{ "id": "57953678-f485-47a1-b59f-4f6067e9f46a", "created_at": "2026-04-06T01:29:20.961167Z", "updated_at": "2026-04-10T03:21:58.736602Z", "deleted_at": null, "sha1_hash": "b9c58dbc5da19b5c4964172ee3afd8092d291643", "title": "Blog - SpecterOps", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 1554833, "plain_text": "SpecterOps Blog\r\nFilters\r\nSearch Blog\r\nRESEARCH \u0026 TRADECRAFT\r\nghostsurf: From NTLM Relay to Browser Session Hijacking\r\nTL;DR: ntlmrelayx‘s SOCKS proxy works great for SMB and MSSQL but fails when you try to browse a web application…\r\nBy: Allen DeMoura 17 mins\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 1 of 7\n\nRESEARCH \u0026 TRADECRAFT\r\nLudus SCCM Lab Expansion\r\nTL;DR : While writing ConfigManBearPig, a PowerShell script that enables collection of SCCM-related attack paths for visualization in\r\nBloodHound, I…\r\nBy: Chris Thompson 6 mins\r\nBLOODHOUND\r\nExpanding Attack Path Management to macOS Environments\r\nIntroduction Attack path management has historically focused on identity systems like Active Directory and Entra ID. That focus made\r\nsense.…\r\nBy: Jared Atkinson 11 mins\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 2 of 7\n\nRESEARCH \u0026 TRADECRAFT\r\nJamfHound v1.1 Update: SSO Attack Paths and Okta Additions\r\nTL;DR : New SSO Attack Paths and Okta Edges in JamfHound: Updates have been added to the JamfHound OpenGraph collector…\r\nBy: Lance B. Cain 10 mins\r\nRESEARCH \u0026 TRADECRAFT\r\nLeveling Up Secure Code Reviews with Claude Code\r\nTL;DR: Claude Code is a force multiplier when performing secure code reviews during an assessment. In this post, we discuss…\r\nBy: Andrew Luke 18 mins\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 3 of 7\n\nRESEARCH \u0026 TRADECRAFT\r\nAttack Paths Don’t Stop at Identity Providers\r\nModeling Okta in BloodHound Enterprise to uncover cross-platform identity risk Introduction Identity is no longer confined to a single\r\nsystem.…\r\nBy: Jared Atkinson 10 mins\r\nRESEARCH \u0026 TRADECRAFT\r\nRTFM: Read The Fatal Manual – When Vendor Documentation Creates Critical Attack Paths\r\nTL;DR: Trusted vendor documentation across 16 major technology companies were actively guiding administrators to deploy critical\r\nmisconfigurations (often Active Directory…\r\nBy: Martin Sohn Christensen 55 mins\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 4 of 7\n\nBLOODHOUND\r\nDiscovering Unexpected Okta Attack Paths with BloodHound\r\nTL;DR: OktaHound is a new data collector for the Okta Platform that ingests information about entities and their relationships within…\r\nBy: Michael Grafnetter 15 mins\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 5 of 7\n\nPage 1 / 56\r\nBLOODHOUND\r\nGraph the Planet: Shai-Hulud 2.0\r\nTL;DR: This blog looks at the Shai-Hulud 2.0 worm through an Attack Path Management lens. I also introduce NPMHound which…\r\nBy: JD Crandell 7 mins\r\nEmail:\r\nSubmit\r\nPlatform\r\nBloodHound Enterprise\r\nBloodHound Community Edition\r\nServices and Tradecraft\r\nOffensive Services\r\nTRAINING\r\nRed Team Operations\r\nIdentity-Driven Offensive Tradecraft\r\nDetection\r\nTradecraft Analysis\r\nActive Directory\r\nAzure\r\nSolutions\r\nSOLUTIONS INDUSTRIES\r\nSign up for the latest updates\r\nEmail* Submit\r\nBy clicking Sign Up you're confirming that you agree with our Terms and Conditions.\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 6 of 7\n\nPrivileged Access Governance and Compliance\r\nEliminate Lateral Movement\r\nManage Identity Risk\r\nSecure Scaling\r\nMergers \u0026 Acquisitions\r\nPublic Sector\r\nHealthcare\r\nFinancial Services\r\nPARTNERS \u0026 INTEGRATIONS\r\nPartners\r\nIntegrations\r\nResources\r\nResearch\r\nBlog\r\nEvents\r\nPodcasts\r\nOpen Source Tools\r\nCompany\r\nWhy SpecterOps\r\nNews\r\nCareers\r\nContact\r\nCopyright 2026 Specter Ops, Inc. All Rights Reserved.\r\nTerms of Service | Privacy Policy | Security | Trust Center | Premera Transparency Files\r\nSpecterOps expands Identity Attack Path Management to Okta, GitHub, and Mac. Learn More\r\nhttps://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d\r\nPage 7 of 7", "extraction_quality": 1, "language": "EN", "sources": [ "MITRE" ], "references": [ "https://posts.specterops.io/death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d" ], "report_names": [ "death-from-above-lateral-movement-from-azure-to-on-prem-ad-d18cb3959d4d" ], "threat_actors": [], "ts_created_at": 1775438960, "ts_updated_at": 1775791318, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/b9c58dbc5da19b5c4964172ee3afd8092d291643.pdf", "text": "https://archive.orkl.eu/b9c58dbc5da19b5c4964172ee3afd8092d291643.txt", "img": "https://archive.orkl.eu/b9c58dbc5da19b5c4964172ee3afd8092d291643.jpg" } }