See the latest by Matt Creel
An Operator’s Guide to Device-Joined Hosts and the PRT Cookie
About five years ago, Lee Chagolla-Christensen shared a blog detailing the research and development process behind...
By: matt creel
Apr 7, 2025 • 15 min read
Read Post
TL;DR: BOFHound can now parse Active Directory Certificate Services (AD CS) objects, manually queried from LDAP,...
By: matt creel
Oct 30, 2024 • 14 min read
Read Post
Background If you’ve found yourself on a red team assessment without SharpHound (maybe due to OPSEC...
By: matt creel
Jan 30, 2024 • 13 min read
Read Post
Abusing Slack for Offensive Operations: Part 2
When I first started diving into offensive Slack access, one of the best public resources I...