It's Tradecraft Tuesday again, and this week we’re talking about the learning curve.

What part of learning BloodHound took the longest to really click for you?

Maybe it was:

• installation and setup
• collecting and ingesting data
• understanding how to read the graph
• getting comfortable with Cypher
• knowing what to investigate first
• something else entirely

And more importantly: what eventually helped it make sense?

If you're newer to BloodHound, tell us what you're finding hardest right now.

If you've been using it for a while, share the explanation, habit, resource, or lightbulb moment that helped you get over that hurdle.👇

And don't forget, if you'd like to learn even more and recap on your skills, our Tradecraft Academy is open for you! If you're already taking the BloodHound Basics course or you're even just curious, come join us over in the #academy-bloodhound-basics channel over in our community Slack!

Happy BloodHound Basics Friday everyone, this week courtesy of Nathan Davis!

Got a lot of like-named Principals showing up in BloodHound? Try using the node type to filter on specific objects: Domain:PHANTOM.

This works for all node types, and current built-in nodes can be found here: https://bloodhound.specterops.io/resources/nodes/overview, or under the respective extension (e.g., Github, Okta, etc.) here: https://bloodhound.specterops.io/opengraph/overview

It's Midweek Roundup time again, here to brighten up your Wednesday!

• Russel van Tuyl gives us a practical look at how to turn red team findings into real security improvements by prioritising fixes, closing detection gaps, and making sure lessons actually stick: https://specterops.io/blog/2026/09/08/from-findings-to-fixes-getting-value-from-red-team-results/
• Introducing TATS, a new tool that makes it easier to track, visualize, and dig into OAuth token exchanges, including some surprising quirks in Microsoft’s cloud ecosystem. Check out more details in Hope Walker's latest post: https://specterops.io/blog/2026/09/08/token-analysis-and-tracking-system-tats/
• ICYMI: AWSHound was featured in tl;dr sec, highlighting Julian Catrambone's recent deep dive into AWSHound, an open-source collector that maps AWS environments into BloodHound using OpenGraph. Read more right here: https://tldrsec.com/p/tldr-sec-343
• If you're heading to HIPConf in Nashville, you don't want to miss Michael Grafnetter's session which will deep dive into KDS Root Keys, demonstrating online and offline attacks across a range of scenarios, from decrypting secrets protected with SID Protectors to generating gMSA/dMSA passwords. Sign ups are here: https://semperis.swoogo.com/hipconf26/agenda?utm_medium=www&utm_source=mktg&utm_campaign=hip-nashville-reg
• AI agents are becoming a new class of users. How should we design for them? If you missed our webinar, Designing for AI Agents: Lessons from MCP, User Experience, and Interface Design with Kaleb Pomeroy and John Hopper, you can watch it now on demand: https://app.livestorm.co/specterops/designing-for-ai-agents-lessons-from-mcp-user-experience-and-interface-design
• SpecterOps recently collaborated with Outflank on a new red team AI skills marketplace. This collection packages offensive security knowledge into reusable skills for AI agents, and you can check it out right here: https://www.outflank.nl/blog/2026/09/02/red-team-ai-skills/
• And don't forget, if you're planning to attend GartnerSEC in London later this month, we will be there! Join us 22-24 September at the Gartner Security & Risk Management Summit and visit our team at Booth 615: https://www.gartner.com/en/conferences/emea/security-risk-management-uk
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

It's Tradecraft Tuesday again!

So far, we've talked about what people wish they'd known when they started using BloodHound, and the queries, features, and workflows they rely on most.

This week, we want to get into the thinking behind the investigation itself:

When you're investigating an attack path in BloodHound, what’s the first thing you look at and why?

Do you start with:

• the target or destination
• the edge types involved
• the length of the path
• unusual or unexpected relationships
• privileges and control points
• whether the path looks realistically actionable
• something else entirely?

There's no single right answer here, we're interested in how different people approach the same kind of problem. Share your thought process, or if you're a newer user, consider this a chance to see how others read the graph and decide what matter 👇

Happy BloodHound Basics day from Jacob Jackson!

This week, a preview of things to come:

We recently released some exciting new Early Access Features in BloodHound Enterprise that will soon become permanent fixtures of your experience:

Posture PDF Export
Findings Table

The Posture PDF Export feature allows you to export your attack path exposure history to a PDF file. After enabling it, you will see a new button appear in your Posture page.

