BloodHound

DEF CON 20 - Marlinspike Hulton and Ray - Defeating PPTP VPNs and WPA2 Enterprise with MS-CHAPv2

The Renaissance of NTLM Relay Attacks: Everything You Need to Know

| | Active Directory, BloodHound, ntlm relay, Red Team, research
NTLM relay attacks have been around for a long time. While many security practitioners think NTLM relay is a solved problem, or at least a not-so-severe one, it is, in fact, alive ...
Posts By SpecterOps Team Members - Medium
Defining the Undefined: What is Tier Zero

Getting Started with BHE — Part 2

| | Active Directory, attack-path-management, BloodHound, bloodhound-enterprise
Getting Started with BHE — Part 2Contextualizing Tier ZeroTL;DRAn accurately defined Tier Zero provides an accurate depiction of Attack Path Findings in your BHE tenant.Different principals (groups, GPOs, OUs, etc.) have different implications when Tier Zero is ...
Posts By SpecterOps Team Members - Medium
Getting Started with BHE — Part 1

Getting Started with BHE — Part 1

| | Active Directory, attack-path-management, BloodHound, bloodhound-enterprise
Getting Started with BHE — Part 1Understanding Collection, Permissions, and Visibility of Your EnvironmentTL;DRAttack Path visibility is dependent upon scope of collection; complete collection is dependent upon appropriate permissions.Your collection strategy benefits from tiering just ...
Posts By SpecterOps Team Members - Medium
Unwrapping BloodHound v6.3 with Impact Analysis

Unwrapping BloodHound v6.3 with Impact Analysis

| | Active Directory, attack-path-management, azure, BloodHound, identity security
Just in time for the holidays, sharper tools for faster defenseToday, the SpecterOps team rolled out a number of new features, product enhancements, and recommendations intended to help users of BloodHound Enterprise and ...
Posts By SpecterOps Team Members - Medium
ADCS Attack Paths in BloodHound — Part 3

ADCS Attack Paths in BloodHound — Part 3

| | Active Directory, ADC, BloodHound, Cybersecurity, research
ADCS Attack Paths in BloodHound — Part 3In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services (ADCS) objects into BloodHound and demonstrated how to effectively use BloodHound to identify ...
Posts By SpecterOps Team Members - Medium
Hybrid Attack Paths, New Views and your favorite dog learns an old trick

Hybrid Attack Paths, New Views and your favorite dog learns an old trick

| | Active Directory, attack-path-management, azure, BloodHound, bloodhound-enterprise
Introducing Hybrid Attack PathsDeath from Above: An Attack Path from Azure to Active Directory With BloodHoundWhen we introduced Azure Attack Paths into BloodHound, they were added as a completely separate sub-graph. At no ...
Posts By SpecterOps Team Members - Medium
ADCS Attack Paths in BloodHound — Part 2

ADCS Attack Paths in BloodHound — Part 2

| | Active Directory, ADC, BloodHound, Cybersecurity, research
ADCS Attack Paths in BloodHound — Part 2In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services (ADCS) objects into BloodHound and demonstrated how to effectively use BloodHound to identify ...
Posts By SpecterOps Team Members - Medium
Pwned by the Mail Carrier

Pwned by the Mail Carrier

| | Active Directory, BloodHound, Microsoft Exchange, research, security-boundaries
How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that.At SpecterOps, we recommend our customers establish a security boundary around their most critical assets (i.e., Tier Zero) of ...
Posts By SpecterOps Team Members - Medium
Final Steps to BloodHound Federal — FedRAMP High Compliance

Final Steps to BloodHound Federal — FedRAMP High Compliance

| | Active Directory, attack-path-management, azure, BloodHound, bloodhound-enterprise
Final Steps to BloodHound Federal — FedRAMP High ComplianceEver since SpecterOps first launched BloodHound Enterprise (BHE) in July 2021, one of our team’s biggest frustrations involved a lack of FedRAMP qualifications, which prevented us ...
Posts By SpecterOps Team Members - Medium
The Most Dangerous Entra Role You’ve (Probably) Never Heard Of

The Most Dangerous Entra Role You’ve (Probably) Never Heard Of

| | azure, BloodHound, bloodhound-enterprise, cloud computing, Cybersecurity
Entra ID has a built-in role called “Partner Tier2 Support” that enables escalation to Global Admin, but this role is hidden from view in the Azure portal GUI.Why it mattersAn adversary may target the ...
Posts By SpecterOps Team Members - Medium
Load more