Logan Goins

Just released a new @SpecterOps blog! I discovered that during client push in SCCM env's it's possible to remotely start WebClient and coerce HTTP from site servers for a relay to LDAP resulting in hierarchy takeover when WebClient is installed! 🫠 specterops.io/blog/2026/01/1…

Need to do an NTLM relay over C2 but local priv-esc isn't possible? @_logangoins new post walks through relaying NTLM auth out of a network and back in through red team infra to bypass traditional relay controls, plus how defenders actually stop it. specterops.io/blog/2026/07/1…

We used this technique on an op recently, and I wanted to create a simple resource on it due to it being seldom covered but very useful. It's a cool way to get around various NTLM relay constraints when operating over C2 from low-privilege. See it here: specterops.io/blog/2026/07/1…

Registration for training at #BHUSA 2026 is officially open, and we are bringing a full slate of adversary-focused courses to Las Vegas. 🎰 Early reg. pricing ends May 22, so now is the time to lock in your seat. 🧵 Links to each course ⤵️

@dez_ @_xpn_ @cryps1s @SpecterOps Yes! We have a library of other scenarios and testing ranges available as well. I'm happy to talk through what we offer whenever you'd like. Linking our 2-pager on that service below: specterops.io/wp-content/upl…

CopyFail (CVE-2026-31431) in Go. In case you want to get root from a static binary without Python as a dependency. github.com/badsectorlabs/…

Just added krb5 auth over ADWS in my tool SOAPy. I noticed since SOAPy released 2 yrs ago with the first ADWS python code nobody had implemented krb5 auth in python. Check it out here, and stay tuned for an upcoming blog post + big release 👀 github.com/logangoins/SOA…

Tired of fighting K8s for security research? Spin up K8s environments in @badsectorlabs' Ludus with: * Falco + Grafana/Loki detections * @SpecterOps' Mythic C2 callbacks * @grahamhelton3's nodes/proxy RCE demo * Common misconfigs out of the box github.com/heilancoos/lud…

gopacket is live! Check it out, it is intended to be a full reimplementation of Impacket in Go (it is in beta please send me bug reports) github.com/mandiant/gopac…

New Titanis release => github.com/trustedsec/Tit… The new Dsrep lets you dump secrets from AD, Ldap supports queries for DNS records and timestamp conversions, Dcom supports dotted-property notation, along with other enhancements and fixes.

A debate in the BloodHound Slack: can you attribute the originating host from an ADWS query? 🤨 Challenge accepted. Part 5B continues the ADWS blind spot: Event 5156 recovers the attacker’s real IP in ~60ms. 🕵️ Check out my latest post… huntress.com/blog/ldap-acti…

SCCM is everywhere, but realistic testing environments aren’t. In his latest blog post, @_Mayyhem expands on work by @synzack21 and @badsectorlabs with a Ludus-based SCCM lab for research and attack path testing. Read more ⬇️ ghst.ly/4bYltDo

I added an SCCM central admin site, child site, passive site server, secondary site, and remote system roles to @synzack21 and @badsectorlabs Ludus lab so you can skip the manual deployment. It's vuln to almost every technique in Misconfiguration Manager. specterops.io/blog/2026/04/0…

Bloodhound OpenGraph x.com/i/broadcasts/1…

Have you got SCCM in your environment? Want to catch adversaries attempting to abuse it for malicious purposes? Check out my newest blog to setup deceptions within existing SCCM infra specterops.io/blog/2026/02/1…

Every Entra ID assessment ends here: “How do I get a token without triggering Conditional Access controls?” 🤔 @rbnroot built CAPSlock, an offline ROADrecon-based Conditional Access engine that simulates sign-ins & flags gaps without touching the tenant. ghst.ly/4aKIk64

Introducing BloodHound Scentry: BloodHound Enterprise + SpecterOps experts working alongside your team to eliminate attack paths and accelerate APM. Level 0 → Level 3 maturity in ~6 months. Not theory. Tradecraft. 🎯 Learn more ➡️ ghst.ly/bhscentry-tw

I ended up quickly modifying ntlmrelayx to support these changes so that relays to LDAP are possible again, thanks y'all for your hard work on figuring this out! You can find the changes here: github.com/logangoins/imp…

🚨Introducing EventHorizon!🚨 A framework built to arm researchers with customizable ETW telemetry and sigma-like detection and response rules! It allows you to easily retrieve ETWTI telemetry, all with a simple msi installer and included wiki. github.com/HullaBrian/Eve…

SpecterOps has a really good line up for SO-CON'26. #agenda" target="_blank" rel="nofollow noopener">specterops.io/so-con/#agenda

Still running MDT? As of Jan 6, 2025, it’s unsupported and unpatched. In this post, @unsigned_sh0rt shows how attackers can locate MDT/WDS (even unauthenticated) and chain issues into credential risk. Defenses included. Read more ⤵️ ghst.ly/49UHoeW