Jim Sykora @ TROOPERS

Ope. Updated my profile to a custom domain. bsky.app/profile/jimsyc…

@DrAzureAD Enjoy all 3-6 days of it! :)

Finnish summer ❤️

@_xpn_ It's your brain trying to procrastinate the thing you actually need to do by inventing new side quests to chase. The trick is to have a task you must do that's even more procrastination-worthy, like a plumbing issue.

Why do all the interesting ideas pop into your brain when you have something else to focus on??!!!

@kfosaaen Here's the keyboard I was taking about that might be fun to add to this setup. keychron.com/products/keych…

I had several people asking about our presentation setup for the talk this week, so I figured I’d share it here. For the last few years, I’ve been using an iPad mini with a USB-C dock. I typically plug a USB presentation clicker into the dock, along with HDMI out.

#TROOPERS26 roundtable on Identity moderated by @ericonidentity, with @martinsohndk @al3x_n3ff @MGrafnetter @JsQForKnowledge @pssvdrctry @Thomas_Live in the group

🔐 #EntraOps × #BloodHound: Attack Path Analysis for #MicrosoftIntune and more! Presented at #TROOPERS26 with @martinsohndk on Tiered Administration in #MicrosoftEntra and Cloud-Managed PAWs. We released #BloodHound OpenGraph for #EntraOps to visualize attack paths. 👇 (1/2)

The famous Cookie Monster Agate Geode was discovered by gemologist Lucas Fassari in Brazil in 2020.

@_subTee My wife's favorite movie of all time.

@_xpn_ 40C in Germany this week too :( I mean, we get that in Minnesota too. In August...

I hope to see a few of you at @WEareTROOPERS this week! I'm in Heidelberg and excited about the entire identity track.

@MGrafnetter @WEareTROOPERS I'm grateful that I will be able to see this in person!

Putting the final touches on my @WEareTROOPERS slide deck for next week. For the first time, I’ll be demoing the decryption of BitLocker drives, DNSSEC keys, and ASP.NET Core secrets using KDS root keys, plus hybrid Golden [gd]MSA attacks. troopers.de/troopers26/tal…

Releasing Tunnel Vision Toolkit, part of my @x33fcon talk on Microsoft Global Secure Access. Includes BOFs to assist in engagements where you face GSA, plus a rogue client that lets you connect to internal resources from unmanaged devices. github.com/ar0x4/tunnel-v…

ICYMI: @0xr0BIT joined #KnowYourAdversary for a discussion on how scheduled tasks store creds, why they frequently appear during security assessments, & how TaskHound helps operators & defenders visualize these relationships directly within BloodHound. 👀 ghst.ly/4x4qGmU

This post was published as part of the @SpecterOps "GhostWorks" initiative.. exciting times, can't wait to show what we've been doing \o/ #h-a-tradecraft-approach-to-ai-nbsp" target="_blank" rel="nofollow noopener">specterops.io/blog/2026/06/0…

U2U powers UnPAC-the-Hash and chains into Shadow Credentials and ADCS ESC attacks, but most resources skip the “how.” @GrayHatKiller breaks down Kerberos U2U auth from the RFC to Windows’ divergences—and why modern attacks rely on it. ghst.ly/4egy4TT

Regarding Active Directory permissions, most people assume that a Deny ACE always wins. It doesn't! Windows stops the access check the moment enough rights are granted — any ACE after that point is never evaluated. New post: managedpriv.com/blog/acl-canon…

@curi0usJack Been having good results so far using OpenSpec with the grill-me skill for SDD.

Have spent all day working on SPEC.md (spec driven development). This has been a rather slow and tedious exercise, but admittedly I'm a fan of being forced to truly think through everything before entering the dev -> prompt change cycle. It really helped to have Claude look at my spec and fill in missing gaps for review/changes.

The .NET ActiveDirectorySecurity API was built for helpdesk scripts, not ACL fidelity. If you're using it for backup, migration, or exact cloning — you're going to have a bad time. New post: the 9 design problems you need to know. bit.ly/3Rl635L

Found a Tailscale API key on an assessment? In their latest research, @KingOfTheNOPs & @Sw4mp_f0x created TailscaleHound to turn your Tailnet into a BloodHound graph to visualize access paths between Azure & Tailscale. Check it out ⤵️ ghst.ly/4nJkgFF

shipping: WinSSHound maps SSH access in AD as BloodHound paths. because Windows OpenSSH cheerfully ignores your "Deny Logon" GPOs (pre-2025) and on a default sshd_config every Authenticated User in the domain can walk right in. Why? Because Microsoft. github.com/1r0BIT/WinSSHo…