Andy Robbins

10 years ago this week I published this blog post while @cptjesus.bsky.social, @harmj0y.bsky.social and I were working on what eventually became BloodHound: wald0.com?p=14

Next week I'll be speaking at WWHF Mile High in Denver about Abusing Backup Operators with @trustedsec.com's Titanis. web.cvent.com/event/1dbf78...

SCCM attack paths are messy until you can see them. 👀 ConfigManBearPig from Chris Thompson extends BloodHound with SCCM nodes + edges using OpenGraph, plus queries to surface hierarchy takeovers and escalation paths. Check it out: ghst.ly/45FCP5G

Note: Work related I do Active Directory stuff for a living. Security research to be more specific. One of my favorite niche AD topics is AdminSDHolder. It's even my vanity domain. I wrote a 159 pg book about AdminSDHolder. I'm kinda proud of it. specterops.io/resources/ad...

See your network shares the way attackers do. 👀 Meet ShareHound, an OpenGraph collector for BloodHound CE & Enterprise that reveals share-level attack paths at scale. @podalirius.bsky.social unpacks all the details in our latest blog post. ghst.ly/4ogiBqt

Incredible to see @hdm.io using BloodHound to build the new runZeroHound, connecting asset inventory data from @runzero.com with attack path visualization. Love seeing the community take BloodHound in new directions!

Credential Guard was supposed to end credential dumping. It didn't. Valdemar Carøe just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more: ghst.ly/4qtl2rm

Introducing PingOneHound! This OpenGraph extension for BloodHound can help you identify, analyze, execute, and remediate attack paths in PingOne organizations. Read the introductory blog post here: specterops.io/blog/2025/10...

@reconmtl.bsky.social has uploaded the majority of the 2025 talks, including my talk on LSA. You can check it out at the below link if you'd like. Thank you again to the organizers and everyone else who helps put on the conference. I look forward to coming back! youtu.be/G2CfMWXLU1U?...

Check out my new blog diving deeper into BroCI.

I've been researching the Microsoft cloud for almost 7 years now. A few months ago that research resulted in the most impactful vulnerability I will probably ever find: a token validation flaw allowing me to get Global Admin in any Entra ID tenant. Blog: dirkjanm.io/obtaining-gl...

We've got a fresh #BloodHoundBasics post from @jonas-bk.bsky.social! Ever wondered about those obscure AD special identity groups that quietly grant permissions to every principal in your environment? With BloodHound, you can uncover compromising permissions tied to these groups. 🧵: 1/2

BloodHound isn't just for Active Directory anymore. 🤯 @sadprocessor.bsky.social dives into the BloodHound OpenGraph functionality & demonstrates the new PowerShell cmdlets added to the BloodHound Operator module to work with the OpenGraph feature. ghst.ly/4peTTrB

From November 2016: This is how I used to design BloodHound's entity panels. Just a text editor to list out what I as a red-teamer wanted to see, with the corresponding (then new) cypher queries listed as well. Simple, VERY low-fidelity mockup, but really helped during the design phase.

🚨 New #BloodHound shirt alert 🚨 ✅ - Unisex adult/child and ladies sizes available ✅ - Cool design :) ✅ - ALL profits go to charity This time we are supporting Hope for HIE, which supports families suffering the effects of hypoxic ischemic encephalopathy Get your shirt here: ghst.ly/bh8-tshirt

Check out my new blog on nested app authentication.

In this blog post I explain the fundamental building blocks, vocabulary, and principles of attack graph design for BloodHound: specterops.io/blog/2025/08...

Red teamers know the drill: endless file churning, hunting for passwords & tokens. 🔍 Meet DeepPass2, our new secret scanning tool that goes beyond structured tokens to catch those tricky free-form passwords too. Read Neeraj Gupta's blog post for more. ghst.ly/40HLNNA

Entra Connect sync accounts can be exploited to hijack device userCertificate properties, enabling device impersonation and conditional access bypass. @hotnops.bsky.social explores cross-domain compromise tradecraft within the same tenant. Read more: ghst.ly/3ISMGN9

@egyp7.bsky.social Hey dude ✌️

BloodHound v8.0 is here! 🎉 This update introduces BloodHound OpenGraph, revolutionizing Identity Attack Path Management by exposing attack paths throughout your entire tech stack, not just AD/Entra ID. Read more from Justin Kohler: ghst.ly/bloodhoundv8 🧵: 1/7

Happy Friday! @tifkin.bsky.social and I are happy to announce that we have cut the release for Nemesis 2.0.0 - check out the CHANGELOG for a (brief) summary of changes, and dive into our new docs for more detail! We're extremely proud and excited for this release github.com/SpecterOps/N...

