A Guide to Attacking Domain Trusts

It’s been a while (nearly 2 years) since I wrote a post purely on Active Directory domain trusts. After diving into group scoping, I realized a few subtle misconceptions I previously had concerning trusts and group memberships. That, combined with the changes made to…

F’Awk Yeah! Advanced sed and awk Usage (Parsing for Pentesters 3)

Thoughts on Host-based Detection Techniques

Introduction

A few weeks ago I released a post that described our methodology for creating behavior-based detections for attack techniques chronicled in the MITRE ATT&CK Matrix. I think the concept of what a “detection…

BloodHound 1.4: The Object Properties Update

If you’ve been following the development of BloodHound, you’ll notice that the…

UMCI Bypass Using PSWorkFlowUtility: CVE-2017–0215

SharpHound: Technical Details

In the previous blog post, we focused on SharpHound from an operational perspective, discussing some of the new features, as well as improved features from the original ingestor. In this post, we’ll talk more about the technical and underlying changes made to the ingestor that…

Modern Defenses and YOU!

Part 9 of Advanced Threat Tactics covers a lot of my thoughts on evasion. The ideas in that lecture are still relevant, the defenses discussed there didn’t go away! That said, there are other defenses and realities offensive operators must contend with today. This blog post discusses…