SpecterOps

@SpecterOps

Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management

specterops.io Joined January 2017

406 Following 43K Followers 4.2K Posts

Latest posts 5

Pinned post

SpecterOps @SpecterOps Oct 14

The #SOCON2027 Call for Presentations is open! 🙌

Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it.

Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS

SpecterOps @SpecterOps 8h

Your next move changes when defenders respond.

Practise adapting your tradecraft against live defenders in our Red Team Operations training at #BHEU.

Join our team December 7 through 10 in London: ghst.ly/4AQLIHs

SpecterOps @SpecterOps 3d

Happy #BloodHoundBasics courtesy of @_wald0!

Struggling with cypher? We can help! We have several resources available including:

Docs: ghst.ly/4t4UKxr
Blogs: ghst.ly/4j2Kjqv

Or hop into the Slack/Discord, we are happy to help.

bloodhound.specterops.io Supported Cypher Syntax - SpecterOps This page documents the supported openCypher Syntax that BloodHound officially supports

SpecterOps @SpecterOps 3d

A vendor holds credentials. A service principal holds permissions in your tenant.

For multi-tenant apps, a compromised cred can expose multiple customer environments.

Read more on app registrations, service principals & consent connect from @rbnroot ⤵️ ghst.ly/4jVEjkl

specterops.io Principal Problems: App Registrations, Service Principals, and the Hidden Risk of Multi-Tenant Apps App registrations vs service principals in Entra ID, and why one stolen credential in the ConnectWise breach reached 100+ tenants.

SpecterOps @SpecterOps 4d

“That template controls that agent. Somebody else is in control of that template.”

@Icemoonhsv and @elad_shamir explain why an agent’s blueprint matters when evaluating who controls its access.

Check out #KnowYourAdversary: ghst.ly/4eTDKnB

0:45