SpecterOps

The #SOCON2027 Call for Presentations is open! 🙌 Discovered, built, broken or defended something in identity security or Attack Paths? We want to hear about it. Submit a 25- or 50-minute session proposal by November 13: https://ghst.ly/4dCeLVx

A compromised workstation shouldn’t give an attacker a path to production. JPMorganChase’s cyber resilience guidance calls for removing standing privileges & excessive access held by service accounts & machine identities. Agreed. Cut those Attack Paths. https://ghst.ly/4iATiil

What comes after initial access? Build your red team tradecraft with our team at #BHEU, from command and control to Active Directory exploitation. Join us 7-10 December in London. Save your spot: https://ghst.ly/4AQLIHs

An attack path can span GitHub and AWS. @hotnops.bsky.social and Julian Catrambone recently joined #KnowYourAdversary to explore third party trust and paths to critical resources. https://ghst.ly/4yZNLb9

Reading AWS policies individually can miss how permissions combine into attack paths. Daniel Heinsen and Julian Catrambone discuss mapping relationships across accounts, identities, and resources in BloodHound on #KnowYourAdversary. https://ghst.ly/4gS0KFc

AI agents add identities. AI helps attackers find existing paths faster. Our Chief Product Officer Justin Kohler explores what the 2026 Microsoft Digital Defense Report means for identity risk and Attack Path Management. Read his analysis: https://ghst.ly/4AWdGlh

Our team will be at #BHEU leading our Red Team Operations training in London from 7-10 December. Four days of hands on tradecraft in a simulated enterprise environment. Explore the course and register: https://ghst.ly/4AQLIHs

“Attackers don’t operate that way.” Our Chief Technology Officer, Jared Atkinson, on why security risks can’t be viewed in isolation. Permissions, relationships and identities connect to form attack paths. More in @vmblog.bsky.social: https://ghst.ly/3VrSnb0

How haunted can you make a graph? 👻 Create Halloween art with OpenGraph! Think ghosts, monsters, & pumpkins for a chance to win swag. Submit your piece to our OpenGraph Halloween Art Competition by October 16. We crown the winner on Halloween. Details: https://ghst.ly/4hphfZD

What do your AWS permissions make possible? @hotnops.bsky.social and Julian Catrambone join our hosts Jared Atkinson and Justin Kohler to discuss bringing AWS attack paths into BloodHound in episode 16 of #KnowYourAdversary. 🎧: https://ghst.ly/4gS0KFc

New from the Tradecraft Academy 👇 Built in partnership w/ OpenAI through OpenAI Daybreak Defense Network, Adversary Intelligence: LLM Tradecraft provides hands-on training to build, evaluate, attack, and defend LLM and agentic systems. More from @harmj0y.bsky.social: https://ghst.ly/4hw4zim

AI may accelerate identity misuse, but paths to critical assets often run through inherited permissions, outdated groups and trust relationships. Hear from our team at #SecTor on October 8 at 1:15 PM ET: https://ghst.ly/4dRBHjq

A #BloodHoundBasics reminder from @scoubi.bsky.social ⤵️ Not into live chat? Join our new SpecterOps & BloodHound Community subreddit! Come for the AMA, stay for the discussions: https://www.reddit.com/r/SpecterOpsCommunity/

At #OffensiveAICon, @harmj0y.bsky.social & @tifkin.bsky.social will explore optimized evasion attacks & their transferability across EDR products. They’ll share findings from reverse engineering four EDRs and experimenting with LLMs & GEPA to expand the search space for effective obfuscation.

Introducing Ghostwriter Skills 👻 The first release helps with report templates, template QA, report readiness checks and executive summary drafts. Practitioners remain responsible for the final analysis. Explore each skill: https://ghst.ly/46zigYS

✨This is your sign to reserve your spot for Michael Grafnetter's webinar this week!✨ Hear about Pass-the-Passkey, a novel & actively researched category of malware-initiated attack techniques targeting passkey auth that can enable cloud user impersonation. 👉 https://ghst.ly/4cpVSoa

New #BloodHoundBasics post c/o @scoubi.bsky.social! 🎉 As of v9.7 BH supports multiple destinations in Pathfindings. You can force a path to traverse a specific node. It is also possible to rearrange the order of the nodes a path must traverse. For more info 👉 https://ghst.ly/4cOBtt9

Don't miss Justin Kohler's session at Infosec Nashville TOMORROW! Justin will explore why defenders need to shift focus to the identity layer as agents, non-human identities, and hidden trust introduce new risk. https://ghst.ly/4yCNTg1

Identity-driven attacks are among the most critical threat vectors in modern environments. Identity-driven Offensive Tradecraft at #SpecterBash covers the methodology for discovering & exploiting identity attack paths across on-prem & hybrid environments. https://specterops.io/specter-bash/

AI is speeding up attacks while expanding the enterprise attack surface. At Infosec Nashville, Justin Kohler will explore why defenders need to shift focus to the identity layer as agents, non-human identities, and hidden trust introduce new risk. https://ghst.ly/4yCNTg1

Adversary simulation tradecraft, live defense data, enterprise-scale labs. Red Team Operations at #SpecterBash doesn't just teach you how to attack. It teaches you how to think, adapt & operate under pressure. The scariest part? How much you didn't know going in. 🎃 https://ghst.ly/45COqlF

Why does SCCM app execution spawn from WmiPrvSE.exe instead of CcmExec.exe? @bouj33boy.bsky.social traced the full chain with ProcMon + Ghidra, from WMI tasking to CreateProcessW, and built a detection strategy around it. Check it out: https://ghst.ly/4gXzp2Z

The red team report has landed. What happens next? Russel Van Tuyl breaks down how to turn findings into action by prioritizing remediation, closing detection gaps, and building on what you learned. Read more: https://ghst.ly/46fFjHW

Tracking OAuth token exchanges is complicated. TATS can help. @1cemoon.bsky.social introduces the Token Analysis and Tracking System & shares some unexpected findings uncovered along the way. Check it out! https://ghst.ly/4xMBaYd

This #LaborDay, we’re celebrating the hard work and dedication of people everywhere who help their teams and communities thrive. Wishing everyone a safe and relaxing holiday with family and friends!

