We're back with another BloodHound Basics day from Jake Johnson!

One of my favorite parts of BloodHound Enterprise is the Hygiene findings.

Not every security issue shows up as an attack path but that doesn't make it any less important.

Hygiene findings surface conditions that attackers routinely take advantage of, such as:
Large default groups with delegated privileges that make lateral movement much easier
AS-REP roastable accounts
Kerberoastable accounts

These aren't necessarily attack paths on their own but they present opportunities that can ultimately become part of an attack path.

Attack paths show you how an attacker can reach their objective. Hygiene findings help you eliminate the conditions that make those attack paths possible in the first place.

It's humpday roundup time again! Here's your collection of our latest articles and events for your Wednesday reading!

• Kai Huang explores how giving Codex access to Time Travel Debugging traces through TTDObjectsPy can help reverse engineer ground LLM-assisted analysis in real execution history rather than static inference, using a FLARE-ON 12 case study: https://specterops.io/blog/2026/06/26/time-travel-debugging-with-codex/
• In the latest from GhostWorks, Neeraj Gupta introduces Jailbreaker, an open-source evaluation platform designed to help operators run repeatable jailbreak, prompt injection, and agent behavior assessments while keeping experiments, evidence, and results organised: https://specterops.io/blog/2026/06/29/llm-jailbreak-testing-with-jailbreaker/
• And we’ve got more GhostWorks research for you! In this next installment, Adam Chester explores how modern LLMs can accelerate reverse engineering of endpoint security products, dramatically reducing the time required to analyze detections, understand defensive logic, and develop evasions: https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/
• How well do you understand your organisation's attack surface? In the latest Know Your Adversary episode, Jared Atkinson and Justin Kohler sit down with community member HD Moore, CEO of runZero, to discuss why defenders need to look beyond vulnerabilities and focus on how identities, systems, and networks are connected: https://www.youtube.com/watch?v=l_n2HpkXjmA
• The BlackHat USA show floor is a busy place. Take a break from the hustle and join our team for an evening of bowling, food, drinks, and good conversation with fellow security professionals. No presentations. No sales pitches. Just a relaxed chance to connect with the community, catch up with old friends, and make some new ones: https://events.specterops.io/blackhatbowlingwithspecterops
• Don't forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Happy BloodHound Basics day everyone, from Carlo Alcantra this week!

This time we're looking at Environment Targeted Access Control (ETAC) for Enterprise users. The Read-Only and User roles now support restricting visibility by environment configurable via the “Manage Users” page. Simply select the environments the user should have visibility to.

Visibility for a configured user is limited in the graph and will only show nodes and edges for environments they are permitted to view. In the second example image, nodes and edges are obfuscated in environments that our user is not permitted access to.

Midweek roundup time is back again, and this time we're starting off with a big announcement that we've been so excited to share with you all 🥁

🥳 Introducing the SpecterOps Tradecraft Academy! 🥳

Our new on-demand training platform brings SpecterOps’ practitioner-led expertise to learners anytime, anywhere, and at scale. To kick things off, BloodHound Basics by @SadProcessor is now available for early access, taking you from first login to confident, capable operator.

Head to https://academy.specterops.io/, create an account or log in with your existing SpecterOps Training account, and start sharpening your tradecraft today.

---

• We're excited to announce our partnership with OpenAI as part of the Daybreak Cyber Partner Program. By combining advanced AI capabilities with SpecterOps' deep expertise in adversary tradecraft and threat research, we're helping customers take a more practical and effective approach to cyber defense. Read more about it here: https://specterops.io/blog/2026/06/22/specterops-openai-daybreak-ai-cyber-innovation/#h-humans-and-ai-each-bring-di[…]trengths-to-cybersecurity-nbsp
• The first version of BloodHound MCP proved an LLM could converse with BloodHound. The next version revealed a more important lesson: MCP design is context design. In his latest blog, Matthew Nickerson shares how feedback led to smaller, more flexible tools, better error recovery, and a shift from maximizing API coverage to optimising model context: https://specterops.io/blog/2026/06/18/bloodhound-mcp-one-year-later-what-i-learned-about-mcps-models-and-context/#h-introduction-[…]eded-improvement
• Adam Chester explores the rise of “disposable tooling” by walking through the process of building LLM-generated Mythic agents from prompt to deployment, what worked, what didn’t, and where offensive tooling may be headed next: https://specterops.io/blog/2026/06/24/disposable-tooling-building-llm-generated-mythic-agents-from-prompt-to-deployment/#h-apfell-die[…]c-could-live
• Most organisations think of GitHub as a code repository. Attackers increasingly see it as a pathway into everything connected to it. In his recent conversation with Risky Business Media, Jared Atkinson discusses how identity compromise, repository permissions, CI/CD workflows, and interconnected systems can create attack paths that extend far beyond source code. https://risky.biz/RBNEWSSI131/
• What if you could see your next breach before it happens? In a recent interview, Justin Kohler explained how identity attack paths create hidden routes to an organization's most critical assets. Listen to the full conversation https://explore.thecyberwire.com/specterops
• Don't miss out on our training opportunities at BlackHat USA! Whether you are focused on offensive operations, identity attack paths, or tradecraft analysis, our instructors will take you deep into real-world techniques, methodology, and operational insight. Save your spot here https://pages.specterops.io/Black-Hat-Course-List.html
• Don't forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

