Hope Walker
@1cemoon.bsky.social
Senior Security Researcher at SpecterOps. All opinions are my own.
My SO-CON talk about mapping RBAC in BloodHound is posted now. Fair warning for those who don't know me, I do have a personality and started by yelling at the crowd. 👑 Check out how we are mapping RBAC in BloodHound moving forward. youtu.be/1KDcK9PjnhU?...
Mapping RBAC in BloodHound | SO-CON 26
YouTube video by SpecterOps
youtu.be
During an assessment, our team discovered that StrongDM auth state files containing JWTs & key material could be reused across hosts to obtain authenticated sessions & access infrastructure resources (CVE-2026-4387). Read more from @1cemoon.bsky.social: https://ghst.ly/4egbgVd
CVE-2026-4387: StrongDM State File Reuse
Public disclosure for CVE-2026-4387. State file could be transferred and used on other hosts without restriction
ghst.ly
I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). specterops.io/blog/2026/06...
CVE-2026-4387: StrongDM State File Reuse
Public disclosure for CVE-2026-4387. State file could be transferred and used on other hosts without restriction
specterops.io
How do you really model RBAC in attack paths? 🤔 @1cemoon.bsky.social breaks down the limitations of role-based mapping in BloodHound, and shows how to move to permission-level edges for clearer, more accurate graphs. #SOCON2026
Don’t miss @1cemoon.bsky.social at #BSidesSD 🔥 Deep dive into NAA, brokered client IDs, and how token flows behave (and break) in Microsoft environments. Learn more: https://www.bsidessd.org/
Check out my new blog diving deeper into BroCI.
SpecterOps@specterops.io · 10mo agoMicrosoft introduced nested application auth (NAA) in 2024. Researchers spotted FOCI similarities & dubbed it brokered client IDs (BroCI). @1cemoon.bsky.social documents NAA flows and BroCI—filling a gap for research on Microsoft identity protocols. ghst.ly/3Jdhp7Z
Check out my new blog on nested app authentication.
SpecterOps@specterops.io · 12mo agoWhy should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @1cemoon.bsky.social breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3
What can you expect to learn in our Azure Security Fundamentals training at #SOCON2025? Course architect @1cemoon.bsky.social shares that students will dive into: ➡️ Azure Resource Manager ➡️ Common security misconfigurations ➡️ Entra ID authentication Register today: ghst.ly/reg-socon25-...