Introducing SpecterOps Skills: a public repository built to turn practitioner knowledge into reusable, reviewable workflows for AI-assisted security work. John Hopper shares what we're building, why we're building it, and how you can contribute ➡️ https://ghst.ly/4ybT6ew

See Azure & Entra ID the way attackers do. Our Azure course at #SpecterBash teaches you to identify the misconfigs & attack paths that matter, and take your first step in attacking or defending corporate cloud environments. Save your spot ➡️ https://ghst.ly/45COqlF

Passkeys are gaining adoption, and adversaries are exploring how to target them. Join Michael Grafnetter on Sept. 23 for a practical look at Pass-the-Passkey and emerging techniques for attacking passkey authentication. Register 👉 https://ghst.ly/4cpVSoa

In today’s installment of #BloodHoundBasics from Carlo Alcantara, a quick reminder that all pages in BloodHound support keyboard shortcuts. 💡 Use Alt/Option + H to access the shortcut menu to see all available options.

Did you miss our webinar w/ Kaleb Pomeroy & John Hopper last week? You can watch on demand now & hear their practical tips on designing with MCP, including how security and access boundaries influence agent interactions. 👀: https://ghst.ly/4y1vPfb

AI won't create new weaknesses. It will find the ones already in your environment faster. That's why we're signing OpenAI's cyber defense letter. Read our take on why visibility (not secrecy) wins: https://ghst.ly/3UHiBpw

ServiceNow won't let you query cleartext discovery credentials, not even as admin. @tw1sm.bsky.social found a way to make the server hand them over anyway, no coercion or relay needed. Works on SSH keys, AWS keys, Entra secrets, and LDAP creds. Check it out: https://ghst.ly/4y37KVo

Happy #InternationalDogDay from some of the VERY good dogs of SpecterOps! 🐶🐾 We're celebrating with a few of our team's canine coworkers. Now we want to see yours! Consider paying the pup tax and sharing a photo of your furry friend in the comments. 👇

ICYMI: @andyrobbins.bsky.social, @harmj0y.bsky.social & @cptjesus.bsky.social joined #KnowYourAdversary to take a look back at 10 years of BloodHound! Tune in & hear how BloodHound has evolved in the years since it was first unveiled at #DEFCON in 2016. Parts 1 & 2 ➡️ https://ghst.ly/3Kkoiob

Red teaming should produce findings security leaders can act on. @russelvantuyl.bsky.social , Andrew Chiles & @xpnsec.com will discuss aligning engagements to business risk, the impact of assumed breach & the difference between measuring and building detection & response. ➡️ ghst.ly/4qAYKEj

Can this role read that bucket?" and "Can it decrypt that key?" aren't the same question. @n0pe-sled.bsky.social's latest blog post introduces AWSHound, free, self-hosted, turns AWS Orgs into real BloodHound CE attack paths. Check it out: https://ghst.ly/4g4EJm9

#SpecterBash is back! 😎 Join us October 5-8 in Denver, CO for four days of adversary tradecraft courses, evening events, and the most fun you’ll have leveling up your infosec skills. 🎃 Registration is open: https://ghst.ly/45COqlF

Frontier AI is changing cyber defense. Dave Bittner talks with Clint Gibler, Cyber Lead at OpenAI, and Robby Winchester, our Chief Services Officer, about where it delivers the most value and why human judgment still matters. https://ghst.ly/4cuiSSP

Don’t forget to save your spot for our upcoming webinar! Join Jared Atkinson & Justin Kohler to explore Identity Attack Path Management in AWS, Entra Agent ID support, agentic AI security & the growing OpenGraph ecosystem. ➡️ https://ghst.ly/4h0yWPn

Your browser is a C2 agent waiting to happen. Andrew Gomez shows how to silently sideload a Chromium extension, no prompts or GUI, and turn Chrome/Edge into a persistent implant with SOCKS, cookie theft, and OS access. Check it out: https://ghst.ly/4g8AZif

Cookie theft got harder. Browser hijacking didn't. Andrew Gomez shows how enabling the Chrome DevTools Protocol inside a live Chrome/Edge process can bypass modern cookie protections, plus how to detect it with Sysmon. Explore more: https://ghst.ly/461sfpi

Happening soon! @martinsohn.dk is joining SagaLabs Community Night to present "How To Think In Graphs," covering the inherent advantages defenders & attackers have in the identity graph space, how to tool for the modern graph, & how to get an entire org thinking in graphs.

AI coding agents leave a lot behind on endpoints. Consulting Services intern Gavin Kramer built Blacklight to show defenders exactly what's exposed and how to monitor it. Covering Claude Code, Codex, Cursor, and Gemini CLI. Check it out! https://ghst.ly/4g03vT8