I had a great time at #socon2025! Big thanks to the SpecterOps crew for hosting. Slides for my "Hunting SMB Shares" talk are below for those who are interested.

Slides
github.com/NetSPI/Power...

PowerHuntShares
github.com/NetSPI/Power...

And here's a link to the blog - www.netspi.com/blog/technic...

In addition to the blog out today, there's a new tool in MicroBurst - Get-AzMachineLearningCredentials
This one has been in the works for a while, but it's a tool to dump the credentials that are stored by the Azure Machine Learning service. github.com/NetSPI/Micro...

Today is #BloodHoundBasics Day! 🙌

We commonly see Domain Admins peppered across Organizational Units. This can degrade your security posture by making Group Policy enforcement hard to understand or audit.

BloodHound helps by visualizing BOTH the OU placement AND group membership.

🧵 1/2

Oops, bad link, fixed: raw.githubusercontent.com/NetSPI/Power...

PowerHuntShares.v2: New Sample HTML Report
Here is a sample report for those who wanted it. Enjoy!
raw.githubusercontent.com/NetSPI/PowerHu…

This State of Generative AI report from Menlo Ventures provided some good insights on where cybersecurity professionals might look for risk in terms of assessments and research.

menlovc.com/2024-the-sta...

I couldn't find any PowerShell examples of encrypting/decrypting data w/ Azure Key Vault keys, so I made some:

Protect-StringWithAzureKeyVaultKey
Unprotect-StringWithAzureKeyVaultKey

github.com/BloodHoundAD...

Explanatory blog post coming soon.