So you've compromised a host that isn’t cloud-joined. Antero Guy breaks down how to request OAuth tokens & enumerate an Entra ID tenant by using an SSO cookie from a non cloud-joined device. Read more: ghst.ly/445tQKL

I publish two blog posts today! 📝🐫 First dives into how we're improving the way BloodHound models attack paths through AD trusts: specterops.io/blog/2025/06... Second covers an attack technique I came across while exploring AD trust abuse: specterops.io/blog/2025/06... Hope you enjoy the read 🥳

🕵️‍♀️ I'll be presenting "I SPy: Rethinking Entra ID research for new paths to Global Admin” at fwd:cloudsec June 30-July 1, alongside some fantastic other speakers: fwdcloudsec.org/conference/n... If you can’t make it, talks are streamed at: www.youtube.com/@fwdcloudsec

New tricks, same impact posts.specterops.io/update-dumpi...

Recently, Microsoft changed the way the Entra Connect Sync agent authenticates to Entra ID. Check out our latest blog post from @hotnops.bsky.social to learn how the agent works now & how these changes affect attacker tradecraft. ghst.ly/3ZpMc6y

🚨 New #BloodHoundBasics courtesy of @scoubi.bsky.social! You've successfully compromised Bob in marketing's account in an engagement. Mark it as Owned by right-clicking ➡️ "Add to Owned" ➡️ run the query "Shortest Paths from Owned objects to Tier Zero" & see your new attack paths! (1/2)

Andy Robbins: The Evolution of Bloodhound podcasters.spotify.c...

MATCH (c1:Computer)-[:MemberOf*1..]->(g:Group) WHERE g.objectsid ENDS WITH '-516' WITH COLLECT(c1[.]name) AS dcs MATCH (c2:Computer) WHERE c2.enabled = true AND (c2.operatingsystem contains '2025') AND (c2[.]name IN dcs) RETURN c2[.]name If this query hits, you're DA: www.akamai.com/blog/securit...

It's #BloodHoundBasics day! Let's talk Tier 0 inheritance. If you're trying to unravel why some of the objects in your environment show up as Tier 0, this query will demonstrate the nuances of inheritance in 2 ways: inheritance up w/ OUs, & inheritance down w/ Groups. 🧵 1/3

We are BACK with another #BloodHoundBasics post, this week courtesy of @andyrobbins.bsky.social. ICYMI: The BloodHound BACK button is BACK. Just use your browser's BACK button to go BACK. 🔙

There are trans Americans right now looking out at this world and wondering if anyone is going to stand up for them and for their simple right to exist. Well, I am. We are. We will.

Excited to be at @specterops.bsky.social SO-CON this week!! If you're around, I'll be presenting "Abusing AUs, Confusing the SOC" tomorrow bright & early:

Introducing a new tool designed to help you install & manage BloodHound instances...🥁 BloodHound CLI! Check out @printingprops.com's blog post to learn how this tool dramatically simplifies installation and server management. ghst.ly/40zXAxI

Few BloodHound python updates: LDAP channel binding is now supported with Kerberos auth (native) or with NTLM (custom ldap3 version). Furthermore, the BH CE collector now has its own pypi package and command. You can have both on the same system with pipx. github.com/dirkjanm/Blo...

Santa's early w/ a new #BloodHoundBasics post!🎅 Looking for new Attack Paths to the domain? 🔎 BH v6.3 introduces CoerceToTGT. The edge connects principals w/ unconstrained delegation to the domain, as attackers can use those to coerce privileged computers & retrieve their TGT.

A new fun way to set shadow credentials posts.specterops.io/attacking-en...

New blog post alert! 🚨 Lance Cain shares insights from a recent security assessment about the attack surface of Single-Page Applications integrated w/ Azure and how to aid technology professionals in securing their Azure environment. ghst.ly/4gq8E5y

Awesome work by Lance, clear write-up on the issue, the solution, a PR to ROADtools and more tradecraft!

New #AADInternals version is finally out now: ▪ Moved endpoint related stuff to new module: AADInternals-Endpoints ▪ Added blue team stuff ▪ Added red team stuff See full change log at: aadinternals.com/aadinternals...

A quick tour of new functions in BARK that support Azure Key Vault tradecraft research, including a walk-through of how an adversary may chain these functions together as part of an attack path: posts.specterops.io/azure-key-va...

I couldn't find any PowerShell examples of encrypting/decrypting data w/ Azure Key Vault keys, so I made some: Protect-StringWithAzureKeyVaultKey Unprotect-StringWithAzureKeyVaultKey github.com/BloodHoundAD... Explanatory blog post coming soon.