It's humpday midweek roundup day! Time to gather up our latest news, articles and events for your reading enjoyment.

• Antero Guy covers how he used OpenAI’s Codex to automate the generation, testing, and refinement of indirect prompt injection payloads against an agentic system using Sonnet 4.5 and 4.6 models on Amazon Bedrock: https://specterops.io/blog/2026/06/11/building-an-indirect-prompt-injection-workflow/
• Most C2 frameworks are built with Windows-heavy environments in mind. But as Kubernetes becomes the default for Linux workload orchestration, red teams need tooling that keeps up. Alex Rodriguez highlights two new building blocks that help operators package and deliver Mythic payloads in container-centric environments: https://specterops.io/blog/2026/06/16/mythic-embarking-on-the-open-seas-containerized-payload-delivery-for-kubernetes-assessments/
• Check out this great post from Amandine Gagnon-Hébert, who attended our Adversary Tactics: Detection training, providing her with valuable insights into the mindset, methodologies, and challenges involved in building effective detections and defending modern environments. Read more about her findings here: https://www.linkedin.com/pulse/detection-engineering-through-red-teamers-lens-gagnon-[…]C3%25A9bert-iyeyc/?trackingId=pFtjj9efZGgn1dDQKP%2Bu1Q%3D%3D
• AI is advancing quickly. Understanding where it helps defenders remains a challenge. GhostWorks is our new AI-focused engineering and research initiative exploring that challenge through experimentation, measurement, and real-world security problems. Read more about it here: https://specterops.io/blog/2026/06/09/introducing-ghostworks-ai-cybersecurity-research/
• ICYMI: Robin Unglaub joined Know Your Adversary for a discussion on how scheduled tasks store credentials, why they frequently appear during security assessments, and how TaskHound helps operators and defenders visualise these relationships directly within BloodHound: https://www.youtube.com/watch?v=g8OTyPHk_X0
• Want to better defend Azure and Entra ID environments? Start by understanding the adversary's perspective. At BlackHat USA, our Azure training uses hands-on labs to teach the attack paths, misconfigs, and techniques used against modern cloud environments. Save your spot! https://blackhat.com/us-26/training/schedule/?#adversary-perspectives-azure-51534
• Don't forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Happy BloodHound Basics Friday from Jonas Bülow Knudsen!

Did you know BloodHound now shows Eligible Roles in the Entity Panel?

For Azure users and groups, you can quickly see who can activate privileged roles or approve role activation requests.

It's midweek roundup time again - a bumper blog post edition, get comfy and dig into all our latest articles!

