Martin Sohn Christensen

Martin Sohn Christensen

@martinsohn.dk

Security Researcher @ SpecterOps https://martinsohn.dk

98 followers56 following31 posts

Martin Sohn Christensen
@martinsohn.dk

RID-500 is AD's best break-glass account... and you should disable it!๐Ÿ™ƒ Jorge de Almeida Pinto shared counterintuitive wisdom at #TROOPERS26 - All-powerful and cannot get locked out. - Disabled = more secure. - Disabled bypassed when booting in Safe Mode With Networking. Sources in๐Ÿงต

Martin Sohn Christensen
@martinsohn.dk

Jorge's blog series "Breaking The Glass Of Your โ€œGet-Out-Of-Jail-For-Freeโ€ AD Account" Part 1: jorgequestforknowledge.wordpress.com/2024/04/23/b... Part 2: jorgequestforknowledge.wordpress.com/2024/05/04/b... Safe Mode with Networking bypasses disabled RID-500: learn.microsoft.com/en-us/troubl...

jorgequestforknowledge.wordpress.com(2024-04-23) Breaking The Glass Of Your โ€œGet-Out-Of-Jail-For-Freeโ€ AD Account โ€“ Introduction (Part 1)When installing Active Directory (AD), in the first AD domain, the so-called Forest Root AD Domain, an administrator account is created as part of the creation of the AD domain. This also happens iโ€ฆ
Martin Sohn Christensen
@martinsohn.dk

#TROOPERS26 afterglow: Andrew Schwartz on building a solid LDAP detection stack - why signature-based detection is failing and volume-based detection generally wins. Lots of tips for detecting SharpHound, ldapnomnom, SOAPy & more.

Martin Sohn Christensen reposted

Thomas Naunheim
@naunheim.cloud

Speaking at #TROOPERS26 next week and I can't wait. Joining @martinsohn.dk to talk about attack paths to #PAW and real-world risks of tiered admin models with #IntuneRBAC. Plus something we've been working on for months... See you in Heidelberg! www.troopers.de #EntraOps #Bloodhound

Martin Sohn Christensen
@martinsohn.dk

I wrote about a recent research task of mine -

SpecterOps@specterops.io

AzureHound now has least-privilege permission documentation & @martinsohn.dk shows the internal research that made it. TL;DR of changes: Directory.Read.All โ†’ 8 MS Graph permissions Reader role โ†’ 16 ARM actions Directory Readers โ†’ not required Check it out: https://ghst.ly/4vzI8yk

ghst.lyghst.ly
Martin Sohn Christensen
@martinsohn.dk

This sounds awesome for no money. Unfortunately I'll be between BSides & Troopers those days :/

MASTER BOOT RECORD@masterbootrecord.bsky.social

Next month we perform at ROMA.EXE the first demo party in Rome. On stage with arottenbit and Gom Jabbar (Kenobit + Stormo). Location: Casilino Sky Park Tickets on DICE 10โ‚ฌ (Show only on 20 June) 25โ‚ฌ concert + demoparty access (20/21 june) MBRSERVER.COM / ROMA-EXE.COM SPREAD THE CODE

Martin Sohn Christensen reposted

SpecterOps
@specterops.io

BloodHound users: your query workflow just got better. With this latest update, @martinsohn.dk and @joeydreijer.bsky.social introduce multi-source loading, multi-server support, and dozens of new queries, now live in the Query Library. Check it out: https://ghst.ly/4vBic6c

specterops.ioWhat's New in the BloodHound Query Library: BYOL, OpenGraph, Multi-Server, and More - SpecterOpsBloodHound Query Library now supports custom query sources, OpenGraph extensions, and multi-server environments.

Martin Sohn Christensen reposted

SpecterOps
@specterops.io

Time is running out โณ Grab your spot in our Detection course at #SOCON2026 happening next week! In-person attendees receive a free pass to the conference days. Save your seat before registration closes TOMORROW! http://ghst.ly/socon26-regbsky

Martin Sohn Christensen
@martinsohn.dk

My responsible disclosure covering 16 vendors whose documentation was steering customers into critical misconfigs. More details will be shared at my talk @ BSides Prague on April 24! www.bsidesprg.cz#program:~:te...

bsidesprg.czSecurity B-Sides PragueBSides Prague provides a platform for the information security community to present their work in a friendly and welcoming environment.
SpecterOps@specterops.io

The origin of critical misconfigurations may be a trusted vendor of yours. @martinsohn.dkโ€™s latest research found official documentation across 16 vendors introducing critical attack paths, often through AD CS misconfigurations. Check it out: https://ghst.ly/4bwYiBe

ghst.lyRTFM: Read The Fatal Manual - When Vendor Documentation Creates Critical Attack Paths - SpecterOpsHow major tech companies' docs guide users to deploy critical misconfigurations, often AD CS ESC1. Responsible disclosure findings, process, timeline.

