@SpecterOps

Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management

specterops.io
Joined January 2017
  • Tweets4.2K
  • Following405
  • Followers42.5K
1.9KMedia
The #SOCON2027 Call for Presentations is open! 🙌 Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it. Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS
3
1
11
2,470
ICYMI we have a Discord server now! 🙌 Join us ⤵️
Scoubi@ScoubiMtl4h
Replying to @SpecterOps
@SpecterOps now has a Discord server for the Community to gather and talk about #BloodHound #AttackPath #Offensive and #Defensive #Tradecraft #Identity and just have fun talking with like minded professionals! Join us now at : discord.specterops.io and get a vanity 👻 role!

Join the SpecterOps Community Discord Server!

A space for community members to discuss tools like BloodHound, Ghostwriter, Mythic, Nemesis and more, as well as keep track of discussions related to SpecterOps tools, our latest news and updates. Fe

discord.com
1
4
664
What comes after initial access? Build your red team tradecraft with our team at #BHEU, from command and control to Active Directory exploitation. Join us 7-10 December in London. Save your spot: ghst.ly/4AQLIHs
1
10
1,047
Happening now! @jaredcatkinson is speaking during the OT resilience and defense panel at #ManuSecUSA.
2
1,267
“That template controls that agent. Somebody else is in control of that template.” @Icemoonhsv and @elad_shamir joined @jaredcatkinson and @JustinKohler10 to chat about agent security for #KnowYourAdversary. 👀: specterops.io/know-your-adve…
1
5
1,247
ICYMI: The #SOCON2027 CFP is open! 🎤 Share your research, technical deep dives, or lessons from the field on adversary tradecraft, identity security, and Attack Paths. Submit a 25- or 50-minute talk by November 13: ghst.ly/4dGrZAx
6
1,213
An attack path can span GitHub and AWS. @hotnops and @n0pe_sled recently joined #KnowYourAdversary to explore third party trust and paths to critical resources. ghst.ly/4zvoVQ1
1
5
1,381
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants. 🧵1/4
Huntress
@HuntressLabsOct 16
RAPID RESPONSE: Huntress has become aware of a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). We’ve confirmed that an unknown threat actor abused the access they obtained in SkyKick to pivot to access customers' Microsoft 365 environments. 🧵
5
15
1
72
7,488
more replies
BloodHound users may run the below queries to identify potential impact to their environs. Identify outbound control of ConnectWise app: MATCH p=(sp:AZServicePrincipal)-[r]->(target)  WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’  RETURN p
1
1
4
819
Identify paths from the impacted service principal to Tier Zero.  MATCH p=shortestPath((sp:AZServicePrincipal)-[*1..6]->(t))  WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’    AND t.system_tags CONTAINS ‘admin_tier_0’
1
698
This week's #BloodHoundBasics courtesy of Carlo Alcantara: Table View! Because sometimes defenders think in lists. The new table view accompanies the Graph View on the Attack Paths page in BloodHound Enterprise. (1/3)
1
10
1,611
Certain fields (Platform, Attack Paths, Environment) can be searched to filter the view to specific findings. (2/3)
1
643
This new view also includes updates to the underlying API which now tracks history of findings & remediations. Filtering & sorting the columns now provides a way to track progress over time, giving you insight into when a finding first appeared & when it was last seen. (3/3)
480
(3/3)
67
SpecterOps retweeted
Scoubi@ScoubiMtlOct 16
I will be @BSidesNYC tomorrow at the @SpecterOps booth! Come talk to us and if you are wearing a #SpecterOps or #BloodHound t-shirt, I might have something special for you (very limited). See you tomorrow! :)
1
3
597
“We have to assume that it will take us some time to patch.” Sahan Fernando, CISO at @radychildrens, discusses balancing security remediation with patient care in the latest episode of #KnowYourAdversary. 👀: ghst.ly/4zvoVQ1
1
2
1,373
One more day to haunt a graph. 👻 Our OpenGraph Halloween Art Competition closes TOMORROW, Oct 16. Pumpkins, skeletons, or something completely cursed. No masterpiece required. Email [email protected] Subject: OpenGraph Halloween Art Competition
1
1,215
Load more