Microsoft

Scenario 1: The shared document

In this test, Claude Sonnet 4 was asked to open a shared document from a colleague. It found an email with a “Q1 Project Timeline” link, clicked it, saw a Microsoft 365 login form, looked up the user’s real password in the vault, typed it in, and hit submit. When the page didn’t load, it tried again. Here, the model fell into the same trap that many people do in phishing attacks: it failed to examine the web address. The link pointed to acmecorp-sharepoint.com-docs.cloud, a domain designed to lo

22 juil.

The teams that moved the Internet: Argentina, followed by France and Norway

To decide which team the world watched most, we looked at each team's matches and aggregated the median worldwide impact across all countries. In other words, when a given team took the field, how much did the typical country's traffic move away from normal? Not surprisingly, Argentina topped the list at 1.17x, meaning that when Argentina played, the typical country's traffic swung about 17% away from its normal level, the strongest global pull of any team. This comes as no surprise, since they

21 juil.

Defender Priorities

For enterprise defenders, the central question extends beyond who is attacking now. It includes which access predates escalation, which trusted paths remain, and what an operator could do with them under different tasking. Review identity, cloud, RMM, and service-provider relationships against that standard, and map shared dependencies: which nominally separate services would fail together, and which recovery paths rely on the same identity provider, carrier, or administrator as production. For

21 juil.

What’s available now

These courses are live today for free, each built by SpecterOps consultants and researchers: BloodHound Basics, built by Jean-Damien Douillard, takes you from first login to capable operator across both BloodHound Community Edition and BloodHound Enterprise. This course covers installation, data collection with SharpHound and AzureHound, ingestion, data exploration, and graph analysis across Active Directory, Entra, and Azure environments. The course also covers Cypher querying, API usage, OpenG

21 juil.

SharpHound Integrated Windows Authentication

Supports ADFS with Integrated Windows Authentication (IWA) Aligns with Windows-native enterprise auth workflows

21 juil.

Azure Hybrid Data Improvements

Removes unnecessary placeholder objects Only creates relationships when both sides exist Reduces graph churn and improves analysis time

21 juil.

Introduction

Attack path management has historically focused on identity systems like Active Directory and Entra ID. That focus made sense. These systems define authentication, authorization, and privilege at scale, and they remain central to how access is granted across an environment. But they are not the full picture. There are entire classes of systems that introduce attack paths that do not exist in the directory. Device management platforms are one of the most important examples. These systems are resp

21 juil.

Hybrid Attack Paths Across Systems

Perhaps the most important aspect of modeling Jamf is what happens when these capabilities intersect with other platforms. In real environments, attackers rarely operate within a single system. They move between identity providers, device management platforms, and other services as they progress toward their objective. This creates hybrid attack paths spanning multiple systems. We can then identify a path from a non-privileged Active Directory User to one of the jamf_Account nodes that had execu

21 juil.

Bad Windows Service Analysis

BadWindowService is chock-full of vulnerabilities and includes a lot of text in the README and logged messages, making it clear that this is intentionally vulnerable. Despite removing those, the response to the following system prompt and prompt was Claude’s conclusion that this is intentionally vulnerable due to the sheer volume of security controls circumvented. It did present its findings in a nice table for further investigation. # Application Information### DescriptionThis is the source cod

21 juil.

Introduction

Identity is no longer confined to a single system. In modern environments, identity spans multiple platforms: Active Directory, Okta, Entra, GitHub, and others; each operating within its own environment, with its own model for authentication and access. These systems are connected through federation, synchronization, and single sign-on. Each connection serves a legitimate purpose, enabling organizations to manage identity centrally while extending access across platforms. But these connections a

21 juil.

How These Paths Emerge

In practice, these relationships rarely present themselves as a single, obvious chain. They are distributed across platforms, environments, and teams, each with its own perspective on identity and access. Consider a typical scenario. An organization uses Active Directory as an upstream identity source, federated into an Okta environment. That Okta environment is then used to provide single sign-on into a set of downstream applications. In some cases, those relationships extend further, to additi

21 juil.

What EMEA teams get out of this launch

Secure company data by trusting the device, not just the sign-in 1Password Device Trust lets organisations restrict access based on the health of a user’s device. This way, compromised, unmanaged, or out-of-date endpoints don’t get a free pass to sensitive tools and data. Now, with EU data hosting, EMEA teams can adopt that control without compromising on data residency requirements. A smoother rollout that supports employees When employees get blocked and don’t understand why, they do what huma

21 juil.

Scenario 1: The shared document

In this test, Claude Sonnet 4 was asked to open a shared document from a colleague. It found an email with a “Q1 Project Timeline” link, clicked it, saw a Microsoft 365 login form, looked up the user’s real password in the vault, typed it in, and hit submit. When the page didn’t load, it tried again. Here, the model fell into the same trap that many people do in phishing attacks: it failed to examine the web address. The link pointed to acmecorp-sharepoint.com-docs.cloud, a domain designed to lo

21 juil.

