Introducing BloodHound 4.3 — Get Global Admin More Often

Part 5: Expanding the Operation Graph Welcome back to the On Detection: Tactical to Functional blog series. Previously we discussed operations and sequences of operations that I call operation paths. [...]

Part 4: Compound Functions Introduction Welcome back to the On Detection: Tactical to Functional series (links to all posts are at the bottom of the post). Thus far, we’ve explored [...]

Part 3: Expanding the Function Call Graph Introduction In the previous post in this series, I introduced the concept of operations and demonstrated how each operation has a function call graph [...]

Part 2: Operations Introduction Welcome back to my On Detection: Tactical to Functional series. In the first post in this series, we explored the source code for Mimikatz’s sekurlsa::logonPasswords command. [...]

Introducing BloodHound 4.2 — The Azure Refactor The BloodHound Enterprise team is proud to announce the release of BloodHound 4.2 — The Azure Refactor. The primary authors of BloodHound 4.2 are Dillon Lees (@ddlees), Rohan [...]

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on GitHub. TLDR: You may use this header file for reliable compile time [...]

Part 1: Discovering API Function Usage through Source Code Review Welcome to my new blog series, “On Detection: Tactical to Functional,” where I intend to explore and expand my understanding of [...]