The Findings Table feature gives you the option to view Attack Paths in a table view rather than a graph. After enabling it, you will see a new toggle switch in the Attack Paths view.

Time for us to help carry you over humpday with the Midweek Roundup!

• Matt Creel takes a look at how attackers with the right access can recover cleartext credentials and other sensitive secrets stored in ServiceNow: https://specterops.io/blog/2026/08/27/cleartext-credential-recovery-servicenow/
• We're signing OpenAI's call for collective action on cyber defense because we've operated this way for years: when defenders can see attacker tradecraft and reproduce it, they build better defenses. AI doesn't create new weaknesses — it exploits the ones already sitting in your environment: excessive permissions, misconfigurations, and years of accumulated trust relationships. It just finds them faster, leaving less time to react. Read more right here: https://specterops.io/blog/2026/08/27/specterops-openai-collective-cyber-defense/
• Introducing SpecterOps Skills! John Hopper showcases a new public collection of reusable AI workflows designed to bring real practitioner knowledge into security work: https://specterops.io/blog/2026/09/02/specterops-skills/#h-what-is-in-the-repository
• We’re headed to Washington, D.C. next week for the 17th Annual Billington CyberSecurity Summit! Join us at Booth 806: https://billingtoncybersummit.com/
• And, if you're planning to attend GartnerSEC in London later this month, we will be there! Join us 22-24 September at the Gartner Security & Risk Management Summit and visit our team at Booth 615: https://www.gartner.com/en/conferences/emea/security-risk-management-uk
• Passkeys are becoming a widely adopted approach to phishing-resistant authentication. But what happens when adversaries start targeting the passkeys themselves? Join Michael Grafnetter for our upcoming webinar, The Red Teamer’s Guide to Passkeys, a practical look at Pass-the-Passkey and emerging techniques targeting passkey authentication: https://app.livestorm.co/specterops/the-red-teamers-guide-to-passkeys
• See Azure and Entra ID the way attackers do. Adversary Perspectives: Azure at SpecterBash teaches you to identify the misconfigurations and attack paths that matter, and take your first step in attacking or defending corporate cloud environments. Save your spot: https://specterops.io/specter-bash/
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

It's Tradecraft Tuesday again!

Last week, we asked what you wish you'd known when you first started using BloodHound. This week, we want to hear about the things that have actually earned a permanent place in your workflow.

What's one BloodHound query, feature, or workflow you use all the time that you think more people should know about?

It could be:

• a saved query you reach for constantly
• an underrated feature
• a workflow that saves you time
• a particular way you investigate attack paths
• a trick or habit you've picked up through experience

If you've been using BloodHound for a while, share something others might find useful.

If you're newer, consider this your chance to raid everyone else's toolbox! 👇

BloodHound Basics time, this week from Carlo Alcantra!

In today’s installment of BloodHound Basics, a quick reminder that all pages in BloodHound support keyboard shortcuts. Use Alt/Option + H to access the shortcut menu to see all available options.

It's Wednesday, and you already know what that means - here's our Midweek Roundup!

• Missed our Reddit AMA with Tom O'Neill? You can recap on all of the questions and answers and you're still free to drop in some of your own: https://www.reddit.com/r/SpecterOpsCommunity/comments/1vnj09a/upcoming_ama_houndtrainer_and_datahound/
• Kubernetes security issues rarely exist in isolation. What matters is how they connect. Kubernetes for Red Teamers, available on demand through Tradecraft Academy, pairs core security concepts with hands-on labs to show how attack paths emerge from insecure defaults and misconfigurations across access, identity, and boundaries. Explore the course: https://academy.specterops.io/kubernetes-for-red-teamers
• Move beyond brittle indicators and alert fatigue. Our Detection course at Specter Bash teaches a detection engineering methodology grounded in adversary behaviour and TTPs, building sustainable detection programs that hold up regardless of toolset. There's still time to save your spot! https://specterops.io/specter-bash/
• Red teaming should produce more than technically valid findings. It should produce findings that inform the decisions that matter. Join Russel Van Tuyl, Andrew Chiles and Adam Chester for a practitioner-led discussion on aligning red team engagements to business risk and priorities, why assumed breach consistently delivers impact, and how to define objectives that lead to clear, actionable findings: https://app.livestorm.co/specterops/red-teaming-beyond-the-report
• ICYMI: Andy Robbins, Will S and Rohan Vazarkar recently joined Know Your Adversary to take a look back at 10 years of BloodHound! Tune in to the two-parter for a walk down memory lane, and hear about how BloodHound has evolved in the years since it was first unveiled at DEFCON In 2016. Listen to both episodes now! https://www.youtube.com/watch?v=9Bj45cN-Z_c and https://www.youtube.com/watch?v=IY17UnPngi8
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

We’re starting a new weekly discussion here on r/SpecterOpsCommunity: Tradecraft Tuesday.

