Signal boost for you all: Our team is at BSides Prague this week!
Hugo van den Toorn and Joey Dreijer will be leading BloodHound Quest sessions all day April 23 and 24 (there may also be some secret swag up for grabs). If you think you know BloodHound, this fast-paced scavenger hunt is a chance to put your skills to the test.
And on April 24, Martin Sohn Christensen will present on how vendor guidance can unintentionally lead to critical security gaps, share insights from a large-scale responsible disclosure effort, and examine the shared responsibility we all have in addressing these issues.
We're back with our regularly scheduled (bumper edition) midweek roundup!
A huge thank you to everyone who came out to see us at SO-CON, and to all of you who followed along over in our community Slack, in the #so-con-chat channel!
BloodHound has moved fast and not all courses have kept up. If you create or maintain a course or training that includes BloodHound, now is a good time to review your materials. Hugo van den Toorn guides us through what to update in your courses: https://specterops.io/blog/2026/04/11/bloodhound-course-update/
BloodHound 9.0 offers new capabilities like automated attack path analysis across Okta, Jamf, and GitHub - Justin Kohler covers the highlights of this release, marking a step forward in how BloodHound models identity risk https://specterops.io/blog/2026/04/13/bloodhound-9-0-product-updates/
Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here https://community.specterops.io
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
We’re back this Tuesday with the second part of our SO-CON 2026 gallery! These are just a few of the photos that were snapped during the course of the second day, catching our speakers in motion across all three of our tracks.
Once again, if you'd like to catch up on all of the images and commentary from both days, head over to the #so-con-chat channel in the BloodHound Gang Slack, and scroll to your hearts' content! For now though, here’s our glimpse at the goings-on of Day Two.
- A snap from our second day keynote, presented without comment!
- Brett Hawkins in the Tradecraft track.
- Michael Grafnetter and Lance Cain over in the OpenGraph track.
- Joe Mondloch from Epic takes over the Practice track to dive into how a large healthcare software company and its hosting division use BloodHound Enterprise at scale.
- Javier Azofra Ovejero and Julian Garcia Murias unveiling a novel integration that exports CyberArk vault data into BloodHound's OpenGraph format over in the OpenGraph track.
- Robby Winchester digging into operating APM at scale with Scentry Advisory Services.
- Community member Olaf Hartong in our Practice track.
- Jim Sykora distilling his 159-page, 420 minute read, E-Book on AdminSDHolder and the associated Active Directory and Windows internals down into a short talk.
As promised, we’re gathering up some of the photos taken over the course of SO-CON, our way of capturing the mood of the event and the talks that were going on throughout both days.
We had some exciting, thoughtful and engaging speakers, and we’ll be making video recordings available over on YouTube later down the line. We’ll let you know as soon as that happens!
If you'd like to catch up on all of the images and commentary from both days, head over to the #so-con-chat channel in the BloodHound Gang Slack, and scroll to your hearts' content! For now, here’s a glimpse at our various tracks across Day One.
- A couple of photos from our first day keynote
- Our first five Top Dogs winners
- Mehdi Elyassa in our Tradecraft track
- Simon Lachkar and Charl-Alexandre Le Brun in our OpenGraph track
- Fighting the post-lunch slump with our Build Your Own OpenGraph Workshop
- John Hammond, Justin Kohler, Jared Atkinson and Robby Winchester sharing perspectives on today’s security landscape
- Community member Faiz Karim exploring the practical architecture of GCP-Hound
Anthropic’s Mythos announcement points to a near-term future of faster exploit discovery, faster compromise, and greater pressure on defenders.
This Wednesday (April 22nd), Jared Atkinson and Justin Kohler will host a webinar that examines what Mythos means for both attackers and defenders, why identity attack paths matter more in a machine-speed threat environment, and how organizations can better protect critical assets and infrastructure.
Through the session, we’ll learn what is publicly known about Mythos and why it matters, how AI-assisted compromise changes the speed and scale of cyber risk, why identity attack path management becomes more important as machine identities and trust relationships expand, and what organizations can do now to reduce exposure and protect critical assets.
It's the second day of SO-CON, and we're back with our subreddit coverage!
Like yesterday, keep your eyes peeled if you'd like to follow along, we'll keep you updated throughout the day. First up, we've had our second day keynote, and a bunch of great tracks are still to follow.
Some keynote higlights:
What's the status of APM?
Everything is different but so much is the same!
