🚨 @deathcon.io - Montreal On Site Tickets 🚨 Tickets: eventbrite.ca/e/2026-death... Tickets are selling super fast this year! This is my first post about it and already 30% of the tickets are sold!! #DetectionEngineering and #ThreatHunting buy your tickets now!!

NoiseFest is just a few weeks away!🎉 If you're in Las Vegas for #BlackHat or #DEFCON, come join us for a night of cold drinks, good company, and 60s and 70s vibes. 🏵️ 📅Thursday, August 6th | 6–9 PM PT | Las Vegas 🔗RSVP: info.greynoise.io/events/black... #NoiseFest #GreyNoise #cybersecurity

GreyNoise - NoiseFest at BlackHat 2026

Join us for NoiseFest at BlackHat/DEFCON on Thursday, August 6th. Enjoy drinks, snacks, and engaging conversations with your peers. RSVP now!

info.greynoise.io

Next August, we'll host our newly designed advanced defensive engineering training at BlackHat USA in Las Vegas. Next to detection engineering we'll also cover many important defensive security topics like enrichment, lifecycle management and AI. blackhat.com/us-26/traini...

New #BloodHoundBasics from @scoubi.bsky.social! Waiting on better Cypher parity to switch your BHCE deployment to a PG backend? v9.2.0 brings new Cypher support! UNWIND, RELATIONSHIPS(p), NODES(p), etc & several improvements to existing verbs. Ex: Exclude edge types directly in Cypher!

This is it folks! This is the last weekend to submit a DEATHCon workshop CFP proposal if you want to get in the first round of acceptance! We've got a lot of great submissions already but there's room for yours too! deathcon.io Click on CFP. Conf can pay for travel! Or you can teach online remote!

My team at @greynoise.io is hiring a Junior Detection Engineer - somebody who understands network traffic and can write detection rules. Hit me up if you have any questions! job-boards.greenhouse.io/greynoiseint...

Detection Engineer

United States (Remote)

job-boards.greenhouse.io

It’s #BloodHoundBasics day w/ @scoubi.bsky.social! This week: Relationship Shortcuts. Instead of listing all traversable relationships in your Cypher queries, use: [:AD_ATTACK_PATHS] for Active Directory [:AZ_ATTACK_PATHS] for Entra ID [:ALL_ATTACK_PATHS] for AD & Entra

3rd times the charm? My talk about #BloodHound #OpenGraph was accepted at #WWHF Mile High (Denver). That will allow me to realize 2 dreams at the same time. 1- Speak at WWHF live in person 2- Snowboard in that part of the world with good friends (that will also give a talk at WWHF)

I'm happy to share a new #BloodHound #OpenGraph extension with the commnunity!! Here's the link : github.com/Scoubi/Blood... It maps MITRE ATT&CK. #Sigma and #AtomicRedTeam test all in one graph!

GitHub - Scoubi/BloodSOCer

Contribute to Scoubi/BloodSOCer development by creating an account on GitHub.

github.com

Dirk-jan Mollema found one of the most severe vulnerabilities ever discovered in Microsoft Entra ID. One that could have compromised every tenant in the cloud. In this episode, we unpack the story, the stress, and the mindset behind responsible disclosure. 🔥

Introducing PingOneHound! This OpenGraph extension for BloodHound can help you identify, analyze, execute, and remediate attack paths in PingOne organizations. Read the introductory blog post here: specterops.io/blog/2025/10...

PingOne Attack Paths - SpecterOps

You can use PingOneHound in conjunction with BloodHound Community Edition to discover, analyze, execute, and remediate identity-based attack paths in PingOne instances.

specterops.io

Happy #BloodHoundBasics Day from @scoubi.bsky.social! By now, you've probably heard about our Query Library. But did you know you can run any query in your own instance of BHE/BHCE and then save the query to your Personal Library? Follow the steps threaded below! 🧵: 1/5

Today is the 30th anniversary of Hackers

The final round of #DEATHCon2025 online tickets will drop on 9/9 at 0900 UTC deathcon.io/tickets.html In-person tickets still available at some sites (1/4)

Interested in hands-on learning of #DetectionEngineering and #ThreatHunting ? We still have a few tickets left for @DEATHCon2025 in #Montreal We are lucky enough to have 4 Workshops Leaders with us that will be able to hosts a Live Play of their workshop and help you complete it!