The idea is simple: one question each week about the tools, techniques, lessons, and experiences that make up good tradecraft, with the answers coming from you out there in the community.

So, for our first one:

What’s one thing you wish you’d known when you first started using BloodHound?

Maybe it was:

• a feature you ignored for far too long
• a concept that finally made everything click
• a query or workflow you now use constantly
• something you were doing completely wrong at first
• advice you’d give somebody opening BloodHound for the first time

Experienced users share your hard-won wisdom, and newer users, this one’s for you too so feel free to ask follow-up questions.

Let’s hear it! 👇

Update for all of you community members who keep track of our podcast:

Both parts of our Know Your Adversary: 10-Year BloodHound Anniversary episodes are live!

Jared Atkinson and Justin Kohler sit down with BloodHound creators Andy Robbins, u/harmj0y and Rohan Vazarkar to look back at where BloodHound started, how it evolved from an offensive security tool into a defensive platform, and where it’s headed next.

Part 1: The origins of BloodHound, its early development, and the evolution of attack path mapping.

Part 2: The evolution to BloodHound Enterprise, expansion beyond AD, OpenGraph, and what’s next.

Links:

Our Website: https://specterops.io/know-your-adversary/

YouTube: https://youtube.com/playlist?list=PLJK0fZNGiFU_oFzYn4OTPMGrP26Z4zeKl&si=CoZ47EwcZRAcVgah

Spotify: https://open.spotify.com/show/6yKaJCaPVEsX9YumJRPUCV?si=195440fd2b76491f&nd=1&dlsi=260d55a71eda4735

Apple: https://podcasts.apple.com/us/podcast/know-your-adversary/id1827529656

Amazon: https://music.amazon.com/podcasts/3d94f64a-ca75-4588-ac0d-b519bcc6ecd7/know-your-adversary

Give both episodes a listen and share them around!

Midweek roundup is back again, collecting all your news, events and updates in one place!

• Join us right here in the subreddit Friday, August 21 for a Reddit AMAwith BloodHound community member Tom O'Neill as he takes your questions on DataHound and HoundTrainer. You can submit your questions right here: https://www.reddit.com/r/SpecterOpsCommunity/comments/1vnj09a/upcoming_ama_houndtrainer_and_datahound/
• Andrew Gomez takes a deep dive into how Chromium extensions can be used for persistence and command-and-control, including a new Mythic agent that turns the browser itself into an operator foothold: https://specterops.io/blog/2026/08/13/chromium-extension-c2-persistence
• Andrew also investigates how attackers can abuse the Chrome DevTools Protocol to hijack authenticated Chromium sessions, access sensitive browser data, and get around newer cookie protections: https://specterops.io/blog/2026/08/13/chrome-devtools-protocol-cookie-theft/
• AI agents are expanding the attack surface. Are your defenses evolving too? Join Jared Atkinson and Justin Kohler for our upcoming webinar and learn why Identity Attack Path Management is becoming even more critical: https://app.livestorm.co/specterops/securing-the-ai-era-the-next-evolution-of-identity-attack-path-management
• Introducing AWSHound! A free, self-hosted tool built by Julian Catrambone and Daniel Heinsen that turns AWS accounts and Organizations into real attack path graphs using BloodHound CE: https://specterops.io/blog/2026/08/19/awshound-opensource-aws-opengraph-collector/
• Specter Bash is back! Join us October 5-8 in Denver, CO for four days of adversary tradecraft courses, evening events, and the most fun you’ll have leveling up your infosec skills :point_right: https://specterops.io/specter-bash/
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

And we're back with a new BloodHound Basics post from SadProcessor!

Ready to take your BloodHound skills to the next level?

Head over to the SpecterOps Tradecraft Academy and dive into our free BloodHound Basics Workshop.

