Garrett
@unsigned_sh0rt
Followers
2K
Following
3K
Media
156
Statuses
1K
Research at @SpecterOps
Portland, OR
Joined August 2009
Non-infosec post this time. I try to stray away from talking about my personal life here as much as I can especially when it comes to my family. In November 2023 my son Oliver was diagnosed with level 3 Autism Spectrum Disorder.
3
7
38
The Azure AD Broker plays a key role in Entra ID sign-in & token handling, but how well do we really understand it? @winternl_t unpacks its on-disk cache, how to decode it, & the security implications. š
specterops.io
This post documents the AAD Broker's storage format, how to unpack it, and discusses potential security implications.
1
34
100
Thank you all for helping her make this happen
She's started a fundraiser in his honor to help give back to the community that has supported him so much. I want to support her every way I can. Please consider sharing and/ or donating for autism research!
1
0
15
AdminSDHolder is kinda my jam. I wrote the e-book on it. If you work with Activity Directory, I highly recommend you give this a skim, or at least check the spoilers in the blog.
AdminSDHolder: the AD security feature everyone thinks they understand but probably don't. š¬ @JimSycurity went to the source code to debunk decades of misconceptions ā including ones in Microsoft's own docs. Read more ā¤µļø https://t.co/Vo9XksEfmn
2
34
192
Microsoft (kinda) deprecated DES in SCCM which caused some of the policy related tradecraft to break. The HTTP module in SCCMHunter and mssqlkaren have been updated to support AES-256. Thanks to @Blurbdust for helping get the fix into pxethief (which I stole from, ofc).
1
11
40
I have released an OpenGraph collector for network shares and my first blogpost at @SpecterOps on the subject! You can now visualize attack paths to network shares in BloodHound š https://t.co/2e2DBIndcU
specterops.io
ShareHound is an OpenGraph collector for BloodHound CE and BloodHound Enterprise helping identify attack paths to network shares automatically.
3
91
219
We have a AMA from @anyrun_app currently talking malware in /r/redteamsec if you want to join the conversation -
reddit.com
Explore this post and more from the redteamsec community
2
4
22
Maybe itās time to setup those terabytes of netntlmv1 rainbow tables https://t.co/NoCdsvJw8N
0
0
6
This is so sick @bytewreck
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ā¤µļø
0
1
15
Credential Guard was supposed to end credential dumping. It didn't. @bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled. Read for more ā¤µļø
specterops.io
Uncovering the protection mechanisms provided by modern Windows security features and identifying new methods for credential dumping.
4
308
651
Ludus is so useful and makes it easy to just deploy infra for whatever random shower thought I have. But it's gotten to the point that I need asset management for my lab environments.
3
4
47
I feel like @YuG0rd's briefly mentioned new dMSA account takeover mechanism in his last blog didn't get enough attention. A new account takeover mechanism is on the horizon. I wrote a blog detailing it, releasing with a new BOF I wrote called BadTakeover https://t.co/fyUkDYKAeP
specterops.io
After Microsoft patched Yuval Gordonās BadSuccessor privilege escalation technique, BadSuccessor returned with another blog from Yuval, briefly mentioning to the community that attackers can still...
3
44
106
Check out my new blog post diving deeper into BroCI.
Microsoft introduced nested application auth (NAA) in 2024. Researchers spotted FOCI similarities & dubbed it brokered client IDs (BroCI). @Icemoonhsv documents NAA flows and BroCIāfilling a gap for research on Microsoft identity protocols.
1
10
26
Ever been on an SCCM site server and *this* close to a DA pw that you couldn't decrypt for some reason? Check out my new blog looking at encryption in use within SCCM sites configured for High Availability and accompanying tooling to recover passwords:
ibm.com
Follow IBM X-Force as they work out the secrets to decrypting credentials vaulted by Microsoftās System Center Configuration Manager (SCCM).
3
59
140
We'll be in London in December to teach Adversary Tactics: Identity-Driven Offensive Tradecraft at @BlackHatEvents Europe. This course will teach you to identify new attack paths and learn the internals of and how to execute modern tradecraft.
Identity = the new attack surface. Our Identity-driven Offensive Tradecraft course teaches you to exploit auth mechanisms, cross tenants, and forge attack paths in hybrid environments. Save your spot in this course at #BHEU. Register today! https://t.co/fOhMia1IAC
1
1
4