Creators of BloodHound | Experts in Adversary Tradecraft | Leaders in Identity Attack Path Management
Joined January 2017
- Tweets4.2K
- Following403
- Followers42.4K
- Likes2.3K
Pinned Tweet
The #SOCON2027 Call for Presentations is open! 🙌
Discovered, built, broken, or defended something in identity security or Attack Paths? We want to hear about it.
Submit a 25- or 50-minute session proposal by November 13: ghst.ly/4scIMRS
An attack path can span GitHub and AWS.
@hotnops and @n0pe_sled recently joined #KnowYourAdversary to explore third party trust and paths to critical resources.
ghst.ly/4zvoVQ1
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.
🧵1/4
BloodHound users may run the below queries to identify potential impact to their environs.
Identify outbound control of ConnectWise app:
MATCH p=(sp:AZServicePrincipal)-[r]->(target)
WHERE toLower(sp.appownerorganizationid) = ‘3f9cd7a0-127a-4ed4-bf06-2f830d5616b7’
RETURN p
This week's #BloodHoundBasics courtesy of Carlo Alcantara: Table View! Because sometimes defenders think in lists. The new table view accompanies the Graph View on the Attack Paths page in BloodHound Enterprise. (1/3)
Certain fields (Platform, Attack Paths, Environment) can be searched to filter the view to specific findings. (2/3)
SpecterOps retweeted
I will be @BSidesNYC tomorrow at the @SpecterOps booth!
Come talk to us and if you are wearing a #SpecterOps or #BloodHound t-shirt, I might have something special for you (very limited).
See you tomorrow! :)
“We have to assume that it will take us some time to patch.”
Sahan Fernando, CISO at @radychildrens, discusses balancing security remediation with patient care in the latest episode of #KnowYourAdversary.
👀: ghst.ly/4zvoVQ1
One more day to haunt a graph. 👻
Our OpenGraph Halloween Art Competition closes TOMORROW, Oct 16. Pumpkins, skeletons, or something completely cursed. No masterpiece required.
Email [email protected]
Subject: OpenGraph Halloween Art Competition
Intentional AI use means setting the direction, choosing models for the task and verifying results.
@cmaddalena put it to work on Ghostwriter’s 99-screen UI overhaul for $815.50 in model spend.
You’re still the architect. Read more ⤵️ ghst.ly/4yoTCph
Your graph could use a few ghosts. 👻
Our OpenGraph Halloween Art Competition closes Friday, Oct 16. Get weird with it for a chance to win our swag, including a desk mat.
📧 [email protected]
Subject: OpenGraph Halloween Art Competition
How do AWS permissions combine into attack paths?
@hotnops and @n0pe_sled discuss mapping relationships across accounts on #KnowYourAdversary.
👀: ghst.ly/4gS0KFc
We’re back with another SO:Brief, this time exploring AWSHound.
@ScoubiMtl & @n0pe_sled explore how individual AWS permissions can connect into attack paths and how AWSHound brings those relationships into BloodHound.
Happy #BloodHoundBasics from @martinsohndk! 🙌
In RBAC you grant permissions to groups - not individuals. A must-have design in AD.
You can easily audit RBAC violations with the BloodHound query 'Principals With Direct Rights Assignment': ghst.ly/4hDNp3N