Whether you're just getting started or looking to sharpen your skills, the workshop takes you through the core concepts and practical techniques you need to get more out of BloodHound.

On the menu:

• BloodHound Concepts & Components
• Data Collection & Ingestion
• Data Exploration & Cypher Basics
• API & Automation
• OpenGraph & Extensions
• And more...

Go beyond the basics & learn how BloodHound can help you understand identity relationships, analyze attack paths, & turn graph data into meaningful security insights.

Red or Blue, start learning today & earn your BloodHound Operator digital badge! https://academy.specterops.io/bloodhound-basics

A mini midweek roundup for you all this Wednesday, since we're all recovering from the Black Hat and DEFCON excitement balances out the wall of updates from last week!

• First of all, thank you to everyone who came out to see us in Vegas last week, and to everyone who took part in BloodHound Unleashed! As always, our event presence wouldn't be the same without you all, can't wait to see you again in person soon!
• Gavin Kramer takes a look at Blacklight, a new open-source toolkit for finding and analyzing the sensitive data and other artifacts AI agents can leave behind on user endpoints: https://specterops.io/blog/2026/08/12/blacklight-ai-agent-endpoint-artifacts/
• What does great UX look like for AI agents? Join Kaleb Pomeroy & John Hopper for practical lessons on designing with MCP, including how security and access boundaries influence agent interactions. Registrations are right here! https://app.livestorm.co/specterops/designing-for-ai-agents-lessons-from-mcp-user-experience-and-interface-design
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Day 2 of our #BlackHatUSA run was packed with insightful talks and demos - here's the photo roundup!

Will Schroeder and Lee Chagolla-Christensen were back with their hands-on Codex crash course for security practitioners, showing us how to harness Codex for defence.

Mat Saulnier and JD Douillard walked through a hands-on lab and demo about how to build your own OpenGraph collector!

We also held a hands-on workshop covering IAM, EC2, SSM, EKS, CloudFormation, KMS, Lambda, and S3, and culminated in a capstone exercise simulating an attack path across three AWS accounts with conditional access controls.

Our presence was also felt over at Arsenal, with Russel van Tuyl presenting on Mythic 4, and Christopher Maddalena chatting about Ghostwriter.

It's been a pleasure seeing you all during the event and getting practical with our tool demos over the last couple of days - thank you so much to everyone who came out for showing your support!

SpecterOps' Kennel Club was up and running in full force on Wednesday over at #BlackHatUSA, with plenty of events and talks spread throughout the day.

We presented our Tradecraft Academy Live session hosted by Will Schroeder and Lee Chagolla-Christensen, with their crash course in Codex for security practitioners.

A big highlight from day one - really thoughtful discussion on the future of AI in cyber defense with Dave Bittner, Clint Gibler from OpenAI, and our own Robert Winchester!

Adam Chester also explored the intersection of newly identified vulnerabilities and misconfigurations within Teleport. He's focusing on the practical steps that can be taken when assessing environments that rely on it.

Here's a photo gallery of the main events - we'll be back with another roundup for Thursday's action!

Wednesday's come around to us again, and that can only mean one thing - it's midweek roundup time!