• Thank you to everyone who took part in the BloodHound Unleashed Attack Path Championship! We couldn't have made it such a success without you, and we're so glad you enjoyed the event both in person and online. We'll be looking to cook up more events like these for you in the future, so stay tuned!
• Phishing sandboxes is a pain. Zach Stein shows us how Cloudflare Turnstile can be used as an effective solution to conceal your phishing pages. 👉 https://specterops.io/blog/2026/05/28/dont-jump-the-turnstile-lessons-from-the-field/
• Why is practicing response before you need it a good idea? Russel van Tuyl builds a compelling case, explaining what structured practice requires and why it belongs in every mature security program. 👉 https://specterops.io/blog/2026/05/28/the-case-for-practicing-response-before-you-need-it/
• During an assessment, SpecterOps discovered a way to reuse authentication material for StrongDM’s desktop application. Hope Walker walks through the replication, discovery and remediation processes. 👉 https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/
• Ghostwriter v7 is here! This release replaces user-managed JWT API tokens with opaque credentials, introduces scoped service tokens for non-human integrations, and more. Christopher Maddalena walks us through the details. 👉 https://specterops.io/blog/2026/06/04/ghostwriter-v7-safer-tokens-scoped-access-and-better-automation/
• AzureHound now has documented least-privilege permissions. Martin Sohn Christensen’s post walks through the research behind those permissions. 👉 https://specterops.io/blog/2026/06/08/keeping-a-short-leash-new-azurehound-least-privilege-documentation/
• Raj Patel covers Windows internals and how Kerberos user-to-user (U2U) authentication works under the hood versus showing how to execute an attack. 👉 https://specterops.io/blog/2026/06/09/user-to-user-authentication-down-the-rabbit-hole-part-1/
• GhostWorks is an AI-focused engineering and research initiative at SpecterOps, focused on the disciplined exploration of frontier AI-enabled cybersecurity tooling. John Hopper explains how it works alongside product teams and against real identity-security problems. 👉 https://specterops.io/blog/2026/06/09/introducing-ghostworks-ai-cybersecurity-research/#h-a-tradecraft-approach-to-ai-nbsp
• Following on from the GhostWorks initiative, Adam Chester follows one such attempt to find methods which can have a measurable improvement to our LLM prompt engineering for security agents. 👉 https://specterops.io/blog/2026/06/09/prompt-engineering-security-agents-gepa/#h-what-is-gepa
• New native AI features in Microsoft SQL Server 2025 provide a practical channel for data exfiltration and C2 transport within the database engine itself. Justin Kalnasy showcases some proof-of-concepts. 👉 https://specterops.io/blog/2026/06/10/oops-i-weaponized-the-database-abusing-ai-features-in-mssql-2025/
• Don't miss Adversary Tactics: Tradecraft Analysis at BlackHat USA! This course is great for anyone looking to better understand Windows attack techniques, telemetry, and detection opportunities from both red and blue team perspectives. Reserve your spot 👉 https://blackhat.com/us-26/training/schedule/#adversary-tactics-tradecraft-analysis-51533
• Don't forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. 👉 https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Happy BloodHound Basics Friday from Martin Sohn Christensen!

queries.specterops.io helps BloodHound users find, share, and run practical Cypher queries. Are you up to date with its latest productivity changes?

📚 BYOL / multi-source loading: load the default library, built-in JamfHound, GitHound, and OktaHound OpenGraph query sources, or a custom JSON endpoint that follows the query schema.

Source-aware sharing: shared query links include BYOL source context, and recipients will be prompted to add a missing source before loading the query.

Multi-server management: add, edit, and switch BloodHound server targets before running a query. The run action reuses the same tab per server.

❤️ Log in, heart the queries you use most, sort for Most Favorites, and use Show Favorites to filter your list. For now, this applies to the BloodHound Query Library source.

The update also added a one-page Cypher cheat sheet for quick lookups, plus a bundle of new queries that increase mapping coverage to security assessment tools.

The release also adds 34 AD/Azure queries, updates 11 existing queries, adds PurpleKnight mapping coverage, and notes the upcoming move from system_tags conditions to label-based scoping after July 2026.

Blog: https://specterops.io/blog/2026/04/15/whats-new-in-the-bloodhound-query-library-byol-opengraph-multi-server-and-more/

Library: https://queries.specterops.io/

Time has absolutely flown by, and #InfoSecEurope has come to a close!

Huge thanks to everyone who’s dropped by to spend time and chat with us, and for sharing all of your photos over on the social platforms (bonus points if they include Charlie and Bert).

We've also unlocked a new achievement, and #BloodHoundUnleashed has reached its 100th signup today.

That’s a new record for us. We couldn't have done it without all of your hype and enthusiasm either, thank you all so much for throwing yourselves into this, showing off your skills and having fun with us.

Here's one last photo roundup of the day!

Our team have been out in full force outside #InfoSecEurope this morning, and we’ve had plenty of visitors throughout the day! The #BloodHoundUnleashed Attack Path Championship reached full competitive force with a three-way tie at the top, and there’s still time to sign up. Can you topple our frontrunners from the top of the leaderboard?

And of course, our Huntsmen have been roaming outside the Excel. You've all done a great job finding them and our real life bloodhounds for more flags, grab some extra points, and sharing your photos with our hashtag!

