SpecterOps

Looking for more opportunities to sharpen your skills at #BHUSA? Join us at the Kennel Club for hands-on workshops covering AI, red teaming for AWS, and building your own OpenGraph collector. Learn more & sign up 👉 specterops.io/black-hat/

Passkeys are slowly becoming the norm, but are real-world implementations as secure as orgs assume? At #BHUSA, @MGrafnetter will unveil new research into attacks fundamentally similar to Pass-the-Hash and NTLM Relay. Learn more ➡️ ghst.ly/44oQ2Pm

What happens when network exposure data meets attack path analysis? @runZeroInc CEO @hdmoore joined #KnowYourAdversary to discuss RunZeroHound, BloodHound OpenGraph, & how defenders can uncover attack paths that traditional vuln management misses. ghst.ly/4g9XtkB

This week's #BloodHoundBasics post comes courtesy of @_wald0 🙌 BloodHound has been free and open source software for nearly 10 years! Our latest version, BloodHound CE v9.4.0, is free and open source under the Apache 2.0 license: ghst.ly/3SR9CRS

Quick 'n dirty BloodHound ecosystem overview. The different ingestors, collectors, analysis tools. There might be things missing. gist.github.com/gitgotgitgotit…

Just a few weeks until #BHUSA. If you've been thinking about sharpening your detection strategy, now's the time. Join our Tradecraft Analysis training to learn how Windows attack techniques work under the hood and build stronger detection coverage. 👉 ghst.ly/43eLw5s

Proxied execution leaves almost nothing on disk. No new process, no dropped tool, just a socket doing its job. @brian_psu & John Wotton break down why that's hard to detect, and introduce Proxywatch, our behavior-based approach to catching it. ghst.ly/44feQcF

@Ox4d5a We can't speak to how BloodHound is packaged or run in Kali, but if you're looking for the recommended way to get started with BloodHound Community Edition, our quickstart guide should help. bloodhound.specterops.io/get-started/qu…

yo we need simplified version of bloodhound setup man. this setting up bloodhound is pain in the ass

LLM security and jailbreak testing gets messy fast. I built Jailbreaker to make it easier to run and track jailbreak, prompt injection, and agent behavior tests. Blog - specterops.io/blog/2026/06/2… Github - github.com/SpecterOps/Jai… Would love to hear what you think. @SpecterOps

How do you make sense of a Kubernetes environment that's constantly changing? Hector Riestra explores how Codex helped shape a reusable framework for reasoning about AKS identity, trust relationships, and attack surface. Read more ⤵️ ghst.ly/4h1DWTF

#BHUSA is creeping up on us! Don't forget to register for our bowling party, happening Wed., Aug 5. at @BBowlVegas 🎳 Join our team for bowling, food, drinks, & good company. No presentations. No pitches. Just a fun night with the security community. 🎟️: ghst.ly/4xUHGMN

Frontier AI agents are tackling increasingly complex offensive tasks. Are today's benchmarks keeping up? Hear from Philippos Maximos Giavridis (@AISecurityInst) & @v3r5ace on realistic cyber range evals at the Kennel Club during #BHUSA. ➡️ ghst.ly/4vlZa2e

Most red team scope gets written the same way: "find what you can." @Ne0nd0g breaks down why that approach leaves the most important questions unanswered and what to do instead. Check it out! ⬇️ specterops.io/blog/2026/07/0…

Wishing everyone a safe and happy #FourthofJuly! 🇺🇸 Whether you're spending the day with family, friends, or simply enjoying some well-earned downtime, we hope you have a wonderful #IndependenceDay.

These aren't necessarily attack paths on their own but present opportunities that become part of an attack path. Attack paths show how attackers reach their objective. Hygiene findings help eliminate the conditions that make those attack paths possible. 🧵: 3/3

Hygiene findings surface conditions that attackers routinely take advantage of, such as: ➡️ Large default groups with delegated privileges that make lateral movement much easier ➡️ AS-REP roastable accounts ➡️ Kerberoastable accounts. 🧵: 2/3

We're back w/ another #BloodHoundBasics from Jacob Jackson! ⤵️ One of my favorite parts of BloodHound Enterprise is the Hygiene findings. Not every security issue shows up as an attack path but that doesn't make it any less important. 🧵: 1/3

ICYMI: @hdmoore joined #KnowYourAdversary to discuss why defenders need to think beyond vulnerabilities. From RunZeroHound & BloodHound OpenGraph to OT security, hidden exposure, & AI, this episode explores the relationships attackers exploit. 👀: ghst.ly/4g9XtkB

To defend Azure & Entra ID, you first need to understand how attackers see them. Join our Azure training at #BHUSA & learn the misconfigs adversaries look for through hands-on labs built around real-world attack paths. ➡️ ghst.ly/4y15ZZv

Detection gets easier when you understand the tradecraft behind the techniques. Join our Tradecraft Analysis course at #BHUSA to connect attacker behavior with the telemetry and detection opportunities that matter. Save your spot ➡️ ghst.ly/43eLw5s

What happens when network exposure data meets attack path analysis? @hdmoore joins #KnowYourAdversary to discuss RunZeroHound, BloodHound OpenGraph, and how defenders can uncover attack paths that traditional vulnerability management misses. ➡️ ghst.ly/4g9XtkB