3 tracks. Real-world case studies. Hands-on BloodHound Quest lab. Join us at #SOCON2026 and advance your identity-first security strategy.
🎟️ Save 25% with early bird: specterops.io/so-con
highlights a powerful new feature you might’ve missed: Cypher Selectors for Privilege Zones.
Why powerful? Unlike classic objectid selectors, Cypher selectors use complex conditions & can be created before the node exists.
🧵: 1/3
highlights a powerful new feature you might’ve missed: Cypher Selectors for Privilege Zones.
Why powerful? Unlike classic objectid selectors, Cypher selectors use complex conditions & can be created before the node exists.
🧵: 1/3
In-person attendees also receive a free conference pass. Save your spot ➡️ ghst.ly/socon-2026
In-person attendees also receive a free conference pass. Save your spot ➡️ ghst.ly/socon-2026
Forrest Kasler shares a cautionary tale on why you should always read the docs when you are about to issue a “DELETE” operation on any resource in your client’s infrastructure. ghst.ly/3X2bTZ4
Forrest Kasler shares a cautionary tale on why you should always read the docs when you are about to issue a “DELETE” operation on any resource in your client’s infrastructure. ghst.ly/3X2bTZ4
Meet ShareHound, an OpenGraph collector for BloodHound CE & Enterprise that reveals share-level attack paths at scale.
@podalirius.bsky.social unpacks all the details in our latest blog post. ghst.ly/4ogiBqt
Meet ShareHound, an OpenGraph collector for BloodHound CE & Enterprise that reveals share-level attack paths at scale.
@podalirius.bsky.social unpacks all the details in our latest blog post. ghst.ly/4ogiBqt
Join Nick Powers & @tw1sm.bsky.social TOMORROW as they share new methods to enumerate EPA enforcement across MSSQL, HTTP, & more—and intro RelayInformer, expanding attacker-perspective coverage for key protocols.
Grab your spot → ghst.ly/oct-web-bsky
Join Nick Powers & @tw1sm.bsky.social TOMORROW as they share new methods to enumerate EPA enforcement across MSSQL, HTTP, & more—and intro RelayInformer, expanding attacker-perspective coverage for key protocols.
Grab your spot → ghst.ly/oct-web-bsky
Elad Shamir discusses BloodHound OpenGraph's journey, the challenges of modeling adversary tradecraft, and the Clean Source Principle w/ Jared Atkinson and Justin Kohler in the latest #KnowYourAdversary.
🎧: ghst.ly/4ommfPu
Elad Shamir discusses BloodHound OpenGraph's journey, the challenges of modeling adversary tradecraft, and the Clean Source Principle w/ Jared Atkinson and Justin Kohler in the latest #KnowYourAdversary.
🎧: ghst.ly/4ommfPu
Go back ⬅️, forward ➡️, & share your BloodHound view 👀. Earlier this year, we added Back button support directly through your browser. You can also copy your current URL & share it with a teammate so they see what you see.
Go back ⬅️, forward ➡️, & share your BloodHound view 👀. Earlier this year, we added Back button support directly through your browser. You can also copy your current URL & share it with a teammate so they see what you see.
Valdemar Carøe just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more: ghst.ly/4qtl2rm
Valdemar Carøe just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more: ghst.ly/4qtl2rm
@andyrobbins.bsky.social dives in to the architecture and mechanics in our latest blog post. Learn more & get started today. ghst.ly/3WLqlVd
@andyrobbins.bsky.social dives in to the architecture and mechanics in our latest blog post. Learn more & get started today. ghst.ly/3WLqlVd
dMSA abuse is still a problem, and @logangoins.bsky.social
just dropped a reality check with new tooling to prove it.
Learn more about the issue & the new BadTakeover BOF. ghst.ly/42POg9L
dMSA abuse is still a problem, and @logangoins.bsky.social
just dropped a reality check with new tooling to prove it.
Learn more about the issue & the new BadTakeover BOF. ghst.ly/42POg9L
🧵 1/5
🧵 1/5
Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back!
youtu.be/G2CfMWXLU1U?...
Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back!
youtu.be/G2CfMWXLU1U?...
In his latest blog post, @blaisebrignac.bsky.social explains the history, challenges, and attack primitives that make securing AI systems such an extreme challenge.