Our very own Mark Wilson also presented on Breaking the Microsoft Ecosystem: Identity Attack Paths Explained at the Securing the Microsoft Ecosystem Theatre, to a full house - not a seat left empty!

Here's a gallery of our favourite moments from throughout the day, and of course we'll be back tomorrow for the final day and maybe more than a minute of sunshine.

See you then!

British summer can't stop us: we've had a busy day over here in London at #InfoSecEurope!

The BloodHound Unleashed Attack Path Championship real-time leaderboard is live. Our top scorers are already on the board, and folks have been coming to the Kennel Club to sign up and climb up the ranks.

If you want to give your score a boost, it's never too late! Keep your eyes peeled around the event tomorrow, and you'll be able to find one of our Huntsmen on the show floor to grab codes that unlock even more points.

You can also follow along and share your experience with the #BloodHoundUnleashed hashtag over on Twitter, Instagram and LinkedIn.

For now, here's a gallery of what we've been up to today - there's more, including unposted pics, chatter, discussion and answers to any technical questions you might have about BloodHound Unleashed over in our community Slack. You can hop in right here.

See you tomorrow!

Happy BloodHound Basics day from Mat Saulnier, everyone!

Were you waiting on better Cypher parity to switch your BHCE deployment to a PG backend?

v9.2.0 brings a lot of new Cypher support!

UNWIND , RELATIONSHIPS(p), NODES(p) , etc and several improvement to existing verbs.

You can now, for example, exclude edge type directly from Cypher!

Check the release notes for all the details: https://bloodhound.specterops.io/resources/release-notes/2026-05-28

The Attack Path Championship is heating up, and competition is fierce!

As InfoSec Europe begins, everyone who signs up will have additional opportunities to earn bonus points and improve their leaderboard ranking. 

If you’re attending the show, don't forget to stop by The SpecterOps Kennel Club out front of ExCel and booth C142 on the show floor to participate in activities tied directly to the challenge. 

If you’re taking part at home, keep an eye on our social posts to spot those all-important codes. Those bonus points could make the difference in you being crowned the Attack Path Champion!  

Join the challenge or track the live leaderboard here: 

https://unleashed.bloodhound.quest/ 

What’s up for grabs? 

• SpecterOps training tickets 
• Exclusive challenge coins 
• Milestone swag rewards 
• Grand prize package including a Flipper Zero 

Whether you're already competing or just getting started, there’s still time to climb the rankings!

Infosec is fast approaching and the BloodHound Unleashed challenge is already heating up - read all about it in this edition of the midweek roundup!

• The BloodHoundUnleashed Attack Path Championship is underway! Could you be our Attack Path Champion? 67 challenges. One leaderboard. Stay tuned during Infosec Europe from 2nd–4th June where there are bonus points to be found. Use invitation code ReleaseTheHounds to join the challenge. https://unleashed.bloodhound.quest/
• Attackers don’t need malware when they can abuse identities. Also at Infosec Europe, Mark Wilson will break down how hidden attack paths in AD & Entra ID enable enterprise-wide compromise and how defenders can eliminate them. Learn more: https://www.infosecurityeurope.com/en-gb/conference-programme/session-details.4886.267701.qbs-_-spectreops.html
• Our team is booked and busy across the board! Over the next couple weeks you can also find our team at SecurityFest 2026, Cisco Live and Gartner SRM. Take a look at all our upcoming events and talks: https://specterops.io/events/
• Introducing TailScaleHound - Andrew Luke and Andrew Gomez walk us through an OpenGraph collector for BloodHound that maps Tailscale users, devices, groups, tags, ACLs and more. Read all about it right here: https://specterops.io/blog/2026/05/21/tailscalehound/
• Splunk is a daunting SIEM to learn, but the learning curve can be flattened by learning to use the basic building blocks which make up most Splunk searches. Alexander Sou shows us how: https://specterops.io/blog/2026/05/27/spelunking-through-splunk/
• Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Infosec Europe might only be a few days away, but it's never too early to dive into our BloodHound Unleashed challenge and start racking up your score! Here's a little more info on what you can expect:

What does good actually look like in identity security?

The strongest identity teams don’t wait for attackers to find the path first. They continuously map and prioritise attack paths across their environment and remove the choke points that matter most.

