Adversary Simulation X-Force Red, developer of tools, connoisseur of dogs
Joined July 2019
- Tweets248
- Following431
- Followers1.2K
- Likes566
Pinned Tweet
CredMaster 2.0 passspray tool release! New features like notification alerts, advanced SOC evasion techniques, 8 new plugins and an easy config file. S/O to @ZephrFish for all his contributions in the rewrite
B: whynotsecurity.com/blog/cred…
G: github.com/knavesec/CredMast…
Ellis Springe retweeted
Thank you to @UnpromptedAU & @BSidesCbr for inviting me to speak. Being back down under was lovely! You can find the slides for my n-day automated pipeline talk here. I’m at OAIC this week if you want to chat about exploit dev in 2026 and beyond. beautiful.ai/player/-P2q0r-B…
Ellis Springe retweeted
Boom! @chompie1337 wastes no time kicking off #Pwn2Own Berlin in style. She requires just a few second to get code execution on the NV Container Toolkit. She heads off to the disclosure room to provide all the details.
Ellis Springe retweeted
SCOM monitors critical systems, but insecure defaults make it a powerful attack vector.
At #BHEU, @unsigned_sh0rt & @breakfix show how to abuse SCOM for credential theft, lateral movement, and domain escalation, plus how to defend it. ghst.ly/4aoggph
Come join the team! Long-term operations with some of the best in the world with guaranteed development time. This kind of opportunity doesn't come around often 😀
If you're into serious red teaming with a crazy skilled team we've got a US based opening! ibmglobal.avature.net/en_US/…
Ellis Springe retweeted
Ending an insane 6 weeks with a celebration. I’m deeply honored to receive the Trailblazer Award from the Society of Women Engineers. Thank you @SWEtalk! Grateful to my mgmt, team, husband, family, and friends. Their support has made every one of my accomplishments possible.
ALT chompie at SWE awards
ALT chompie with SWE president holding trailblazer award
ALT chompie and husband at SWE award red carpet
Ellis Springe retweeted
Ever been on an SCCM site server and *this* close to a DA pw that you couldn't decrypt for some reason? Check out my new blog looking at encryption in use within SCCM sites configured for High Availability and accompanying tooling to recover passwords: ibm.com/think/x-force/decryp…
Ellis Springe retweeted
What happens when the User-Account-Restrictions property gets misconfigured?
Spoiler: It's not good. From account compromise to full domain takeover, @unsigned_sh0rt breaks down why this permission set is more dangerous than most realize. ghst.ly/4mKgycH
Judging the @sec_defcon vishing competition on Friday, moving to London on Tuesday. Hell of a week
So much fun judging with @_sn0ww and @_nextjenn, great calls and a tight race all the way to the end! Hats off to all the contestants, it’s make those calls in front of a huge crowd (@JC_SoCal is ok too I guess)
Ellis Springe retweeted
Search 15M+ Microsoft 365 tenants by org name or domain and discover all known domains in the same tenant: micahvandeusen.com/tools/ten…. Legacy methods like Autodiscover/GetFederationInfo no longer work (mc.merill.net/message/MC1081…).
Ellis Springe retweeted
More on BH OpenGraph: Ran into some issues when attempting to map objects collected with partial info back to existing BH objects. Built out a small tool that allows for connecting objects in a more flexible manner: github.com/G0ldenGunSec/Open…
Ellis Springe retweeted
Azure Arc is Microsoft's solution for managing on-premises systems in hybrid environments. My new blog covers how it can it be identified in an enterprise and misconfigurations that could allow it to be used for out-of-band execution and persistence. ibm.com/think/x-force/identi…
Ellis Springe retweeted
Last week we added ELEVATE-4 github.com/subat0mik/Misconf… to Misconfiguration Manager.
tl;dr If SCCM uses AD CS for PKI, client auth certs are "borrowed" by clients during OSD. This will typically be a distribution point but could be the site server in all-in-one deployments...
Ellis Springe retweeted
New research just dropped I'll be presenting at @WEareTROOPERS next week - Attacking ML Training Infrastructure
💥 Model poisoning for code execution
⚠️ Abusing ML workflows
⚙️ MLOKit updates and new threat hunting rules
ibm.com/think/x-force/becomi…
Ellis Springe retweeted
Me and the homies are dropping browser exploits on the red team engagement 😎. Find out how to bypass WDAC + execute native shellcode using this one weird trick -- exploiting the V8 engine of a vulnerable trusted application.
ibm.com/think/x-force/operat…
Ellis Springe retweeted
The deadline is approaching fast for the first wave of OAIC tickets: May 16. Purchase your ticket by THIS Friday to secure your spot! Check your inbox for details.
Next round of invitations coming soon. Request an invite: offensiveaicon.com/#request-…
Ellis Springe retweeted
I am thrilled to be presenting new research on attacking ML training infrastructure at @WEareTROOPERS this summer. Stay tuned for a blog post and lots of updates to MLOKit closer to the conference!
Ellis Springe retweeted
New blog from me about a bug in Power Apps that allows execution of arbitrary SQL queries on hosts connected through on-prem data gateways. This can turn external O365 access into compromised on-prem SQL servers. ibm.com/think/x-force/abusin…