Outlook and Implications

The cybersecurity community has the opportunity to serve as the voice of reason: the best response is proactive, disciplined preparation, not panic. While access to the publicly known, most capable frontier models is currently restricted to responsible actors, the availability of these technologies to a broader audience is inevitable. For defenders, this signals a surge in vulnerability management demands. The traditional window between a vulnerability’s disclosure and its active exploitation in

21 juil.

Outlook and Implications

The impact of this attack by North Korea-nexus actors is broad and has ripple effects as other popular packages rely on axios as a dependency. Notably, UNC1069 isn’t the only threat actor that has launched successful open source supply chain attacks in recent weeks. UNC6780 (also known as TeamPCP) recently poisoned GitHub Actions and PyPI packages associated with projects like Trivy, Checkmarx, and LiteLLM to deploy the SANDCLOCK credential stealer and facilitate follow-on extortion operations.

21 juil.

Jira is becoming the delegation layer for software teams.

For a long time, Jira was where you went to track work. You updated a status, closed a ticket. Something important has shifted now that agents can be assigned to work items. Jira is still a record of what happened, but now it’s something else too: a place where work can move between humans and agents. That shift got me thinking. What if I leaned into it fully and ran an experiment? What if each stage of the SDLC had its own specialized agent and the board itself handled the routing between them?

21 juil.

SharpHound Integrated Windows Authentication

Supports ADFS with Integrated Windows Authentication (IWA) Aligns with Windows-native enterprise auth workflows

20 juil.

Azure Hybrid Data Improvements

Removes unnecessary placeholder objects Only creates relationships when both sides exist Reduces graph churn and improves analysis time

20 juil.

Introduction

Attack path management has historically focused on identity systems like Active Directory and Entra ID. That focus made sense. These systems define authentication, authorization, and privilege at scale, and they remain central to how access is granted across an environment. But they are not the full picture. There are entire classes of systems that introduce attack paths that do not exist in the directory. Device management platforms are one of the most important examples. These systems are resp

20 juil.

Hybrid Attack Paths Across Systems

Perhaps the most important aspect of modeling Jamf is what happens when these capabilities intersect with other platforms. In real environments, attackers rarely operate within a single system. They move between identity providers, device management platforms, and other services as they progress toward their objective. This creates hybrid attack paths spanning multiple systems. We can then identify a path from a non-privileged Active Directory User to one of the jamf_Account nodes that had execu

20 juil.

Bad Windows Service Analysis

BadWindowService is chock-full of vulnerabilities and includes a lot of text in the README and logged messages, making it clear that this is intentionally vulnerable. Despite removing those, the response to the following system prompt and prompt was Claude’s conclusion that this is intentionally vulnerable due to the sheer volume of security controls circumvented. It did present its findings in a nice table for further investigation. # Application Information### DescriptionThis is the source cod

20 juil.

Introduction

Identity is no longer confined to a single system. In modern environments, identity spans multiple platforms: Active Directory, Okta, Entra, GitHub, and others; each operating within its own environment, with its own model for authentication and access. These systems are connected through federation, synchronization, and single sign-on. Each connection serves a legitimate purpose, enabling organizations to manage identity centrally while extending access across platforms. But these connections a

20 juil.

How These Paths Emerge

In practice, these relationships rarely present themselves as a single, obvious chain. They are distributed across platforms, environments, and teams, each with its own perspective on identity and access. Consider a typical scenario. An organization uses Active Directory as an upstream identity source, federated into an Okta environment. That Okta environment is then used to provide single sign-on into a set of downstream applications. In some cases, those relationships extend further, to additi

20 juil.

Short Native Attack Paths

One thing that comes as a surprise is that native Okta attack paths are relatively short when compared to our security models of Active Directory (AD) and Microsoft Entra ID. There are multiple reasons for this: Okta does not support group nesting and only users can be members of groups Many theoretical privilege elevation paths are intentionally mitigated by only allowing Super Administrators (the most privileged role in Okta) to modify users, groups, and applications that have role assignme

20 juil.

Scenario 1: The shared document

The teams that moved the Internet: Argentina, followed by France and Norway

Defender Priorities

What’s available now

SharpHound Integrated Windows Authentication

Azure Hybrid Data Improvements

Introduction

Hybrid Attack Paths Across Systems

Bad Windows Service Analysis

Introduction

How These Paths Emerge

What EMEA teams get out of this launch

Scenario 1: The shared document

Outlook and Implications

Outlook and Implications

Jira is becoming the delegation layer for software teams.

SharpHound Integrated Windows Authentication

Azure Hybrid Data Improvements

Introduction

Hybrid Attack Paths Across Systems

Bad Windows Service Analysis

Introduction

How These Paths Emerge

Short Native Attack Paths

Explorer d'autres thèmes