Duane Michael

Director of Applied Security Research

Duane (@subat0mik) is Director of Applied Security Research at SpecterOps, specializing in adversary simulation operations and offensive security research. He has over 15 years of experience in information security, across both offense and defense. He has developed research, tooling, and training on various topics, and has presented his work at conferences around the world.

See the latest by Duane Michael

Research & Tradecraft

ConnectWise SkyKick Breach: How to Check Your Microsoft 365 Tenant

Last updated October 19, 2026 at 16:45 UTC An attacker used a compromised credential belonging to ConnectWise Cloud Backup (formerly…

By: Justin Kohler, Duane Michael

5 mins

Research & Tradecraft

Misconfiguration Manager: Still Overlooked, Still Overprivileged

TL;DR It has been one year since Misconfiguration Manager’s release and the security community has been hard at work researching…

By: Duane Michael, Garrett Foster

8 mins

Company Updates

Life at SpecterOps Part II: From Dream to Reality

TL;DR We are hiring consultants at various levels. The job posting can be found under the Consultant opening here: https://specterops.io/careers/#careers…

By: Duane Michael

9 mins

Company Updates

Life at SpecterOps: The Red Team Dream

TL;DR We are hiring consultants at various levels. The job posting can be found under the Consultant opening here: https://specterops.io/careers/#careers…

By: Duane Michael

9 mins

Research & Tradecraft

Misconfiguration Manager: Overlooked and Overprivileged

TL;DR: Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening…

By: Duane Michael

13 mins

Research & Tradecraft

The Phantom Credentials of SCCM: Why the NAA Won’t Die

TL;DR — Stop Using Network Access Accounts! If a Windows machine has ever been an SCCM client, there may be credential blobs…

By: Duane Michael

10 mins