A deep dive into why SCCM application execution spawns via WmiPrvSE.exe instead of CcmExec.exe, and how to detect anomalous SCCM deployments.

A red team report is a starting point. Learn how to extract full value from findings: root cause analysis, detection gap mapping, remediation prioritization, and building the improvement habit.

Tracking OAuth tokens is hard, but Token Analysis and Tracking System (TATS) can help. TATS will collect, store, decode, analyze and provide visual tracking for OAuth token exchanges. It was built to ...

Discover a technique for retrieving cleartext LDAP credentials from ServiceNow using script includes, and how to defend against it.

See how AWSHound maps AWS attack paths into BloodHound, evaluating IAM policies, SCPs, and boundaries to reveal real privilege escalation.

Enjoy the videos and music you love, upload original content, and share it all with friends, family, and the world on YouTube.

Learn how Chromium browser extensions can be silently sideloaded to establish persistent C2 access and how to detect it with Sysmon.

Chrome DevTools Protocol cookie theft: how CDP can be enabled inside a live browser to steal cookies, passwords, and sessions.

AI agent endpoint artifacts expose credentials, sessions, and configs. Blacklight helps security teams assess and reduce this surface.

Mythic 4 is now in public beta, adding AI chat containers, operation chat, scoped API tokens, and resumable file transfers.

ConfigManBearPig 2.0 is a Python tool that collects SCCM data for BloodHound to map and fix Configuration Manager attack paths.

Windows Server Failover Clusters share credentials across every node: compromise one, and you compromise the entire cluster

AWS IAM attack paths let attackers chain roles and permissions to admin. BloodHound Enterprise maps them as paths defenders can sever.