Fucking do it, I dare you.

What all do you need to know about BloodHound CE 8.0 & OpenGraph? @scoubi.bsky.social is joining @redsiege.com's Wednesday Offensive tomorrow to dive into the JSON schema for OpenGraph, how to ingest nodes & edges, best practices, & how to create custom icons. Join 👉 ghst.ly/46MNltn

This month's NoiseLetter will make the perfect light reading for a trip to say...Vegas? Make sure to check it out (even if you're not headed to BlackHat/DEF CON there is something in it for you). 🤘

NoiseLetter July 2025

Get GreyNoise updates! Read the July 2025 NoiseLetter for product news, key resources, the latest tags and vulnerabilities, and more.

greynoise.io

The Python Software Foundation warns of phishing emails directing users to a fake PyPI site (pypj. org) to steal credentials. PyPI isn’t hacked, but users are urged to stay alert. www.bleepingcomputer.com/news/securit... Via @bleepingcomputer.com #hacking #infosec #cybersecurity

Hackers target Python devs in phishing attacks using fake PyPI site

The Python Software Foundation warned users this week that threat actors are trying to steal their credentials in phishing attacks using a fake Python Package Index (PyPI) website.

bleepingcomputer.com

This is AMAZING

David Ho@davidho.bsky.social · last yr.

Motherfucking wind farms…

Think being compliant = being secure? Think again. 🤔 Hear from @scoubi.bsky.social at #BSidesLV as he exposes the gap between blindly following rules & security posture. Get the info on password security & what to do when "compliant" passwords fail you. ghst.ly/4o66cWk

Happy #BloodHoundBasics Day from @scoubi.bsky.social! 🎉 Have you ever run a Cypher Query & get so many nodes you couldn't see anything? You Pinch Zoom to get a closer look and it worked fine, but you Pinch Un-zoom & the application resized. 🧵: 1/2

Only 3 Early Bird tickets left!!

Scoubi@scoubi.bsky.social · last yr.

Tickets for #DEATHcon in Montreal are on sale now! Book now to secure your place. FYI, Virtual Tickets for round 1 are already Sold Out! eventbrite.ca/e/deathcon-m... Additional info (like workshops) for the con can be found here : deathcon.io Please like & repost for reach

Tickets for #DEATHcon in Montreal are on sale now! Book now to secure your place. FYI, Virtual Tickets for round 1 are already Sold Out! eventbrite.ca/e/deathcon-m... Additional info (like workshops) for the con can be found here : deathcon.io Please like & repost for reach

Tickets for "DEATHcon - Montreal On Site" go on sale July 8th at 8am. www.eventbrite.ca/e/deathcon-m... Be with 50 other DE&TH aficionados for a whole weekend Nov 8-9 2025!! #DEATHcon #Workshops #DetectionEngineering #ThreatHunting

How attackers move between AD domains via trusts depends on trust type & config. We're replacing TrustedBy edge in BloodHound with new trust edges for better attack path mapping. Check out @jonas-bk.bsky.social's blog post to learn more. ghst.ly/4lj9C5T

Good Fences Make Good Neighbors: New AD Trusts Attack Paths in BloodHound - SpecterOps

The ability of an attacker controlling one domain to compromise another through an Active Directory (AD) trust depends on the trust type and configuration. To better map these relationships and make i...

ghst.ly

Ghostwriter v6's new collaborative editing feature is 🔥 Alex Parrill & @printingprops.com discuss the new real-time collaborative editing for observations, findings, & report fields, enabling multiple users to edit simultaneously without overwriting each other. ghst.ly/4jVqdvG

Ghostwriter v6: Introducing Collaborative Editing - SpecterOps

Ghostwriter now supports real-time collaborative editing for observations, findings, and report fields using the YJS framework, Tiptap editor, and Hocuspocus server, enabling multiple users to edit si...

ghst.ly

#HuntingTipOfTheDay: a personal favourite, command-line obfuscation. Substituting or inserting special Unicode characters might allow attackers to bypass string-based detections. Look for command lines with unusual Unicode characters. Checkout ArgFuscator.net for more fun!

#HuntingTipOfTheDay: macOS has a built-in SSH mechanism that is disabled by default. Would you detect it if someone enables it and logs in remotely? Look for remote login events, and investigate the associated session.