Read more: ghst.ly/497pxl0
In his latest blog post, @blaisebrignac.bsky.social explains the history, challenges, and attack primitives that make securing AI systems such an extreme challenge.
Read more: ghst.ly/497pxl0
@1cemoon.bsky.social documents NAA flows and BroCI—filling a gap for research on Microsoft identity protocols. ghst.ly/3Jdhp7Z
@1cemoon.bsky.social documents NAA flows and BroCI—filling a gap for research on Microsoft identity protocols. ghst.ly/3Jdhp7Z
DYK: Risk calculation in BHE findings can be based on different values—some use Exposure (inbound control), others Impact (outbound). Hover over a finding in the Attack Paths page to see which applies.
DYK: Risk calculation in BHE findings can be based on different values—some use Exposure (inbound control), others Impact (outbound). Hover over a finding in the Attack Paths page to see which applies.
Have you been working on something interesting in Attack Path Management or identity-first defense? Join us in Arlington, VA (April 13–14) and share your work with the community.
Submit your talk by Nov. 15 → ghst.ly/socon26-cfp
Have you been working on something interesting in Attack Path Management or identity-first defense? Join us in Arlington, VA (April 13–14) and share your work with the community.
Submit your talk by Nov. 15 → ghst.ly/socon26-cfp
Jared Atkinson dives into the Clean Source Principle, hidden trust relationships, & why BloodHound OpenGraph changes the game. ghst.ly/4pYTtFU
Jared Atkinson dives into the Clean Source Principle, hidden trust relationships, & why BloodHound OpenGraph changes the game. ghst.ly/4pYTtFU
Today we are highlighting the ReadGMSAPassword edge.
A GMSA is an Active Directory object. GMSA stands for Group-Managed Service Account - a great solution from Microsoft that we recommend organizations use!
🧵: 1/3
Today we are highlighting the ReadGMSAPassword edge.
A GMSA is an Active Directory object. GMSA stands for Group-Managed Service Account - a great solution from Microsoft that we recommend organizations use!
🧵: 1/3
John Wotton's latest on AI gated loaders shows how offensive operators are using LLMs to make shellcode execution context-aware, executing only when OPSEC policies are met. ghst.ly/4nvxsgh
John Wotton's latest on AI gated loaders shows how offensive operators are using LLMs to make shellcode execution context-aware, executing only when OPSEC policies are met. ghst.ly/4nvxsgh
3 tracks. Real-world case studies. Hands-on BloodHound Quest lab. Join us at #SOCON2026 and advance your identity-first security strategy.
🎟️ Save 25% with early bird: specterops.io/so-con
3 tracks. Real-world case studies. Hands-on BloodHound Quest lab. Join us at #SOCON2026 and advance your identity-first security strategy.
🎟️ Save 25% with early bird: specterops.io/so-con
@werdhaihai.bsky.social just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG
@werdhaihai.bsky.social just dropped research on a new lateral movement technique using Windows Installer Custom Action Server, complete with working BOF code. ghst.ly/4pN03PG
By now, you've probably heard about our Query Library. But did you know you can run any query in your own instance of BHE/BHCE and then save the query to your Personal Library?
Follow the steps threaded below!
🧵: 1/5
By now, you've probably heard about our Query Library. But did you know you can run any query in your own instance of BHE/BHCE and then save the query to your Personal Library?
Follow the steps threaded below!
🧵: 1/5
The Salesloft attack shows how GitHub → AWS → Drift → Salesforce created an attack highway defenders never saw coming.
Jared Atkinson's analysis details the patterns we should look out for. ghst.ly/4ngDQrD
The Salesloft attack shows how GitHub → AWS → Drift → Salesforce created an attack highway defenders never saw coming.
Jared Atkinson's analysis details the patterns we should look out for. ghst.ly/4ngDQrD
Register & save your spot ➡️ ghst.ly/specter-bash-2025
Register & save your spot ➡️ ghst.ly/specter-bash-2025
Jared Atkinson & Justin Kohler explore identity security from the attacker's perspective. Real stories, real tactics, real insights.
Check out our first three episodes now 👉 ghst.ly/kya-podcast
Jared Atkinson & Justin Kohler explore identity security from the attacker's perspective. Real stories, real tactics, real insights.
Check out our first three episodes now 👉 ghst.ly/kya-podcast