Welcome back to my On Detection: Tactical to Functional series. In the first post in this series, we explored the source code for Mimikatz’s sekurlsa::logonPasswords command. We discovered that…

The BloodHound Enterprise team is proud to announce the release of BloodHound 4.2 — The Azure Refactor.

Part 5: Expanding the Operation Graph

Part 4: Compound Functions

In the previous post in this series, I introduced the concept of operations and demonstrated how each operation has a function call graph that undergirds it. In that post, I purposely presented…

Welcome back to my On Detection: Tactical to Functional series. In the first post in this series, we explored the source code for Mimikatz’s sekurlsa::logonPasswords command. We discovered that…

Beyond COM

Written by Joshua Prager and Emily Leidy

Ghostwriter v3.1 is now available! This release introduces several new features along with a host of minor improvements.

It’s dangerous to defend the registry alone! Take this!

Part 1: TelemetrySource

This post was written by Will Schroeder and Lee Christensen.

Stalking inside of your Chromium Browser Revisiting Remote Debugging Okay, you got your favorite agent running on the target machine. You did a process listing, but nothing interesting popped out …

How Certificate Based Authentication works, passwordless persistence with CBA, passwordless privilege escalation, prevention, detection, and more.

Your new best friend: Introducing BloodHound Community Edition!

In this blog post, we’ll answer the question, “If I compromise a Read-Only Domain Controller, can I compromise the domain?” or, “Do RODCs belong in Tier Zero?”

Introduction