Black Hat USA 2026 Learn. Connect. Engage.

In this session, attendees will learn how to design data models and build extensions for BloodHound OpenGraph.

After a presentation where I will go over the core concepts & components of BloodHound OpenGraph and the thought process behind BloodHound data modeling, attendees will design a model and build an extension from scratch based on a provided dataset.

If you like to tinker with BloodHound and are curious about the new OpenGraph features, this session is for you…

Note: Bring your own laptop with BloodHound Community Edition installed

For over a decade, offensive use of WMI has been largely confined to Win32_Process for remote execution and event subscriptions for persistence. Defenders and EDR vendors have optimized accordingly and the offensive community has moved on, treating WMI as a solved, well-monitored space.
This research demonstrates that WMI providers represent an entirely unexplored post-exploitation execution plane. We show how to remotely install custom WMI providers on target hosts by reimplementing the mofcomp.exe MOF compilation and installation process entirely over pure WMI parsing MOF files locally and pushing provider registration through the MS-WMIO binary protocol specification. No files are dropped via SMB. No WinRM. No agents. No implants. Every byte of data travels over DCOM/RPC as native WMI traffic.

We present novel techniques for uploading and downloading files over pure WMI using existing Windows classes methods that have not been previously documented or abused by threat actors. Combined with remote provider installation, this creates a fully distributed post-exploitation capability: remote .NET assembly execution, BOF execution, position-independent code execution, Kerberos ticket triaging, and remote process dumping that was tested against major EDR products with minimal alerts generated across multiple red team engagements. We will release an open-source toolkit including remote provider installation tooling, a library of post-exploitation providers, and an operator interface for interacting with deployed providers on remote hosts. Defenders will leave with concrete detection guidance for identifying WMI provider abuse because right now, most aren’t looking

What happens when the ecosystem Microsoft built for isolation and integrity of modern Windows applications becomes a foundation for novel attacker tradecraft?

For over 13 years, an ecosystem that includes MSIX, UWP, AppContainers, package identity, and the Windows Runtime has shipped by default on modern Windows. Yet offensive research into this ecosystem remains scarce, and visibility into its abuse lags further behind.

In this talk, we demonstrate novel techniques spanning all major parts of an attack path.

For initial access, we abuse URL protocol handlers and packaging file formats to subvert endpoint detections. For post-exploitation, we overcome AppContainer process isolation to operate beneath EDR visibility thresholds. For lateral movement, we expose previously unabused WMI providers and DCOM objects within package installation services. For privilege escalation, we chain a logic flaw in package capabilities to achieve SYSTEM from a standard user context.

Every technique requires no third-party software, works on fully patched systems, and abuses default-enabled features. We release tooling for red teams alongside detection guidance for defenders.

The modern app packaging ecosystem was designed for isolation and integrity. We used its design to our advantage and turned it into an attack platform.

Deploying a C2 server manually is a time consuming, sometimes annoying process. Deploying a C2 server weekly for two months, even more so. This Tactic will cover Gaia, the tool developed by the Midwest Collegiate Cyber Defense Competition Red Team to handle automated C2 deployment, user provisioning, payload creation, and more.

This Tactic will have attendees start with a standard Debian VM, and end with a fully provisioned Mythic server that can serve as the foundation for your next CTF, lab, or with a little extra work, your next op.

Join our BloodHound Quest at the Red Team Village during DEF CON 34 (August 7–8) and put your BloodHound knowledge to the test in a fast-paced digital scavenger hunt.

This isn’t your typical CTF. There are no exploits to write, shells to pop, or buffers to overflow. Instead, you’ll solve challenges by exploring, investigating, and thinking like an operator. Whether you’re a seasoned BloodHound user or just getting started with attack path analysis, there’s something here for you.

You’ll only have two hours.
Most players won’t finish. That’s by design.

There are more challenges than anyone can reasonably complete, so success isn’t just about what you know. It’s about how you prioritize, adapt, and make decisions under pressure. The leaderboard is live, the clock is ticking, and every point counts.

What you’ll need


Bring a laptop. A burner is perfectly fine, given the environment.

How to play

• Stop by the Red Team Village.
• Grab the event code.
• Head to begin.bloodhound.quest to sign up.
• Start hunting.

The loot


Besides a good time and bragging rights, the top-ranking players will win a SpecterOps training seat of their choice.

Our courses are hands-on, in-depth and built by the same Offensive Security experts who created BloodHound and continue to drive the research behind it, making this a prize well worth competing for.

Winners must be physically present at the Red Team Village to claim their prize.

Need help during the game? Join #BloodHound-Quest in the BloodHound Slack at community.specterops.io, or find a SpecterOps team member on-site.

Come play. Climb the leaderboard. See where you rank.