ly/4oXlfly

SCCM’s AdminService uses Entra tokens without confirming the UPN exists in AD. A crafted synced UPN can let an attacker impersonate the site server. Microsoft now requires on-prem SID matching (CVE-2025-59501). Great deep dive by @unsignedsh0rt.bsky.social! ghst.ly/43wTzLx

Have questions about submitting to the #SOCON2026 CFP? We’ve got answers. The CFP closes soon — submit your proposal by Nov 15 to participate in the only conference dedicated to advancing Attack Path Management. 📝 Submit: ghst.ly/socon26-cfp

In today's #BloodHoundBasics, @sadprocessor.bsky.social highlights a powerful new feature you might’ve missed: Cypher Selectors for Privilege Zones. Why powerful? Unlike classic objectid selectors, Cypher selectors use complex conditions & can be created before the node exists. 🧵: 1/3

Attackers don’t exploit tools—they exploit identities. Learn how to defend where it matters. Join operators and defenders for one of our hands-on training courses at #SOCON2026. In-person attendees also receive a free conference pass. Save your spot ➡️ ghst.ly/socon-2026

That feeling when your PowerShell syntax error almost deletes Global Admin. 🫠 Forrest Kasler shares a cautionary tale on why you should always read the docs when you are about to issue a “DELETE” operation on any resource in your client’s infrastructure. ghst.ly/3X2bTZ4

See your network shares the way attackers do. 👀 Meet ShareHound, an OpenGraph collector for BloodHound CE & Enterprise that reveals share-level attack paths at scale. @podalirius.bsky.social unpacks all the details in our latest blog post. ghst.ly/4ogiBqt

NTLM relay research is evolving! Join Nick Powers & @tw1sm.bsky.social TOMORROW as they share new methods to enumerate EPA enforcement across MSSQL, HTTP, & more—and intro RelayInformer, expanding attacker-perspective coverage for key protocols. Grab your spot → ghst.ly/oct-web-bsky

From simple model to powerful platform. 💪 Elad Shamir discusses BloodHound OpenGraph's journey, the challenges of modeling adversary tradecraft, and the Clean Source Principle w/ Jared Atkinson and Justin Kohler in the latest #KnowYourAdversary. 🎧: ghst.ly/4ommfPu

It's another #BloodHoundBasics day with Stephen Hinck! Go back ⬅️, forward ➡️, & share your BloodHound view 👀. Earlier this year, we added Back button support directly through your browser. You can also copy your current URL & share it with a teammate so they see what you see.

Credential Guard was supposed to end credential dumping. It didn't. Valdemar Carøe just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more: ghst.ly/4qtl2rm

Introducing PingOneHound, a BloodHound extension to map and remediate attack paths in PingOne. @andyrobbins.bsky.social dives in to the architecture and mechanics in our latest blog post. Learn more & get started today. ghst.ly/3WLqlVd

Patching one technique doesn't close the entire attack vector. dMSA abuse is still a problem, and @logangoins.bsky.social just dropped a reality check with new tooling to prove it. Learn more about the issue & the new BadTakeover BOF. ghst.ly/42POg9L

For today’s #BloodHoundBasics from Carlo Alcantara, we explore how easy it is to use OpenGraph to enrich our existing Active Directory data in BloodHound. In this example, we will add a new attribute to AD objects that have a fine grained password policy applied to them. 🧵 1/5

@reconmtl.bsky.social has uploaded the majority of the 2025 talks, including my talk on LSA. You can check it out at the below link if you'd like. Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back! youtu.be/G2CfMWXLU1U?...

Think you understand how LLMs work? You might be surprised. 😳 In his latest blog post, @blaisebrignac.bsky.social explains the history, challenges, and attack primitives that make securing AI systems such an extreme challenge. Read more: ghst.ly/497pxl0

Microsoft introduced nested application auth (NAA) in 2024. Researchers spotted FOCI similarities & dubbed it brokered client IDs (BroCI). @1cemoon.bsky.social documents NAA flows and BroCI—filling a gap for research on Microsoft identity protocols. ghst.ly/3Jdhp7Z

Celebrating #BloodHoundBasics day w/ Nathan Davis! DYK: Risk calculation in BHE findings can be based on different values—some use Exposure (inbound control), others Impact (outbound). Hover over a finding in the Attack Paths page to see which applies.

The CFP for #SOCON2026 is OPEN! 🙌 Have you been working on something interesting in Attack Path Management or identity-first defense? Join us in Arlington, VA (April 13–14) and share your work with the community. Submit your talk by Nov. 15 → ghst.ly/socon26-cfp

Your strongest platform is only as secure as its weakest dependency. And you probably don't know what those are. Jared Atkinson dives into the Clean Source Principle, hidden trust relationships, & why BloodHound OpenGraph changes the game. ghst.ly/4pYTtFU

It's another #BloodHoundBasics day with @andyrobbins.bsky.social! Today we are highlighting the ReadGMSAPassword edge. A GMSA is an Active Directory object. GMSA stands for Group-Managed Service Account - a great solution from Microsoft that we recommend organizations use! 🧵: 1/3

Red teams slip past detection. Defenders adapt. The cycle continues. 🔄 John Wotton's latest on AI gated loaders shows how offensive operators are using LLMs to make shellcode execution context-aware, executing only when OPSEC policies are met. ghst.ly/4nvxsgh

The only conference dedicated to Attack Path Management is back! 3 tracks. Real-world case studies. Hands-on BloodHound Quest lab. Join us at #SOCON2026 and advance your identity-first security strategy. 🎟️ Save 25% with early bird: specterops.io/so-con