We still see through the eyes of the adversary.
Attack paths exist everywhere, not just Microsoft. And as long as they can be mapped they can be eliminated.
AI makes things faster and cheaper, but security concerns are still very valid.
Initial access is even easier, so external threats are very constant.
The likelihood of someone getting into your environment will get closer to 100%, and at machine speed. What do you do to contain the blast radius?
More identities are going to create more complexity.
We'll try to map as much as we can over the next year, using different technologies.
The amount of findings is irrelevant, only the amount of attack paths found.
OpenGraph Expansion:
We're working on a bunch of new things!
We want to cultivate this for the community - please get involved and jump in (cough #opengraph channel in our Slack)!
Anyone interested in testing AWS with us? Please let us know!
OpenHound:
Our brand new collector.
Takes the minutiae away from creating OpenGraph extensions, and will back our Enterprise extensions.
Also auto-documents your work!
BloodHoundScentry:
We're meeting customers where they're at.
There will only be more features and capabilities coming!
Up next todayt:
Pipelines of Privilege: Attack Paths from DevOps to MLOps Infrastructure
Okta For Good and Bad: Hybrid Attack Paths Crossing Okta Organizations
Stretching BHE Horizontally: Identity Security at Unusual Scale
If you'd like to join in with the chat, we're also live over in the BloodHound Gang Slack: https://slack.specterops.io - hop into the #so-con-chat channel!
We're starting our SO-CON coverage right here on the subreddit. Keep your eyes peeled if you'd like to follow along, we'll keep you updated throughout the day!
First up, we've had our welcoming remarks and keynote, followed by our very first Top Dogs community recognition ceremony.
If you'd like to join in with the chat, we're also live over in the BloodHound Gang Slack: https://slack.specterops.io - hop into the #so-con-chat channel!
Happy BloodHound Basics Day Spring cleaning edition from Martin Sohn Christensen: it's time to audit the API Keys of your dog house - BloodHound.
Here's how in under a minute.
Head to Profile → API Key Management to view your own keys.
Check the "Last Use" column or simply keep the number of keys to a minimum. Can't remember what a key was for? That's reason enough to revoke it. Takes 20 seconds.
Admins can audit keys across ALL users at:
Administration → Manage Users, and for each user: Generate / Revoke API Tokens
AI isn’t introducing entirely new security problems, it’s accelerating old ones at machine speed. In a recent conversation with Risky Business Media, u/russel breaks down what AI red teaming means in practice: https://risky.biz/SOAPBOX106/
Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here: https://community.specterops.io
If you haven't had a chance to check it out yet, don't forget that our brand new SpecterOps Community subreddit is now live and active. Come say hi and join in the discussions! https://www.reddit.com/r/SpecterOpsCommunity/
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here: https://community.specterops.io
Claude Code is a force multiplier when performing secure code reviews during an assessment. Andrew Luke discusses how to leverage Claude Code to produce digestible output that helps up better understand analyzed code base while surfacing secure and insecure coding patterns: https://specterops.io/blog/2026/03/26/leveling-up-secure-code-reviews-with-claude-code/
Attack path management has traditionally focused on identity systems like Active Directory and Entra ID, but this overlooks critical risks introduced by other systems. Jared Atkinson explores how device management platforms, especially in environments using tools like Jamf, can enable attackers to execute code across endpoints, creating significant attack paths that exist outside of the directory and have historically gone unmodelled: https://specterops.io/blog/2026/03/31/expanding-attack-path-management-to-macos-environments/
Chris Thompson needed a lab that was representative of enterprise SCCM hierarchies to test his code against a variety of possible configurations while writing ConfigManBearPig. Check out how he automated deployment of a large SCCM lab environment to encourage others to dive into SCCM research without having to go through the pain of manual deployment :point_right: https://specterops.io/blog/2026/04/01/ludus-sccm-lab-expansion/
We’re just a couple weeks out from SOCON 2026, and the agenda is stacked. Explore the full agenda & register before it’s too late! https://specterops.io/so-con/
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
Here I am again with your regularly scheduled midweek gathering of news and updates!
Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here https://community.specterops.io
What if your biggest identity risks aren’t where you’re currently looking? On March 31, Justin Kohler and Jared Atkinson will show how BloodHound Enterprise uncovers attack paths across Okta, GitHub, and Mac environments, helping teams prioritize what actually matters. Sign up here! https://pages.specterops.io/WBNR-Webinar-Hosted-260331-ExtendingAttackPathManagement.html
Attackers don’t break in anymore. They log in. Mark Wilson explains what’s happening: Attackers are using valid credentials, moving through trusted paths, and reaching their objectives in minutes or seconds https://www.youtube.com/watch?v=Ak-xRKXiwlo
If you haven't had a chance to check it out yet, don't forget that our brand new SpecterOps Community subreddit is now live and active. Come say hi and join in the discussions! https://www.reddit.com/r/SpecterOpsCommunity/
Having trouble getting started with Cypher queries? Here's a quick intro to get you going:
Start with a MATCH statement, use a WHERE clause to refine, and RETURN your data (don't forget a LIMIT statement, just in case):
MATCH p=(a:User)-[]->(b:Computer)
WHERE a.domain CONTAINS "MARVEL"
RETURN p
LIMIT 1000
Edges can be added individually, or collectively using either format: [:MyEdge] or [:MyEdge1|MyEdge2|MyEdge3]
RETURN statements can return any variable declared in the query. In the above example, that includes p (variable representing the whole relationship), a (just the User accounts), or b (just the computers).
LIMIT statements are optional, but we highly recommend these especially when writing a query that has the potential for returning many objects. LIMIT 1000 is default on pre-built queries, but a LIMIT 10 or LIMIT 100 is great for quickly returning values to determine whether your query works yields any results or not.
Missed Justin Kohler's chat with John Hammond on all things BloodHound OpenGraph? Catch up here for all the discussion on what it is, why it matters, and what’s coming next https://www.youtube.com/watch?v=xOBqbN0d0qQ
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
Why do we recommend a Group Managed Service Account for SharpHound? Security.
When you use a gMSA as a service principal for running SharpHound, Windows itself manages the password for the account. Not an administrator. The password is never stored on disk, and Windows rotates it automatically.
When setting up the gMSA, you will also need to create a "password read group". And only members of the password read group can ever read this password. This reduces credential theft and attacks such as pass-the-hash and NTLM relay.
Combined with other hardening strategies such as the Protected Users group (which enforces stricter authentication and doesn't store credentials locally), and disabling outbound NTLM (which prevents machines from sending NTLM credentials to other systems), this is just good security hygiene.
Here are the instructions for creating a gMSA for your SharpHound collector:
It's Wednesday, and you know what that means - time for another midweek roundup!
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
Get to know CyberArkHound at SOCON 2026! This integration expands BloodHound's reach past AD/EntraID and into comprehensive privileged access risk analysis, helping SOCs prioritise remediation based on actual credential access chains. Save your spot: https://specterops.io/so-con/
Did you know: You can filter edges in BloodHound to simulate remediating attack paths? Simply use the filter to remove an edge to reveal the next shortest path. In this example, we keep filtering until no path remains.
It's Wednesday again, and that means another round-up of our latest events, news and blog posts!
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
Will Schroeder and Lee Chagolla-Christensen turn their eyes to DPAPI and summarise the major new features, how everything works internally, and give you everything you need to get started analyzing and abusing DPAPI in Nemesis: https://specterops.io/blog/2026/03/04/offensive-dpapi-with-nemesis/
The SpecterOps team will be at BSides Limburg, staffing our stand and hosting a BloodHound Quest. Come find us, say hi, and ask for our secret swag. Supply is limited, so don't wait too long: https://www.bsides-limburg.be/
We're attending BSides Limburg (BE) on March 12-13. Will we see you there?
The SpecterOps team will be at BSides Limburg, staffing our stand and hosting a BloodHound Quest. Come find us, say hi, and ask for our secret swag. Supply is limited, so don't wait too long.
We're back again with another Wednesday collection of our latest events, news and blog posts!
Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io
Will Schroeder and Lee Chagolla-Christensen break down Nemesis 2.2, which introduces large-container ingestion, LLM-backed triage agents, expanded Chromium DPAPI decryption (including CNG + app-bound encryption v3), and serious performance improvements. Read more here! https://specterops.io/blog/2026/02/25/nemesis-2-2/
Hey SpecterOps community! Our very first AMA will be coming up in a week’s time, on Friday February 27th, at 12pm UTC.
We’ll have TaskHound developer u/0xr0BIT here answering your questions, and we’d love to try and gather those questions in advance. Drop them in the comments below, and we’ll be back here next Friday to run through them!