5 months ago @tifkin_ and I started looking into the security of Active Directory Certificate Services. Today we're releasing the results of that research- a blog post posts.specterops.io/certifie… + a 140-page whitepaper and defensive audit tool (links at the top of the post) [1/6]

Many of you don't understand how serious this is, so let me break it down. In computer science there is a famous kind of puzzle called 3-SAT. You are given a long list of yes-or-no switches and a set of rules about how they must be arranged, and you have to find a combination that satisfies every rule. The obvious way to solve it is to try every combination, but each new switch doubles the number of possibilities, so a puzzle with a few hundred switches would take longer than the age of the universe to brute force. For decades, the smartest people in the field found clever tricks that made this a little faster, but every trick still hit the same wall: the time required kept exploding as the puzzle grew. About 25 years ago, two computer scientists, Russell Impagliazzo and Ramamohan Paturi, working with Francis Zane, turned that wall into a formal idea. They proposed the Exponential Time Hypothesis, which says this explosion is not a failure of human cleverness but a law of nature. No algorithm, however brilliant, will ever solve 3-SAT without the time blowing up exponentially. Nobody could prove it, but almost everyone believed it, and it became one of the foundations of modern computer science. Researchers used it as a measuring stick. If you could show that solving some other problem quickly would also crack 3-SAT quickly, you had shown that problem was hopelessly hard too. Hundreds of papers, across scheduling, graphs, logic and much more, rest on this one assumption. Now an internal AI model at OpenAI claims to have broken it. It says it found an algorithm that solves these puzzles meaningfully faster than the hypothesis allows, and it has checked the proof in a computer verification system called Lean. And here is the remarkable part: the very people who proposed the hypothesis, Impagliazzo and Paturi, along with MIT's Ryan Williams, are now leading the public review of whether a machine has disproved their own idea. So what happens next? If the disproof holds, a large part of theoretical computer science has to be revisited. Every result that said "this problem cannot be solved faster, assuming ETH" loses its foundation, and researchers will have to work out which of those walls were real and which were simply where we stopped looking. It does not mean everything becomes easy. The new algorithm is still slow in absolute terms and this is not the famous P versus NP problem being solved. But it means our map of what is possible was wrong in a place we were very confident about, and it was an AI that redrew it. If the disproof fails, the hypothesis survives and the field breathes out, but we will still have watched an AI produce serious, checkable work on one of the deepest questions in the discipline, closely enough that the founders of the idea had to take it seriously. Either way, something has shifted.

From an AD on-prem POV, I still can't believe this research by @MGrafnetter was released this year. If you haven't read it… definitely worth a read! Pure 🔥 troopers.de/troopers26/talks…

1/2 LDAP signing was supposed to stop NTLM relay to LDAP. I found a way to relay coerced SMB auth to a DC with LDAP signing and channel binding enforced. Patched in October. Blog: specterops.io/blog/2026/10/2… PoC: github.com/grayhatkiller/swi…

New research from @GrayHatKiller: NTLM relay to domain controllers with LDAP signing enforced. Patch your DCs. 👇 ghst.ly/3VSdm7h

On the upside: The fact that old bugs are being discovered is a strong indicator for optimism: Old bugs are deep bugs that survived many years of code review. Finding a bunch of old bugs is the clearest indicator that technological progress in bug detecdtion is real.

I used Opus 5.5 on max and GPT-6 Astra for 5 days straight and I reversed engineered Elastic Security and extracted all the rules. I made them available here: github.com/elastic/detection… You’re welcome.

Your EDR Has Boundary Issues. @harmj0y and @tifkin_ of @SpecterOps explore how adversarial machine learning can evade EDR detection- and how LLMs are accelerating the reverse engineering behind it. Watch their Offensive AI Con talk below. 👇 piped.video/watch?v=GNDMDI_p… #OAIC #OffensiveAI #Cybersecurity #EDR

🏴‍☠️ @shanejcaldwell and @0xdab0 took the stage yesterday at @OffensiveAIcon to officially launch ScopeBench. At last year's con, one question kept coming up: if I pour domain expertise into a hard infosec benchmark, am I just handing free capability to the labs and my competitors? Our answer: build the benchmark we'd all be glad to see saturated. Models that can reliably stay in scope will unlock tons of economically useful use cases that have been slow to grow despite saturated capability. Check out the full research and learn how to contribute: dreadnode.io/research/scopeb… [full recording and slides coming soon]

Offensive AI Con is such a brilliant event. Love getting a vibe from the various AI sectors of the industry. 2025 was very “we need benchmarks”. 2026 is “we’re drowning in exploits”!!

Did you know you can spot which servers and workstations have the WebClient (WebDAV) service running, straight from BloodHound-CE?🔥 A machine with WebClient running can be forced to authenticate over HTTP (PetitPotam/PrinterBug via WebDAV), then NTLM-relayed to LDAP for RBCD / Shadow Credentials, or to AD CS Web Enrollment (ESC8) to compromise the target. This Cypher query surfaces them all at once, so you can prioritize targets:👇 MATCH (c:Computer) WHERE c.webclientrunning = true RETURN c LIMIT 1000 RustHound-CE v2.5.22 adds the WebClient collection method, run automatically with -c All github.com/g0h4n/RustHound-C… #RedTeam #ActiveDirectory #BloodHound

On a flight to Offensive AI Con, listening to @juanandres_gs on Three Buddy Problem lay waste to the offensive AI scene as it stands today, and I’m loving every minute of it 🤣🤣 Sometimes hearing someone say the quiet part out loud is cathartic 🤩

A quick article showing how the Jev OPSEC ranker works, and looking at how Jev can be used for identifying potentially sensitive file paths and content at speed.

This is your sign to reserve your spot for @MGrafnetter's webinar this week!✨ Hear about Pass-the-Passkey, a novel & actively researched category of malware-initiated attack techniques targeting passkey auth that can enable cloud user impersonation. 👉 ghst.ly/4cpVSoa

Playing around with Jev to see how it performs with offsec. Its speed and insane low cost certainly opens up novel concepts, like this POC doing real-time scoring of command opsec in Mythic, and identifying the expression type. It's not great at cyber yet, but exciting to see!

Did my talk, loved the venue 🥰

🔜

Bad news for red teamers: Microsoft Entra ID now detects the WebAuthn / #FIDO2 assertion replay attack. As a result, two of the attack vectors I demonstrated in my #BHUSA "Pass-the-Passkey Family of Attacks" talk no longer work. Luckily, the remaining 18 are unaffected.

For all the the IT admins asking, how do I make Active Directory MORE defensible. This is how… Jerry Devore’s awesome series on Active Directory hardening. Part 1 - Disabling NTLMv1 Part 2 - Removing SMBv1 Part 3 - Enforcing LDAP Signing Part 4 - Enforcing AES for Kerberos Part 5 - Enforcing LDAP Channel Binding Part 6 - Enforcing SMB Signing Part 7 - Implementing Least Privilege Links for each one👇 techcommunity.microsoft.com/…

ItsNotAlwaysSMB: DPAPI in other protocols🔥 SMB is monitored closely nowadays, stopping attacks like looting DPAPI secrets. Thanks to @_zblurx, NetExec got a huge upgrade, extending DPAPI credential dumping to other protocols such as WMI, WinRM and MSSQL and various modules🔑

I've been teasing this project for a while in the Azure course and I am finally making my Token Analysis and Tracking System (TATS) public. Check out my latest blog to see more and share any cool things you find with TATS! specterops.io/blog/2026/09/0…