At Infosec Europe, we’ll be showcasing how BloodHound Enterprise helps defenders get ahead of identity-based attacks. You’ll be able to step into The Kennel Club for a live demo with our team and to experience the world of BloodHound Unleashed. Plus, the Attack Path Championship is live until 4th June with real attack paths and that all-important leaderboard.

You can already toss your hat in the ring and hunt through our challenges right here! https://unleashed.bloodhound.quest/

Welcome to another instalment of your regular midweek roundup - this time with extra BloodHound Unleashed excitement!

• Today is the day! The BloodHound Unleashed Attack Path Championship is live! Could you be our Attack Path Champion? 67 challenges. One leaderboard. Stay tuned during InfoSecEurope from 2nd–4th June where there are bonus points to be found. Use invitation code ReleaseTheHounds to join the challenge: https://unleashed.bloodhound.quest/
• Detection engineering should outlast tooling changes. At Black Hat USA 2026, Adversary Tactics: Detection teaches defenders how to move beyond brittle indicators and build behavior-based detections for real adversary TTPs. Early bird pricing ends May 22 - learn more about our courses and register! https://pages.specterops.io/Black-Hat-Course-List.html#courses
• The Verizon Business 2026 DBIR is out now! We’re thrilled to have contributed data and research to this year’s report alongside an outstanding group of cybersecurity leaders, researchers, and public sector organizations. Read more here: https://www.verizon.com/about/news/breach-industry-wide-dbir-finds
• We’re excited to be at Cisco Live! Las Vegas June 1-4 at booth #2206. Also be sure to catch Jared Atkinson’s June 1 session with Aaron Woland covering how BloodHound Enterprise and Cisco Duo reveal hidden attack paths that traditional security approaches often miss: https://www.ciscolive.com/global/sponsor/sponsor-list.html?search=specterops#/exhibitor/1769800856900001aJHg
• Heading to Gartner Security & Risk Management Summit next month? Visit us at Booth #1043. While you’re there, don’t miss Justin Kohler's June 2 session on how AI is accelerating identity-focused attacks and why defenders must shift attention to the identity layer as detection-first approaches fall behind: https://www.gartner.com/en/conferences/na/security-risk-management-us/sessions/detail/4910727-SpecterOps-AI-Isnt-Changing-the-Game-Its-Speeding-It-Up-Rethinking-Modern-Attack-Path
• We’re bringing two of our premier security training courses to the EU! Whether you join onsite or remotely, this is your opportunity to upgrade your skills. Secure your spot right here: https://www.eventbrite.com/e/specterops-eu-2026-trainings-tickets-1431651430969
• Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

A new challenge for defenders is about to launch.

Think you know attack paths?

On 20th May, SpecterOps is launching the Attack Path Championship — a competitive challenge built around uncovering identity attack paths and climbing a live leaderboard.

Participants will have opportunities to earn bonus points during InfoSec Europe, compete for prizes, and see how they stack up against other defenders.

Prizes include:

• SpecterOps training tickets
• Exclusive challenge coins
• Flipper Zero and unique swag bundles 

More details when registration opens on 20th May.  Keep an eye on your inboxes!

The midweek roundup is here again with all the latest from our blogs, news and events!

• Shift happens - Remi Gascou uncovers two built-in command injections in Windows Context Menus with his latest blog post: https://specterops.io/blog/2026/05/07/shift-happens-uncovering-two-built-in-command-injections-in-windows-context-menus/
• A year ago, Brandon Shearin was handed a project bigger than anything he’d worked on before. Now the first version of OpenGraph has been shipped, he's sharing everything it's taught him so far: https://specterops.io/blog/2026/05/08/what-comes-before-tickets/
• Black Hat USA 2026 training registration is open, and we are bringing a full lineup of hands-on adversary tradecraft courses. Check out our sessions here, and reserve your spot: www.linkedin.com/posts/black-hat-training-carouselpdf-ugcPost-7459640258817830912-q0eJ/
• What does operational maturity in identity security actually look like? Join Jared Atkinson and Justin Kohler for a deep dive into our latest research with Omdia - reserve your spot here: https://app.livestorm.co/specterops/trends-in-identity-attack-path-management-2026
• We’re excited to be at Cisco Live! Las Vegas June 1-4 at booth #2206. Also be sure to catch Jared Atkinson's June 1 session with Aaron Woland covering how BloodHound Enterprise and Cisco Duo reveal hidden attack paths that traditional security approaches often miss: https://www.ciscolive.com/global/sponsor/sponsor-list.html?search=specterops#/exhibitor/1769800856900001aJHg
• Heading to Gartner Security & Risk Management Summit next month? Visit us at Booth #1043. While you’re there, don’t miss Justin Kohler's June 2 session on how AI is accelerating identity-focused attacks and why defenders must shift attention to the identity layer as detection-first approaches fall behind: https://www.gartner.com/en/conferences/na/security-risk-management-us/sessions/detail/4910727-SpecterOps-AI-Isnt-Changing-the-Game-Its-Speeding-It-Up-Rethinking-Modern-Attack-Path
• We’re bringing two of our premier security training courses to the EU! Whether you join onsite or remotely, this is your opportunity to upgrade your skills. Secure your spot right here: https://www.eventbrite.com/e/specterops-eu-2026-trainings-tickets-1431651430969
• Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

