
Pinned Tweet
Pasting API keys in an LLM makes me feel kinda gross, so I created agentcordon. It's an agentic key vault that's:
✅Agent agnostic
✅Cedar policies for clear authorization
✅Fully auditable
✅Remote MCP Support
Daniel Heinsen retweeted
Today I'm dropping how myself and @Haus3c got admin credentials to every Dataverse/Copilot Studio sandbox in the world!
beyondtrust.com/blog/entry/c…
Come see the talk at 3:30pm mainstage Track 4 tomorrow.
Daniel Heinsen retweeted
Watching fellow Specter @0xthirteen talk about WMI Post-Ex capabilities!
Daniel Heinsen retweeted
HEY EVERYONE. THE BLOG POST IS OUT.
I put an LLM in an AMSI provider and some cool stuff came out. Really excited to finally have this released.
"Offense and defense aren't peers. Defense is offense's child." - @JohnLaTwC
We built an LLM-powered AMSI provider and paired it against a red team agent. Then, @0xdab0 wrote a blog about it: dreadnode.io/blog/llm-powere…
A few observations from the experiment:
>>> To advance, we must generate unique, ground-truth datasets.
>>> Defenses will need to live at the edge.
>>> The real potential lies in the interaction between red and blue.
>>> This is a blueprint for generative adversarial reinforcement learning.
Daniel Heinsen retweeted
SCOM monitors critical systems, but insecure defaults make it a powerful attack vector.
At #BHEU, @unsigned_sh0rt & @breakfix show how to abuse SCOM for credential theft, lateral movement, and domain escalation, plus how to defend it. ghst.ly/4aoggph
Daniel Heinsen retweeted
The Azure AD Broker plays a key role in Entra ID sign-in & token handling, but how well do we really understand it?
@winternl_t unpacks its on-disk cache, how to decode it, & the security implications. 🔐 ghst.ly/4oTR4v5
Daniel Heinsen retweeted
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ ghst.ly/4qtl2rm
Daniel Heinsen retweeted
I feel like @YuG0rd's briefly mentioned new dMSA account takeover mechanism in his last blog didn't get enough attention. A new account takeover mechanism is on the horizon. I wrote a blog detailing it, releasing with a new BOF I wrote called BadTakeover
specterops.io/blog/2025/10/2…
Daniel Heinsen retweeted
WSFC misconfigurations can turn your domain into one big fustercluck. I'm sharing fustercluck today as part of my #BHUSA presentation. The README summarizes the issues and a detailed blog is coming soon. github.com/garrettfoster13/f…
Daniel Heinsen retweeted
MSSQLHound leverages BloodHound's OpenGraph to visualize MSSQL attack paths with 7 new nodes & 37 new edges, all without touching the SharpHound & BloodHound codebases.
@_Mayyhem unpacks this new feature in his blog post. 👇 ghst.ly/4leRFFn
The best creds are the ones you simply ask for =)
specterops.io/blog/2025/07/3…
This post goes more into Entra Connect tradecraft and how partially synced objects can be hijacked for cross domain attacks.
posts.specterops.io/entra-co…
Daniel Heinsen retweeted
Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃
i'm on the internet this week. head over to advent.cloudsecuritypodcast.… to hear me talk about tokens and conditional access
A new fun way to set shadow credentials
posts.specterops.io/attackin…
Daniel Heinsen retweeted
Want to move laterally from C2 on an Intune admin's workstation to any Intune-enrolled device? Check out Maestro (github.com/Mayyhem/Maestro), a new(ish) tool I wrote for those situations, and this blog post to walk you through how: posts.specterops.io/maestro-…















