Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management
Joined January 2017
- Tweets4.2K
- Following406
- Followers42.6K
- Likes2.3K
Pinned Tweet
The #SOCON2027 Call for Presentations is open! 🙌
Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it.
Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS
Happy #BloodHoundBasics courtesy of Jacob Jackson!
New in BloodHound Enterprise: Findings Prioritization (Early Access).
Go beyond severity ratings with risk-based rankings to focus remediation where it matters most. ghst.ly/4yLaBlK
Results are in... Congrats to @stuk0v_ winner of our OpenGraph Halloween Art Competition! 🎃
Check out Mat’s winning design below & join us in giving him a round of applause.
Thanks to everyone who submitted a design & brought some Halloween spirit to the BloodHound community!
“Right now we're targeting least privilege.”
@Icemoonhsv and @elad_shamir discuss the permissions needed to enumerate agents and how automating setup makes deployment easier.
Check out #KnowYourAdversary: ghst.ly/4eTDKnB
BloodHound v8.0 with OpenGraph is a finalist for Innovation of the Year (Open Source Product or Tool) in the 2026 @SANSInstitute Difference Makers Awards!
BloodHound community, we’d love your vote. Voting closes November 9: ghst.ly/4knB45j
#SANSDMA
TOMORROW 👉 Join @robwinchester3 & @ne0nd0g for a virtual discussion on frontier AI in federal cyber defense, including its role in threat research, defensive operations and the oversight agencies need.
Register at ghst.ly/4yZPzks
“Detection is not response or remediation.”
@jaredcatkinson explains why identifying an attack needs to lead to timely action and how prevention can make detection easier in our latest ep. of #KnowYourAdversary.
ghst.ly/4ipZ8mF
A compromised workstation shouldn’t give an attacker a path to production.
JPMorganChase’s cyber resilience guidance calls for removing standing privileges & excessive access held by service accounts & machine identities.
Agreed. Cut those Attack Paths. ghst.ly/4iATiil
Happy #BloodHoundBasics Friday from @sec_distilled! 🎉
Looking to get started with BloodHound but don't have an environment to collect from? We've got you covered with sample data for both Active Directory and Azure environments here: ghst.ly/4i9zWQd
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Where does frontier AI fit into federal cyber defense?
Join @robwinchester3 & @ne0nd0g for a webinar on AI’s defensive value, oversight and the role of experienced operators.
📆 Oct. 29 | 2 PM EDT / 11 AM PDT
💻 Virtual
Register 👉 ghst.ly/4yZPzks
What happens when Chromium becomes an offensive tool?
Our latest SO:Brief features @KingOfTheNOPs and @ScoubiMtl on Silent Chrome, offensive tradecraft, and what it means for defenders.
Go deeper with Andrew’s research 👉 ghst.ly/45S1ZgW
“It really makes it concrete and very visual.”
Sahan Fernando, CISO at Rady Children’s Health San Diego, explains how BloodHound Enterprise helps show identity risk and make the case for remediation.
Watch the latest #KnowYourAdversary: ghst.ly/4ipZ8mF
ICYMI we have a Discord server now! 🙌
Join us ⤵️
@SpecterOps now has a Discord server for the Community to gather and talk about #BloodHound #AttackPath #Offensive and #Defensive #Tradecraft #Identity and just have fun talking with like minded professionals!
Join us now at : discord.specterops.io and get a vanity 👻 role!
What comes after initial access?
Build your red team tradecraft with our team at #BHEU, from command and control to Active Directory exploitation.
Join us 7-10 December in London. Save your spot: ghst.ly/4AQLIHs
Happening now! @jaredcatkinson is speaking during the OT resilience and defense panel at #ManuSecUSA.
“That template controls that agent. Somebody else is in control of that template.”
@Icemoonhsv and @elad_shamir joined @jaredcatkinson and @JustinKohler10 to chat about agent security for #KnowYourAdversary.
👀: specterops.io/know-your-adve…
ICYMI: The #SOCON2027 CFP is open! 🎤
Share your research, technical deep dives, or lessons from the field on adversary tradecraft, identity security, and Attack Paths.
Submit a 25- or 50-minute talk by November 13: ghst.ly/4dGrZAx
An attack path can span GitHub and AWS.
@hotnops and @n0pe_sled recently joined #KnowYourAdversary to explore third party trust and paths to critical resources.
ghst.ly/4zvoVQ1
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.
🧵1/4
BloodHound users may run the below queries to identify potential impact to their environs.
Identify outbound control of ConnectWise app:
MATCH p=(sp:AZServicePrincipal)-[r]->(target)
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’
RETURN p