Daniel Heinsen

BloodHound

Attack Path Management Comes to AWS

At SpecterOps, we have been hard at work modeling identity providers in our BloodHound Enterprise platform. Everything from Active Directory…

Research & Tradecraft

Entra Connect Attacker Tradecraft: Part 3

TL;DR Attackers can exploit Entra Connect sync accounts to hijack device userCertificate properties, enabling device impersonation and bypassing conditional access…

Research & Tradecraft

Update: Dumping Entra Connect Sync Credentials

TL;DR Microsoft has recently changed how Entra Connect Sync authenticates to Entra ID. This blog post will discuss what has…

Research & Tradecraft

Entra Connect Attacker Tradecraft: Part 2

Now that we know how to add credentials to an on-premises user, lets pose a question: “Given access to a…

Research & Tradecraft

Attacking Entra Metaverse: Part 1

This is part one in a two (maybe three…) part series regarding attacker tradecraft around the syncing mechanics between Active…

Industry Insights

An AWS Administrator Identity Crisis: Part 1

BLUF: Every attack path needs a destination. This is a formalized way of describing destinations in AWS. In cloud providers…

Industry Insights

I’d TAP That Pass

Summary: Given that: Temporary Access Passes (TAP) are enabled in the Azure AD tenant AND You have an authentication admin…

Research & Tradecraft

AWS ReadOnlyAccess: Not Even Once

Research & Tradecraft

Updates to Ghostwriter: UI and Operation Logs