Principal Consultant at @SpecterOps. All opinions are my own.
- Tweets 100
- Following 176
- Followers 1,240
- Likes 198
New content for AP:A will be debuting at SpecterBash 🎉 This will be the first time the new Agents and Identities section will be taught as part of the course AND there is a brand new CTF for participants.
See Azure and Entra ID the way attackers do. 👀
During our Azure course at #SpecterBash, learn to identify the misconfigs and attack paths that matter, including those involving agents and identities.
Get the attacker’s perspective: ghst.ly/45COqlF
2
5
1,572
Hope Walker retweeted
Tracking OAuth token exchanges is complicated. TATS can help.
@Icemoonhsv introduces the Token Analysis and Tracking System & shares some unexpected findings uncovered along the way.
Check it out! ⤵️ ghst.ly/4xMBaYd
2
19
57
4,006
I've been teasing this project for a while in the Azure course and I am finally making my Token Analysis and Tracking System (TATS) public. Check out my latest blog to see more and share any cool things you find with TATS!
specterops.io/blog/2026/09/0…
6
18
57
5,194
If you don't have the time to read everything, I also have a short video demoing starting TATS with CDP, getting pre-MFA tokens to a portal, and using BroCI to go around admin portal CAPs to get to nested services.
piped.video/yc49BMHRpy4?is=SDHc…
3
407
If you've taken my Azure course with @SpecterOps we are inviting alumni back for a new module on Agents and Identity. Join me on Sept 1 to learn about agents and experience our new material before it goes live at SpecterBash. Spots are limited.
events.humanitix.com/adversa…
2
4
16
1,975
My SO-CON talk about mapping RBAC in BloodHound is posted now. Fair warning for those who don't know me, I do have a personality and started by yelling at the crowd. 👑 Check out how we are mapping RBAC in BloodHound moving forward. piped.video/1KDcK9PjnhU?si=4x1-…
1
6
293
Hope Walker retweeted
During an assessment, our team discovered that StrongDM auth state files containing JWTs & key material could be reused across hosts to obtain authenticated sessions & access infrastructure resources (CVE-2026-4387).
Read more from @icemoonhsv ⤵️ ghst.ly/4egbgVd
4
14
3,221
I'm excited to be able to finally publish the public disclosure for CVE-2026-4387. Check out my blog on discovering the reuse of the state.kv file to get authenticated sessions with StrongDM (now fixed). specterops.io/blog/2026/06/0…
3
10
1,936
Hope Walker retweeted
How do you really model RBAC in attack paths? 🤔
@Icemoonhsv breaks down the limitations of role-based mapping in BloodHound, and shows how to move to permission-level edges for clearer, more accurate graphs. #SOCON2026
3
10
1,902
Hope Walker retweeted
Good morning #SOCON2026! ☀️
Pick up your badges from the front desk and grab breakfast before we kickoff our BIG first day.
1
10
873
Very grateful to BSides San Diego for letting me come and talk about BroCI. I published my slides on GitHub for anyone interested.
github.com/IceMoonHSV/Going-…
3
176
Hope Walker retweeted
Don’t miss @Icemoonhsv at #BSidesSD 🔥
Deep dive into NAA, brokered client IDs, and how token flows behave (and break) in Microsoft environments.
Learn more: bsidessd.org/
1
5
1,101
Hope Walker retweeted
Credential Guard was supposed to end credential dumping. It didn't.
@bytewreck just dropped a new blog post detailing techniques for extracting credentials on fully patched Windows 11 & Server 2025 with modern protections enabled.
Read for more ⤵️ ghst.ly/4qtl2rm
11
334
729
137,877
Check out my new blog post diving deeper into BroCI.
Microsoft introduced nested application auth (NAA) in 2024. Researchers spotted FOCI similarities & dubbed it brokered client IDs (BroCI).
@Icemoonhsv documents NAA flows and BroCI—filling a gap for research on Microsoft identity protocols. ghst.ly/3Jdhp7Z
1
10
25
7,911
Check out my new blog on nested app authentication and brokered authentication.
Why should Microsoft's Nested App Authentication (NAA) should be on your security team's radar? @Icemoonhsv breaks down NAA and shows how attackers can pivot between Azure resources using brokered authentication. ghst.ly/45h2Zw3
2
17
41
12,910
Hope Walker retweeted
Ready to level up your offensive security career? 📈
Join our Consulting Services team as a Senior Offensive Security Consultant doing what you love: red teaming, penetration testing, capability assessments, and research.
Learn more & apply today: ghst.ly/3PBmGFZ
5
13
2,004
Hope Walker retweeted
What can you expect to learn in our Azure Security Fundamentals training at #SOCON2025? Course architect @Icemoonhsv shares that students will dive into:
➡️ Azure Resource Manager
➡️ Common security misconfigurations
➡️ Entra ID authentication
Register: ghst.ly/reg-socon2025-tw
1
1
7
1,521
Hope Walker retweeted
Join our Azure Security Fundamentals course at #SOCON2025! Learn to secure Azure environments & spot misconfigs commonly exploited by attackers.
🐦 Early bird deadline = Dec 1
🎟️ In-person attendees receive a free conference pass.
Register today 👉 ghst.ly/reg-socon2025-tw
1
1
2
1,424