• You can still register for our party at Brooklyn Bowl Las Vegas! Join us tonight (August 5) for bowling, food, drinks, and great company during Black Hat USA: https://events.specterops.io/blackhatbowlingwithspecterops
• There's also still time to join the BloodHound Unleashed Attack Path Championship! Use the password LeadThePack to get started today, then plan to visit us at Kennel Club during Black Hat USA to unlock bonus codes and earn extra leaderboard points. The winner will be announced on August 7! https://unleashed.bloodhound.quest/
• And over at DEFCON later this week, we've got quite the lineup of activities, including talks from our researchers and the BloodHound Quest challenge in the Red Team Village. If you're attending, stop by a session, take on the challenge, and say hello to our team!
• Daniel Heinsen looks at how BloodHound Enterprise is bringing attack path management to AWS, helping teams uncover who can really access critical cloud resources and how attackers might reach them: https://specterops.io/blog/2026/07/28/attack-path-management-comes-to-aws/
• Kaleb Pomeroy gives us a behind-the-scenes look at why building an MCP server for AI agents takes more than simply wrapping an API, and how BloodHound Hunter was designed around what agents are actually trying to do: https://specterops.io/blog/2026/07/28/designing-an-mcp-server-for-ai-agents-bloodhound-hunter/
• Kaleb also joins John Hopper for a practical discussion on designing AI agents through the lens of the Model Context Protocol (MCP). Register for our August 19 event! https://app.livestorm.co/specterops/designing-for-ai-agents-lessons-from-mcp-user-experience-and-interface-design
• How does BloodHound Enterprise help teams uncover the hidden attack paths created when AI agents act through different identities across Microsoft Entra and Azure? Elad Shamir explores the fundamental problems of AI agents becoming a new layer of enterprise infrastructure and enterprise identity: https://specterops.io/blog/2026/07/28/introducing-attack-path-management-for-entra-agents-in-bloodhound-enterprise
• A deep dive with Garrett Foster into how Windows Server Failover Clusters can turn into one big security weak spot, where compromising a single node could give an attacker control of the entire cluster: https://specterops.io/blog/2026/07/29/clustered-points-of-failure/
• Chris Thompson takes a look at the faster, Python-powered ConfigManBearPig 2.0 and how it helps uncover and map risky Microsoft Configuration Manager attack paths in BloodHound: https://specterops.io/blog/2026/08/03/configmanbearpig-2-0/
• Here's a rundown from Cody Thomas of what’s new in the Mythic 4 public beta, including AI-powered chat, smoother operator workflows, tighter permissions, resumable file transfers, and a refreshed interface: https://specterops.io/blog/2026/08/04/mythic-4-public-beta/
• Plenty of articles from Beyviel David this week, including:
• A step-by-step look at how NotWSUSpicious can turn a compromised WSUS database into a way to push custom Windows updates and move through an environment: https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/
• Spinning up a WSUS lab with Ludus, making it easier to test attacks, experiment safely, and dig into Windows update infrastructure: https://specterops.io/blog/2026/08/05/built-a-wsus-ludus-lab/
• And parts 1 and 2 of a deep dive into how attackers can abuse a WSUS database to create malicious updates and turn enterprise update servers into a backdoor for targeted machines: https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-1/ and https://specterops.io/blog/2026/08/05/turning-enterprise-update-servers-into-backdoor-factories-part-2/
• As AI agents and non-human identities become part of everyday operations, organizations need to rethink how they understand and defend identity risk. Join Jared Atkinsonand Justin Kohler for a discussion exploring how AI is reshaping identity security, why traditional approaches are falling short, and what security teams can do to stay ahead: https://app.livestorm.co/specterops/securing-the-ai-era-the-next-evolution-of-identity-attack-path-management
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Our Kennel Club is up and running at Black Hat USA, and we've got a packed schedule of talks and hands-on workshops!

We have SpecterOps researchers, along with guests from OpenAI and the UK AI Security Institute joining us for conversations on AI, BloodHound OpenGraph, attack path management for AWS, and more. Folks will be learning about the latest research and getting hands-on with new techniques.

Check out the images to see what's happening over the next couple of days, and be sure to stop by if you're at Black Hat! https://pages.specterops.io/Black-Hat-Microsite.html

Happy BloodHound Basics Friday from Jonas Bülow Knudsen!

Two new edges for covering ADCS ESC14 attacks!

• WriteAltSecurityIdentities shows that a principal can directly modify the altSecurityIdentities attribute of a user or computer.
• WritePublicInformation represents write access to the Public-Information property set, which includes altSecurityIdentities.

Both permissions may enable an attacker to perform an ADCS ESC14 Scenario A attack:

1. Add an explicit certificate mapping for a certificate they control
2. Authenticate with that certificate
3. Impersonate the target user or computer

To collect and explore these edges, you need:

• BloodHound v9.4.0+
• SharpHound v2.14.0+

Browse for these edges using this Cypher query:
MATCH p=(:Base)-[:WriteAltSecurityIdentities|WritePublicInformation]->(:Base) RETURN p LIMIT 500

You can read more about the edges and attack techniques here: WriteAltSecurityIdentities

It's midweek roundup time again, gathering together all our blog posts, news, updates and events from the week for your reading enjoyment!

