Andy Robbins
@_wald0
Co-founder of SpecterOps. Co-creator of BloodHound. https://bsky.app/profile/andyrobbins.bsky.social
I have just released my first tool : GPOHound 🚀 GPOHound is an offensive tool for dumping and analysing GPOs. It leverages BloodHound data and enriches it with insights extracted from the analysis. 🔗Check it out here: github.com/cogiceo/GPOHou…
We are BACK with another #BloodHoundBasics post, this week courtesy of @_wald0. ICYMI: The BloodHound BACK button is BACK. Just use your browser's BACK button to go BACK. 🔙
Introducing a new tool designed to help you install & manage BloodHound instances...🥁 BloodHound CLI! Check out @cmaddalena's blog post to learn how this tool dramatically simplifies installation and server management. ghst.ly/40zXAxI
Make Bloodhound Cool Again: Migrating Custom Queries from Legacy BloodHound to BloodHound CE by link.medium.com/z0KOxdSSUPb
A new fun way to set shadow credentials posts.specterops.io/attacking-entr…
Excited to share a tool I've been working on - ShadowHound. ShadowHound is a PowerShell alternative to SharpHound for Active Directory enumeration, using native PowerShell or ADModule (ADWS). As a bonus I also talk about some MDI detections and how to avoid them
A quick tour of new functions in BARK that support Azure Key Vault tradecraft research, including a walk-through of how an adversary may chain these functions together as part of an attack path: posts.specterops.io/azure-key-vaul…
Have you read about all the Active Directory Certificate Services (AD CS) 🔐attack paths but never tried them out? @bradyjmcl has updated the ludus_adcs role to enable ESC1,2,3,4,5,6,7,8,9,11,13 and 15 attack paths in your lab! Easy 3 step guide here: docs.ludus.cloud/docs/environme…
I couldn't find any PowerShell examples of encrypting/decrypting data w/ Azure Key Vault keys, so I made some: Protect-StringWithAzureKeyVaultKey Unprotect-StringWithAzureKeyVaultKey github.com/BloodHoundAD/B… Explanatory blog post coming soon.
The PowerHuntShares v2 update now includes: interesting files, password extraction, and LLM fingerprinting! Check it out & give me some feedback! netspi.com/blog/technical…
GraphRunner is so handy! I know it's been out for a minute, but if you do pentests that involve Azure and haven't tried it, you're doing yourself a disservice. Great work by @rvrsh3ll and @dafthack ! github.com/dafthack/Graph…
I’ve always thought Seatbelt was a great situational awareness tool, I created a python implementation of it. Due to the nature of how I expect it to run, it only implements the remote modules, but I hope someone finds it useful. github.com/0xthirteen/Car…
The #SOCON2025 CFP closes Friday, November 15: sessionize.com/socon-2025
Happy #BloodHoundBasics Day! 🐶 BloodHound's Cypher supports Regex with the =~ operator. Regex enables precisely matching principals and attack paths. For example, the Microsoft Entra Connect account's name, commonly known as "MSOL", is found with the pattern: MSOL_[0-9A-F]+@.*
Just published a new video 👇 Are you leaving your Microsoft Graph tokens unprotected?
Want to move laterally from C2 on an Intune admin's workstation to any Intune-enrolled device? Check out Maestro (github.com/Mayyhem/Maestro), a new(ish) tool I wrote for those situations, and this blog post to walk you through how: posts.specterops.io/maestro-9ed71d…