Martin Sohn Christensen reposted

SpecterOps
@specterops.io

The #SOCON2026 agenda is live! ๐ŸŽ‰ Explore talks, topics, & speakers across the Tradecraft, OpenGraph, & new Practice Track, focused on turning Attack Path Management into an operational discipline. Check out the agenda & plan your experience: ghst.ly/socon26-tw ๐Ÿงต: 1/4

Martin Sohn Christensen
@martinsohn.dk

BloodHound's OpenGraph is ๐Ÿ”ฅ๐Ÿš€ This is how we rapidly developed a customer specific attack primitive for BloodHound that we call "ManagerOf" ๐Ÿ‘‡

SpecterOps@specterops.io

New #BloodHoundBasics post from @martinsohn.dk โ€ผ๏ธ Today is a demo of how BloodHound's #OpenGraph helped a customer build ManagerOfHound.ps1 - going from attack path concept to a custom "ManagerOf" edge in BloodHound. Can it fit in a thread? Let's see... ๐Ÿงต 1/6

Martin Sohn Christensen reposted

Jonas Bรผlow Knudsen
@jonas-bk.bsky.social

I publish two blog posts today! ๐Ÿ“๐Ÿซ First dives into how we're improving the way BloodHound models attack paths through AD trusts: specterops.io/blog/2025/06... Second covers an attack technique I came across while exploring AD trust abuse: specterops.io/blog/2025/06... Hope you enjoy the read ๐Ÿฅณ

specterops.ioGood Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound - SpecterOpsThe ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make i...
Martin Sohn Christensen
@martinsohn.dk

Easily find and share BloodHound Cyphers on queries.specterops.io Released with ~90 new Cypher queries, go check them out! @joeydreijer.bsky.social and I spent many hours creating it and we hope you find it useful. All feedback is appreciated :)

queries.specterops.ioqueries.specterops.io
SpecterOps@specterops.io

Introducing the BloodHound Query Library! ๐Ÿ“š @martinsohn.dk & @joeydreijer.bsky.social explore the new collection of Cypher queries designed to help BloodHound users to unlock the full potential of the BloodHound platform by creating an open query ecosystem. ghst.ly/4jTgRQQ

ghst.lyIntroducing the BloodHound Query Library - SpecterOpsThe BloodHound Query Library is a community-driven collection of BloodHound Cypher available at https://queries.specterops.io
Martin Sohn Christensen
@martinsohn.dk

**Every** BloodHound Enterprise tenant I've checked has multiple Non Tier Zero principals with the rights required for BadSuccessor. Luckily a 2025 DC is still rare. Often helpdesk has GenericAll, misconfig'ed to apply on the OU itself, instead of only inheriting to principals within.

SpecterOps@specterops.io

Happy #BloodHoundBasics Day! This week's ๐Ÿ”ฅ topic from @martinsohn.dk: the Microsoft-wont-fix-yet "BadSuccessor" attack that abuses Server 2025's dMSA feature for domain takeover. This ๐Ÿงต shows how you can use BloodHound to find BadSuccessor risk. (1/9)

Martin Sohn Christensen
@martinsohn.dk

BloodHound has 4 new edges: ๐—–๐—ผ๐—ฒ๐—ฟ๐—ฐ๐—ฒ๐—”๐—ป๐—ฑ๐—ฅ๐—ฒ๐—น๐—ฎ๐˜†๐—ก๐—ง๐—Ÿ๐— ๐—ง๐—ผ๐—ฆ๐— ๐—•, ...๐—ง๐—ผ๐—Ÿ๐——๐—”๐—ฃ, ...๐—ง๐—ผ๐—Ÿ๐——๐—”๐—ฃ๐—ฆ, ...๐—ง๐—ผ๐—”๐——๐—–๐—ฆ [ESC8] They combine ๐—ฐ๐—ผ๐—ฒ๐—ฟ๐—ฐ๐—ถ๐—ผ๐—ป and ๐—ฟ๐—ฒ๐—น๐—ฎ๐˜†๐—ถ๐—ป๐—ด, allowing Auth. Users to compromise computers. Read this excellent post by Elad Shamir if you are unfamiliar with those terms or want to know how to mitigate.

SpecterOps@specterops.io

Think NTLM relay is a solved problem? Think again. Relay attacks are more complicated than many people realize. Check out this deep dive from Elad Shamir on NTLM relay attacks & the new edges we recently added to BloodHound. ghst.ly/4lv3E31

Martin Sohn Christensen reposted

Bluesky
@bsky.app

Merry Christmas from us to you ๐ŸŽ„๐ŸŽ๐Ÿ’™ We launched Trending Topics today, and you can find it by tapping the search icon on the bottom bar of the app or the right sidebar on desktop.

Martin Sohn Christensen reposted

Andrea P
@decoder-it.bsky.social

I'm glad to release the tool I have been working hard on the last month: #KrbRelayEx A Kerberos relay & forwarder for MiTM attacks! >Relays Kerberos AP-REQ tickets >Manages multiple SMB consoles >Works on Win& Linux with .NET 8.0 >... GitHub: github.com/decoder-it/K...

Martin Sohn Christensen
@martinsohn.dk

ShadowHound - brand new .ps1 SharpHound alternative that supports LDAP and ADWS Outputs data in ldapsearch format that can be converted to BH JSON with BOFHound. blog.fndsec.net/2024/11/25/s...

blog.fndsec.netShadowHound: A SharpHound Alternative Using Native PowerShellShadowHound is a PowerShell tool designed for mapping Active Directory environments without using known malicious binaries. It utilizes legitimate PowerShell modules for data collection through twoโ€ฆ
Martin Sohn Christensen
@martinsohn.dk

Join our webinar on Thurs when Jonas Knudsen, Lee Christensen, and I will present pt. 4 of "What Is Tier Zero", covering: - MS Exchange On-Premises - ADCS - Insights from isolating Tier Zero with BloodHound Enterprise customers Watch live or register for on-demand at ghst.ly/4eSssxL

ghst.lyWelcome! You are invited to join a webinar: Defining the Undefined: What is Tier Zero, Part 4. After registering, you will receive a confirmation email about joining the webinar.In this webinar we continue to define Tier Zero with another deep dive into the intricate world of critical identities and resources across Active Directory and Azure. This discussion covers: - Insig...

You are up to date.