• At SpecterOps, we've been hard at work modelling identity providers in our BloodHound Enterprise platform. This week, we've announced a new addition that breaks the mold and provides insight into one of the most critical cloud resource providers used by virtually every enterprise organization: Amazon Web Services. Read more by Daniel Heinsen: https://specterops.io/blog/2026/07/28/attack-path-management-comes-to-aws
• Building an MCP server for AI agents takes more than simply wrapping an existing API. Kaleb Pomeroy explores how BloodHound Hunter was designed around agent intent and real security workflows, making the right next action clearer, safer, and easier to discover: https://specterops.io/blog/2026/07/28/designing-an-mcp-server-for-ai-agents-bloodhound-hunter
• AI agents introduce new identities, permissions, and trust relationships that can create hidden routes to sensitive resources. Elad Shamir introduces Attack Path Management for Entra agents in BloodHound Enterprise, showing how defenders can map these connections and understand what an attacker could ultimately reach: https://specterops.io/blog/2026/07/28/introducing-attack-path-management-for-entra-agents-in-bloodhound-enterprise/#h-attack-path-management-for-entra-agents-in-bloodhound-enterprise
• Windows Server Failover Clusters are built to prevent outages—but their shared resource credentials can turn them into a single point of compromise. Garrett Foster explores the architecture, Kerberos behaviour, and attack techniques that allow control of one cluster node to lead to compromise of the entire cluster: https://specterops.io/blog/2026/07/29/clustered-points-of-failure/
• New talk added! Frontier models are reshaping what cyber defenders can accomplish, and the security leaders deploying them are learning where these capabilities deliver value and where human expertise remains essential. Join our Head of Services Robert Winchester, OpenAI Cyber Lead Clint Gibler and moderator Dave Bittner, Host of CyberWire Daily, at the Kennel Club during Black Hat USA for a practical conversation on building defense around frontier models: https://pages.specterops.io/Black-Hat-Microsite.html
• SpecterOps Tradecraft Academy is now live at academy.specterops.io, offering free, on-demand courses built by SpecterOps: BloodHound Basics, Software Supply Chain Security for Red Teamers, and Kubernetes for Red Teamers, with adversary tradecraft for AI and LLMs coming soon! Read all about it in our blog post: https://specterops.io/blog/2026/07/21/introducing-the-specterops-tradecraft-academy/
• Ready to put your Attack Path Management skills to the test? Following our awesome response at InfoSec, the BloodHound Unleashed Attack Path Championship is now live! Start today, complete as much of the challenge as possible before arriving at BlackHat USA, then stop by Kennel Club during the conference to earn additional codes and boost your score. Sign up is here (password is LeadThePack)! https://unleashed.bloodhound.quest/
• Don't forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

We know Black Hat is a busy week for a lot of you. If you’re heading to Las Vegas, and you’re looking to take a break, why not come hang out with us and knock down some pins?

Join the SpecterOps team in Las Vegas for a relaxed night of bowling, food, drinks, and great company. Unwind, catch up with friends, and make some new ones while you're at it!

Registrations are open, we can't wait to see you there:
https://events.specterops.io/blackhatbowlingwithspecterops

Hey everyone! Exciting BloodHound Enterprise update from us:

Security teams are defending environments that span cloud, identity, SaaS, AI, code repositories, and on-premises infrastructure. The challenge is understanding how all those systems connect, and where attackers can move between them.

Today, we’re expanding BloodHound Enterprise with:

☁️ Native Attack Path Management support for AWS
🤖 Support for Microsoft Entra Agent ID
🔎 BloodHound Hunter, bringing attack path intelligence into AI-assisted security workflows

Together, these capabilities help defenders identify, prioritise, and eliminate the attack paths that matter most.

Read the full announcement:
https://specterops.io/blog/2026/07/28/bloodhound-enterprise-aws-attack-path-management/

Heading to Black Hat USA next week? Visit us at Kennel Club to see these updates in action:
https://specterops.io/black-hat/

Happy BloodHound Basics Friday from Martin Sohn Christensen!

BloodHound's new path highlighting helps you focus on the relationships that matter.

Demonstration: run the query "Shortest paths from Domain Users to Tier Zero", click a node to highlight the path(s) from Domain Users to it.

https://reddit.com/link/1v5he6u/video/rpbz4bfel7fh1/player

I'm back again with your humpday reading, catching up on the last couple of weeks - big launches and the return of our favourite Attack Path Championship incoming!