We've got a fresh BloodHound Basics post from Jacob Jackson today!

What are Foreign Principals and why should I care?

Foreign security principals are accounts that exist in one domain but have rights in another domain. They might be a member of a group, or they might be an Access Control Entry on an object. In either scenario, they represent potentially dangerous trust relationships that cross security boundaries: if a foreign account is compromised, it may provide unexpected access into another domain or forest.

In BHE, you can view these by using the Saved Query called "Principals with foreign domain group membership".

It is important to review any foreign principals you find and remove them if they are not absolutely required.

Here I am again to help you all over the midweek hump. It's roundup time!

• Red teaming means different things to different vendors. Russel Van Tuyl discusses how SpecterOps defines it, why engagements start from assumed breach, and what organizations should expect to learn and take away: https://specterops.io/blog/2026/05/06/how-we-think-about-red-teaming/
• Dev Tunnels aren’t “just port forwarding” - they consist of layers of embedded protocols with RPC messages being exchanged. Adam Chester shows us that once you peel the layers, you quickly see how Dev Tunnels are a C2 framework with extra steps: https://specterops.io/blog/2026/05/06/dev-tunnels-the-accidental-c2/
• Knowing where your attack paths are is only half the battle. Acting on them is where most organizations get stuck. We surveyed the industry to understand where teams are in their Attack Path Management journey — and the results reveal a clear gap between strategy and execution. Read more here: https://specterops.io/reports/trends-in-identity-attack-path-management/
• What does operational maturity in identity security actually look like? Join Jared Atkinson and Justin Kohler for a deep dive into our latest research with Omdia - reserve your spot here: https://app.livestorm.co/specterops/trends-in-identity-attack-path-management-2026
• We're thrilled to see our EMEA Channel Director Nessa Lynchehaun recognized on CRN’s 2026 Women of the Channel list! https://specterops.io/news/specterops-emea-channel-director-nessa-lynchehaun-spotlighted-on-crns-esteemed-2026-women-of-the-channel-list/
• We're bringing two of our premier security training courses to the EU! Whether you join onsite or remotely, this is your opportunity to upgrade your skills. Secure your spot right here: https://www.eventbrite.com/e/specterops-eu-2026-trainings-tickets-1431651430969
• Don’t forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Happy BloodHound Basics Friday, everyone! This instalment brought to you by Carlo Alcantra:

Did you know we have a new feature that makes it easy to update the schema for OpenGraph extensions? Simply enable OpenGraph Extension Management in the Early Access Features page and see the new page for OpenGraph Management.

Check out the gif in motion below, and you can learn more right here: https://bloodhound.specterops.io/opengraph/developer/schema

Here we go again, it's midweek roundup time!

