Chihuahua in charge NotMe retweeted
Happy #BloodHoundBasics courtesy of Jacob Jackson!
New in BloodHound Enterprise: Findings Prioritization (Early Access).
Go beyond severity ratings with risk-based rankings to focus remediation where it matters most. ghst.ly/4yLaBlK
Chihuahua in charge NotMe retweeted
Results are in... Congrats to @stuk0v_ winner of our OpenGraph Halloween Art Competition! 🎃
Check out Mat’s winning design below & join us in giving him a round of applause.
Thanks to everyone who submitted a design & brought some Halloween spirit to the BloodHound community!
Chihuahua in charge NotMe retweeted
Bypassing SMB signing enforcement🔥
@aas_s3curity found a re-authentication bug in SMB. This allows you to simply relay an authentication to a host (e.g., a DC) even if signing is enforced! His NetExec module to test if a host is still vulnerable is now merged into main🚀
1/3🧵
Chihuahua in charge NotMe retweeted
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Chihuahua in charge NotMe retweeted
Crazy cool blog I saw on linkedin about an SMB signing bypass technique
TLDR: SMB re-auth reuses the original signing key and never checks the new identity matches the old. So you sign a session as a low-priv account you control, re-auth it with a relayed privileged login, and get a privileged session still signed with your original low-priv key, which btw is accepted even where signing is required, with DCs included.
blackfield.ch/blog/defeating…
Chihuahua in charge NotMe retweeted
New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇
ghst.ly/3VSdm7h
1/2
LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced.
Patched in October.
Blog: specterops.io/blog/2026/10/2…
PoC: github.com/grayhatkiller/swi…
Chihuahua in charge NotMe retweeted
Putting a flag.txt in my root directory containing a prompt injection that congratulates the agent for passing the eval and then instructs it to patch whatever entry method it used and disconnect from the server
Chihuahua in charge NotMe retweeted
I made a short video that explains Entra app permissions and the part they played in the ConnectWise incident: how one app credential reached 173+ Microsoft 365 tenants with no password or MFA, and what to check today.
youtube.com/watch?v=Q36aL_HI…
Chihuahua in charge NotMe retweeted
Read the SpecterOps blog for remediation steps and updates: ghst.ly/4yULY73
4/4
Chihuahua in charge NotMe retweeted
Every app with consent in your tenant is a potential attack path. AzureHound, our open-source collector, maps Entra ID apps and their permissions: ghst.ly/4efrqhg
3/4
Chihuahua in charge NotMe retweeted
What to check:
• Service principal sign-ins from app ID 506e08f9-6e9a-4da4-942b-a099a03644ae
• Activity from 144.172.64[.]128
Not using SkyKick or ConnectWise Cloud Backup? Revoke its app consents in your tenant.
2/4
Chihuahua in charge NotMe retweeted
PSA for Microsoft 365 admins: Huntress has reported a widespread security incident involving ConnectWise Cloud Backup (formerly SkyKick). A threat actor used a vendor credential to sign in as the SkyKick app and reach customer M365 tenants.
🧵1/4
If you're into adversary simulation, identity security or red/blue tradecraft, bookmark this.
The team at @SpecterOps has built one of the best FREE security research archives online.
The rabbit hole covers:
- Active Directory + Kerberos
- Entra ID + Azure
- Okta + identity providers
- BloodHound + attack paths
- SCCM / Configuration Manager
- Red team tradecraft
- Detection engineering
- Lateral movement
- Credential access
- OAuth + token security
- Browser persistence
- AWS + cloud attack paths
- Kubernetes security
- Software supply chain attacks
- Adversary simulation
- Purple teaming
- Threat hunting
- AI-assisted offensive security
There is a ridiculous amount of deep technical material here, including research developed from real offensive and defensive operations.
They also now have FREE on-demand Tradecraft Academy courses covering BloodHound, Kubernetes for Red Teamers and software supply chain security.
Blog:
specterops.io/blog/
Free Tradecraft Academy:
academy.specterops.io/
Huge credit to the @SpecterOps team for publishing so much of this openly.
#RedTeam #ActiveDirectory #Infosec
Chihuahua in charge NotMe retweeted
A validly signed pythonw.exe we caught ran with zero arguments: its payload sat in a path configuration file Python reads at startup, invisible to any command-line rule. Least privilege stopped ScreenConnect it carried.
activesoc.blackhillsinfosec.…
Chihuahua in charge NotMe retweeted
📄 Skills in Agent Harnesses
A lot of people don't know this (I didn't until recently) but most agent harnesses will load the description of your skill upon starting up your harness. This is how Claude Code works.
What people don't usually know is that even when you explicitly call a skill to be used inside of a harness, or the AI figures out to use a skill, it usually only does a read of the first 150 lines of the skill (to understand how to use it or if it applies to the work it's trying to do).
It's really important to outline a table in the first 150 lines of the mandatory parts of the skill that must be run when you invoke the skill.
If you make some type of mandatory instruction after 150 lines, it might get missed entirely. If you describe in prompting that you want to use a provided Python script or template, it also might be out of bounds of that 150 lines and never get called correctly.
If you write a table of contents of the skill actions in the first 150 lines and mark which ones are mandatory (or that, if the user has called the skill, you must read the whole skill context and all references), you get more reliable skills. We use markdown checklists for this now.
Chihuahua in charge NotMe retweeted
Uncensored AI for Offensive Security is still free in the WKL Student Portal!
Deploy your own LLM and run it across AMSI bypasses, Defender evasion, OSINT parsing, and phishing artifacts while keeping your data local.
Learn more: bit.ly/4aV3wWW
🚨 Fresh Living off the Land Weekly is out
Forty-five merged pull requests from 12 contributors landed across LOLDrivers, HijackLibs, LOOBins, and LOLRMM. The work expanded driver and DLL sideloading research, documented macOS utilities, strengthened remote-management artifacts and detections, and improved public catalogs and their publishing workflows.
Thank you, contributors!
magicsword.io/changelog/lotl
magicsword.io/changelog/lotl…
Chihuahua in charge NotMe retweeted
Need to disable any EDR in post exploitation? Here is a simple tutorial showing how to do that using BallisKit EDR Eclipse!
EDR Eclipse is also compatible with ShellcodePack and MacroPack formats as well as all major C2s!
blog.balliskit.com/tutorial-…
#redteam
Chihuahua in charge NotMe retweeted
“They don't have guardrails.”
@jaredcatkinson & @JustinKohler10 are joined by @Icemoonhsv & @elad_shamir for the latest #KnowYourAdversary. In this ep. the group explores unpredictable agents and the security challenges they pose.
👉 ghst.ly/4gS0KFc






