Lateral movement getting blocked by traditional methods? @werdhaihai.bsky.social just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG

Happy #BloodHoundBasics Day from @scoubi.bsky.social! By now, you've probably heard about our Query Library. But did you know you can run any query in your own instance of BHE/BHCE and then save the query to your Personal Library? Follow the steps threaded below! 🧵: 1/5

It's time to change how you think about SaaS integrations. The Salesloft attack shows how GitHub → AWS → Drift → Salesforce created an attack highway defenders never saw coming. Jared Atkinson's analysis details the patterns we should look out for. ghst.ly/4ngDQrD

Learn to detect adversary TTPs through behavioral analysis, not just malware signatures. Our Detection course at Specter Bash teaches you to engineer detections based on attacker tactics and techniques. Register & save your spot ➡️ ghst.ly/specter-bash-2025

🎙️ NEW PODCAST: #KnowYourAdversary Jared Atkinson & Justin Kohler explore identity security from the attacker's perspective. Real stories, real tactics, real insights. Check out our first three episodes now 👉 ghst.ly/kya-podcast

New #BloodHoundBasics post from @martinsohn.dk ‼️ Today is a demo of how BloodHound's #OpenGraph helped a customer build ManagerOfHound.ps1 - going from attack path concept to a custom "ManagerOf" edge in BloodHound. Can it fit in a thread? Let's see... 🧵 1/6

Win32_Process has been the go to WMI class for remote command execution for years. Steven Flores explores a new WMI class that functions like Win32_Process and offers further capability. Read more: ghst.ly/4gyPbkr

Last call! Our #military to #cybersecurity webinar is tomorrow, and there's still time to save your spot. Get the real playbook from #veterans on our team: ✅ Resume strategies that work ✅ Application timing ✅ Consultant life insights Don't miss out 👉 ghst.ly/sep-web-bsky

From DACLs to dragons: @winterknight.net is bringing the ultimate mashup to @pancakescon.com. Half Windows security deep-dive, half D&D villain masterclass. Because why choose between protecting your filesystem and crafting the perfect antagonist? 🐉 Learn more: pancakescon.com/

From military to cybersecurity — your next mission awaits! Join our upcoming Hack the Hiring Process webinar & hear from a panel of veterans on our team as they share their transition strategies: resume tips, application timing, and real consultant life insights. Register 👉 ghst.ly/sep-web-bsky

We've got a fresh #BloodHoundBasics post from @jonas-bk.bsky.social! Ever wondered about those obscure AD special identity groups that quietly grant permissions to every principal in your environment? With BloodHound, you can uncover compromising permissions tied to these groups. 🧵: 1/2

Spoiler alert: Your AI safety measures might have a blind spot. 👀 When attackers use conversation context to bypass LLM safeguards, single-prompt evals just don't cut it anymore. Dive into @atomicchonk.bsky.social's latest blog on multi-prompt attack detection. ghst.ly/47qJhzn

Military veterans bring discipline, problem-solving skills, & strategic thinking to #cybersecurity; exactly what our industry needs. Join us for veteran-led insights on: ✅ Resume tips ✅ Application strategy ✅ Life working at a security firm 👉 ghst.ly/sep-web-bsky

BloodHound isn't just for Active Directory anymore. 🤯 @sadprocessor.bsky.social dives into the BloodHound OpenGraph functionality & demonstrates the new PowerShell cmdlets added to the BloodHound Operator module to work with the OpenGraph feature. ghst.ly/4peTTrB

Transitioning from military to #cybersecurity? We've got your six. Veteran members of our consulting team are sharing the playbook: resume strategies, application timing, & what consultant life really looks like. Join us Sept. 18 to learn more 👉 ghst.ly/sep-web-bsky

In today’s installment of #BloodHoundBasics from Carlo Alcantara: Labels and Tags. 🏷️ With the Privilege Zones feature, labels can be created to define a collection of assets. 🧵: 1/2

There's still time to register for today's webinar! Join Jared Atkinson, Andrew Chiles, & Elad Shamir as they dive into our inaugural State of Attack Path Management report. Register ➡️ ghst.ly/aug-web-bsky

🚨 New #BloodHound shirt alert 🚨 ✅ - Unisex adult/child and ladies sizes available ✅ - Cool design :) ✅ - ALL profits go to charity This time we are supporting Hope for HIE, which supports families suffering the effects of hypoxic ischemic encephalopathy Get your shirt here: ghst.ly/bh8-tshirt

Cookie theft has evolved. 🍪 Over the last year, stealing cookies on Windows devices has changed significantly for Chromium browsers like Chrome and Edge. Andrew Gomez dives into these changes, how threat actors adapt, & new detection opportunities. ghst.ly/45S1ZgW

We are back with our BloodHound t-shirt fundraiser, just in time for #InternationalDogDay! Grab your BloodHound 8.0 shirt today. All funds raised will go directly to @hopeforhie.org, the global voice for families affected by Hypoxic Ischemic Encephalopathy. Get yours at ghst.ly/bh8-tshirt

📆 Save the date for #SOCON2026 in Arlington, VA! This next conference will be bigger than before with a new third talk track. 🧑‍🏫 Conference: April 13-14, 2026 💻 Training: April 15-18, 2026 Sign up now to receive updates → specterops.io/so-con

Happy #BloodHoundBasics day from Nathan Davis! Unsure what Active Directory Certificate Services (AD CS) Escalation (ESC) Attack Paths are? These depend heavily on certificate template configurations that may lead to the abuse of any principal in your forest. 🧵: 1/4