doin thangs @specterops

San Diego, CA
Joined March 2020
Pasting API keys in an LLM makes me feel kinda gross, so I created agentcordon. It's an agentic key vault that's: ✅Agent agnostic ✅Cedar policies for clear authorization ✅Fully auditable ✅Remote MCP Support
1
8
25
2,223
Quick preview of my Blackhat talk ;)
7
28
2
204
11,247
Daniel Heinsen retweeted
Watching fellow Specter @0xthirteen talk about WMI Post-Ex capabilities!
2
6
69
5,097
Daniel Heinsen retweeted
HEY EVERYONE. THE BLOG POST IS OUT. I put an LLM in an AMSI provider and some cool stuff came out. Really excited to finally have this released.
"Offense and defense aren't peers. Defense is offense's child." - @JohnLaTwC We built an LLM-powered AMSI provider and paired it against a red team agent. Then, @0xdab0 wrote a blog about it: dreadnode.io/blog/llm-powere… A few observations from the experiment: >>> To advance, we must generate unique, ground-truth datasets. >>> Defenses will need to live at the edge. >>> The real potential lies in the interaction between red and blue. >>> This is a blueprint for generative adversarial reinforcement learning.
4
16
73
12,201
Daniel Heinsen retweeted
See you all next week...excited to present with @breakfix at #BHEU! 💣
SCOM monitors critical systems, but insecure defaults make it a powerful attack vector. At #BHEU, @unsigned_sh0rt & @breakfix show how to abuse SCOM for credential theft, lateral movement, and domain escalation, plus how to defend it. ghst.ly/4aoggph
3
40
131
19,372
Daniel Heinsen retweeted
The Azure AD Broker plays a key role in Entra ID sign-in & token handling, but how well do we really understand it? @winternl_t unpacks its on-disk cache, how to decode it, & the security implications. 🔐 ghst.ly/4oTR4v5
1
34
1
102
10,047
Daniel Heinsen retweeted
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ⤵️ ghst.ly/4qtl2rm
11
334
20
728
137,820
Daniel Heinsen retweeted
I feel like @YuG0rd's briefly mentioned new dMSA account takeover mechanism in his last blog didn't get enough attention. A new account takeover mechanism is on the horizon. I wrote a blog detailing it, releasing with a new BOF I wrote called BadTakeover specterops.io/blog/2025/10/2…
3
43
2
105
18,218
Daniel Heinsen retweeted
WSFC misconfigurations can turn your domain into one big fustercluck. I'm sharing fustercluck today as part of my #BHUSA presentation. The README summarizes the issues and a detailed blog is coming soon. github.com/garrettfoster13/f…
3
50
114
9,649
Daniel Heinsen retweeted
MSSQLHound leverages BloodHound's OpenGraph to visualize MSSQL attack paths with 7 new nodes & 37 new edges, all without touching the SharpHound & BloodHound codebases. @_Mayyhem unpacks this new feature in his blog post. 👇 ghst.ly/4leRFFn
2
52
2
133
16,327
The best creds are the ones you simply ask for =) specterops.io/blog/2025/07/3…
13
31
2,759
This post goes more into Entra Connect tradecraft and how partially synced objects can be hijacked for cross domain attacks. posts.specterops.io/entra-co…
3
17
55
4,608
Daniel Heinsen retweeted
Want to run roadrecon, but a device compliance policy is getting in your way? You can use the Intune Company Portal client ID, which is a hardcoded and undocumented exclusion in CA for device compliance. It has user_impersonation rights on the AAD Graph 😃
6
119
4
347
36,207
A new fun way to set shadow credentials posts.specterops.io/attackin…
49
115
10,357
Daniel Heinsen retweeted
Want to move laterally from C2 on an Intune admin's workstation to any Intune-enrolled device? Check out Maestro (github.com/Mayyhem/Maestro), a new(ish) tool I wrote for those situations, and this blog post to walk you through how: posts.specterops.io/maestro-…
6
130
298
22,249
my workshop tomorrow in a nutshell
1
4
911