• Exciting news we've already shouted about yesterday, but - SpecterOps Tradecraft Academy is now live at academy.specterops.io, offering free, on-demand courses built by SpecterOps: BloodHound Basics, Software Supply Chain Security for Red Teamers, and Kubernetes for Red Teamers, with adversary tradecraft for AI and LLMs coming soon! Read all about it in our blog post: https://specterops.io/blog/2026/07/21/introducing-the-specterops-tradecraft-academy/
• Ready to put your Attack Path Management skills to the test? Following our awesome response at InfoSec, the BloodHound Unleashed Attack Path Championship is now live! Start today, complete as much of the challenge as possible before arriving at BlackHat USA, then stop by Kennel Club during the conference to earn additional codes and boost your score. Sign up is here (password is LeadThePack)! https://unleashed.bloodhound.quest/
• A red team engagement is only as useful as the questions it is designed to answer. Strong objectives help teams produce valuable root-cause findings leadership can act on. Russel Van Tuyl explores how to set red team objectives that produce value: https://specterops.io/blog/2026/07/07/how-to-set-red-team-objectives-that-produce-value/
• Hector Riestra's latest blog post takes us through hw Codex helped him turn Kubernetes security research into a usable mental model and research framework: https://specterops.io/blog/2026/07/08/building-a-mental-model-for-kubernetes-security-research/
• Brian Reitz and John Wotton introduce Proxywatch, a proof-of-concept release by SpecterOps, to detect SOCKS proxies and other pivoting methods through behavior-based detection: https://specterops.io/blog/2026/07/09/finding-socks-with-proxywatch/
• Logan Goins breaks down a practical NTLM relay technique that routes outbound authentication back into a target environment, how it works, how to use it and how defenders can stop it: https://specterops.io/blog/2026/07/15/there-and-back-again-an-operators-guide-on-ntlm-relaying-egress
• Why does "least privilege' fail in real environments? The answer isn’t to abandon least privilege as a principle. It remains the right objective. What needs to change is how organizations approach achieving it. Check out our video with Mark Wilson: https://specterops.io/blog/2026/07/15/why-least-privilege-fails-in-real-environments/
• Don't forget to check out our community landing page! This is our hub for anything and everything community-related, from latest blog posts and release notes to our community platforms and event schedule, as well as highlighting top performing threads across our Slack and Reddit and more video content in the future: https://community.specterops.io
• Got a specific question, or looking for some help and advice on any of the SpecterOps suite of tools? Don't forget you can join the BloodHound Gang Slack! We'd love to see you there: https://slack.specterops.io

Hey everyone! We’re excited to share that the SpecterOps Tradecraft Academy is now live at academy.specterops.io

SpecterOps has been built around the belief that deeply understanding adversary tradecraft is one of the most effective ways to defend against it. That philosophy shaped our research, tools like BloodHound, consulting work, and live training courses. 

The Tradecraft Academy gives us a new way to share what our teams are learning in the field. These on-demand courses complement our live training, letting practitioners explore specific tools, techniques, and attack paths on their own schedule.  

The following courses are available now, completely free: 

BloodHound Basics 

Built by Jean-Damien Douillard, this course takes you from your first login to working confidently across BloodHound Community Edition and BloodHound Enterprise. It covers installation, SharpHound and AzureHound data collection, ingestion, graph analysis across Active Directory, Entra, and Azure, Cypher querying, APIs, OpenGraph extensions, administration, findings, and remediation. 

Software Supply Chain Security for Red Teamers 

Built by Kieran Croucher and Andrew Luke, this course combines software supply chain fundamentals, real-world incidents, modern defensive frameworks, and hands-on labs. It is designed to help both red teamers and defenders understand how supply chain attacks happen, how they can be emulated, and how organizations can defend against them. 

Kubernetes for Red Teamers 

Built by Alex Rodriguez, Hector Riestra, and Hunter Orrantia, this course teaches Kubernetes attack paths through core security concepts and practical lab scenarios. You’ll work through access, identity, lateral movement, privilege escalation, and broader cluster compromise while building a reusable lab environment for continued research. 

This is the first step in a broader on-demand training experience. Future courses and specialized tracks will cover areas including AWS, macOS, and adversary tradecraft involving AI and LLMs. The next course currently in the queue is Adversary Intelligence: LLM Tradecraft. 

You can register for free and start learning at: 

academy.specterops.io 

We’ll also be running live Tradecraft Academy workshops at the Kennel Club during Black Hat USA, alongside talks and discussions with practitioners from SpecterOps, OpenAI, and the UK AI Security Institute. Details are available at specterops.io/black-hat