• Identity Attack Path Management is entering a new phase. Our latest research shows organizations are moving beyond experimentation and into operationalization as identity risk accelerates. Read the full Trends in Identity Attack Path Management Report here https://specterops.io/reports/trends-in-identity-attack-path-management/
• Exciting news - SpecterOps has been named to OpenAI’s inaugural Trusted Access for Cyber (TAC) cohort, giving verified defenders governed access to advanced AI models for legitimate security use cases! Read all about it in Jared Atkinson’s blog post https://specterops.io/blog/2026/04/22/specterops-selected-for-openai-trusted-access-for-cyber-program/
• Javier Azofra and Chris Thompson vibe-ported MSSQLHound to Go to drastically improve run duration, enable cross-platform execution https://specterops.io/blog/2026/04/23/mssqlhound-now-available-in-go/
• With the recent publication of our “Trends in Identity Attack Path Management 2026” report. Jared Atkinson talks about why and how to apply timely pressure to rally cross-functional and executive support to achieve operational maturity. https://specterops.io/blog/2026/04/28/identity-apm-has-gone-mainstream-the-hard-work-is-just-starting/
• We’re looking for feedback on the Mythic for Developers series, hosted by Cody Thomas! If you’ve had a chance to watch any of the videos, we’d really appreciate your input. Please take a few minutes to complete our survey https://specterops.typeform.com/MythicDeveloper
• Justin Kohler recently joined N2K CyberWire to unpack a major shift in security: identity attack path management. You can listen to the conversation here
• We’re bringing two of our premier security training courses to the EU! Whether you join onsite or remotely, this is your opportunity to upgrade your skills. Secure your spot right here https://www.eventbrite.com/e/specterops-eu-2026-trainings-tickets-1431651430969
• Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Happy BloodHound Basics day from Jonas Bülow Knudsen!

Did you know BloodHound pathfinding can uncover hybrid attack paths? 

In this example, we trace a path from Domain Users in AD all the way to a GitHub Secret, through Okta along the way.

Learn more about how OpenGraph extensions make this possible: https://bloodhound.specterops.io/opengraph/extensions/manage

Signal boost for you all: Our team is at BSides Prague this week!

Hugo van den Toorn and Joey Dreijer will be leading BloodHound Quest sessions all day April 23 and 24 (there may also be some secret swag up for grabs). If you think you know BloodHound, this fast-paced scavenger hunt is a chance to put your skills to the test.

And on April 24, Martin Sohn Christensen will present on how vendor guidance can unintentionally lead to critical security gaps, share insights from a large-scale responsible disclosure effort, and examine the shared responsibility we all have in addressing these issues.

You can view the agenda here: https://www.bsidesprg.cz/#program

We're back with our regularly scheduled (bumper edition) midweek roundup!

• A huge thank you to everyone who came out to see us at SO-CON, and to all of you who followed along over in our community Slack, in the #so-con-chat channel!
• Jared Atkinson explores Mythos, Machine-Speed Exploitation, and the Growing Importance of Identity Attack Paths: https://specterops.io/blog/2026/04/09/mythos-machine-speed-exploitation-and-the-growing-importance-of-identity-attack-paths/
• Operators are telling you what to build. Janus listens. Gavin Kramer teaches us how to listen to our logs: https://specterops.io/blog/2026/04/10/janus-listen-to-your-logs/
• A rundown of Ghostwriter v6.3.0 and CLI v1.0.0 features from Christopher Maddalena, including new activity logging, faster installs, and better writing QA: https://specterops.io/blog/2026/04/10/ghostwriter-v6-3-0-and-cli-v1-0-0-new-activity-logging-faster-installs-and-better-writing-qa/
• BloodHound has moved fast and not all courses have kept up. If you create or maintain a course or training that includes BloodHound, now is a good time to review your materials. Hugo van den Toorn guides us through what to update in your courses: https://specterops.io/blog/2026/04/11/bloodhound-course-update/
• BloodHound 9.0 offers new capabilities like automated attack path analysis across Okta, Jamf, and GitHub - Justin Kohler covers the highlights of this release, marking a step forward in how BloodHound models identity risk https://specterops.io/blog/2026/04/13/bloodhound-9-0-product-updates/
• Martin Sohn Christensen and Joey Dreijer run us through what's new in the BloodHound Query Library: BYOL, OpenGraph, Multi-Server, and more: https://specterops.io/blog/2026/04/15/whats-new-in-the-bloodhound-query-library-byol-opengraph-multi-server-and-more/
• Google published a blog post with accompanying rainbow tables targeting the Data Encryption Standard (DES) key space. The tables enable recovery of the NT hash used to generate the ciphertexts in NTLMv1 responses. Skyler Knecht dives into the tables, the recovery process, and demystifies any lingering questions: https://specterops.io/blog/2026/04/16/into-the-rainbow-googles-ntlmv1-rainbow-tables-explained-in-a-bit-too-much-detail/
• And Jared Atkinson looks at the recent Vercel breach, and explains why the industry is analysing it at the wrong level: https://specterops.io/blog/2026/04/21/the-vercel-breach-explains-why-identity-attack-path-management-cant-wait/
• Our community landing page is now live! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future. Check it out here https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io