About
Duane is an adversary simulation operator, security researcher, and leader at SpecterOps.…
Activity
3K followers
-
Duane Michael reposted thisDuane Michael reposted thisSo happy to finally release AWSHound with Daniel H.. Its been a labor of love for the last 6 months and I can't wait to hear how the community uses it! If you haven't heard AWSHound is a free, self-hosted tool that turns AWS accounts and Organizations into real attack path graphs using BloodHound CE. It evaluates IAM policies, boundaries, SCPs, RCPs, and resource policies offline. Showing you what an attacker can actually compromise in your AWS organization. Grab the tool on GitHub: https://lnkd.in/gmGQvKfF Read more about it here: https://lnkd.in/gaG_vPUk Or here: https://lnkd.in/g-aJ_pep
-
Duane Michael posted thisCalling all my red team connections! SpecterOps is hiring Offensive Security Consultants at junior (associate), mid, and senior levels. Back when I was on the consulting side, I wrote a two-part blog series about life, culture, and work at SpecterOps. Check out the blogs to see if we're a mutual good fit and shoot your shot. Remember, you miss 100% of the shots you don't take! I'm not the hiring manager, but I'll do my best to answer any questions. Blogs: Part I: https://lnkd.in/gFEVGDHN Part II: https://lnkd.in/gDPJrTz3 Links to the job postings: Associate: https://lnkd.in/gADwimdw Mid: https://lnkd.in/gv2mjFd4 Senior: https://lnkd.in/gBwX5Znf
-
Duane Michael reposted thisDuane Michael reposted thisConfigManBearPig collects data from SCCM (Microsoft Configuration Manager) so BloodHound users can visualize whether their environment is vulnerable to nearly every attack technique in the Misconfiguration Manager tradecraft knowledge base, including 8 of 9 hierarchy TAKEOVER paths reachable from a low-privileged domain user. Version 2.0 is a ground-up Python rewrite built on OpenHound (our framework for building BloodHound collectors), and it's faster, more scalable, and easier to run in the field. What's new: → 56%+ faster in lab testing, with DuckDB-backed local processing to cut memory overhead → Now runs on Linux, not just Windows → NT hash and Base64 Kerberos ticket authentication → SOCKS proxy support for better OPSEC → Multi-target parallel execution with per-target diagnostic logging → CVE mapping tied to observed SCCM build versions → New OpenGraph schema for pathfinding directly in BloodHound Chris Thompson is demoing it live at #BHUSA Arsenal TOMORROW: Tuesday, August 4th, 5:15–6:15 PM, Station 6. Swing by if you're around. https://lnkd.in/e57TSJJB
-
Duane Michael reposted thisDuane Michael reposted thisAt Black Hat or in early for DEF CON? Daniel H. and I are teaching From Dev to Prod: AWS Cross Account Privilege Escalation twice this week — Wednesday, August 5 at 2:30pm and again Thursday at 10am. Hands-on escalation across IAM, EC2, SSM, EKS, CloudFormation, KMS, Lambda, and S3, capped with a full attack path across three AWS accounts. Plus AWSHound for mapping these paths in your own environment. https://lnkd.in/gzN62cpD
-
Duane Michael reposted thisDuane Michael reposted thisCompromise one node in a Windows Server Failover Cluster (WFSC), and you've compromised all of them. In his latest blog, Garrett Foster explains why: WSFC nodes share resource credentials by design, including the CNO and VCO's cluster-wide passwords. He breaks down the reverse engineering behind it, the Kerberos behavior that looks impossible until you understand it, and a full attack path from one node to full cluster compromise. Read more: https://lnkd.in/d95e5d25
-
Duane Michael reposted thisDuane Michael reposted thisMy SpecterOps AT:IDOT swag pack finally came in the mail. Just as cool as the course content itself! You might notice a special coin that may or may not be related to an ongoing PR 🫣 Hope to share more about it soon!
-
Duane Michael reposted thisDuane Michael reposted thisIntroducing Tradecraft Academy! 📚 Tradecraft Academy is our new home for on-demand, practitioner-led, hands-on offensive and defensive security training, designed to help security professionals learn at their own pace without sacrificing hands-on experience. Kick things off with BloodHound Basics, where you'll learn how to collect and analyze data, navigate attack paths, work with Cypher queries, leverage OpenGraph extensions, and operationalize BloodHound in real-world environments. Read more: https://lnkd.in/gPfEXUDc Get started today: https://lnkd.in/gUi49Vcj
-
Duane Michael reposted thisDuane Michael reposted this[TALK] My latest Black Hat Europe talk is now publicly available. I'm glad it's finally out. If you can look past the rather obvious anxiety and the occasional brain malfunction, I hope you might find something useful. 🔗https://lnkd.in/eDVWG8bx Mirrored from my Twitter/X post.
Duane Michael replied to a comment
3w
Kenneth Strawn The associate opening got absolutely hammered and has been closed.
-
Duane Michael liked thisDuane Michael liked thisI've been teasing this project for a while in the Azure course and I am finally making my Token Analysis and Tracking System (TATS) public. Check out my latest blog to see more and share any cool things you find with TATS! https://lnkd.in/gUR_usi8
-
Duane Michael liked thisDuane Michael liked thisWhat better way to spend a few hours of Labor Day weekend than learning more about BloodHound? I completed the Bloodhound Basics course from SpecterOps. It’s a great hands-on course covering data collection, attack-path analysis, Cypher, automation, and OpenGraph. It’s also completely free. #BloodHound
-
Duane Michael liked thisAdversary Tactics: Detection was issued by SpecterOps to Corey Nenno.Adversary Tactics: Detection was issued by SpecterOps to Corey Nenno.
-
Duane Michael liked thisDuane Michael liked thisHeading to Blue Team Con? Join Brian Reitz and John Wotton for a look at how attackers use SOCKS proxies to pivot through compromised networks and how defenders can identify that behavior. Brian and John will share the research behind ProxyWatch and how it can help defenders find SOCKS proxies in their environments. https://lnkd.in/gEvRkBYk
-
Duane Michael liked thisDuane Michael liked thisBig personal news: my labradoodle officially is cancer free as of yesterday! Had to touch some grass (sand) and celebrate with bubbles, rawhide and a new lobster toy over a sunset last night. Here’s to another 13 years!
-
Duane Michael liked thisDuane Michael liked thisLong plane rides are perfect for writing the blog you had on your todo for a while! So, to kick of Black Hat/Def Con week, here is "Borrowing Windows Hello keys for authentication and persistence". It covers some neat WHFB endpoint techniques I researched and talked about with Ceri Coburn two years ago and some new research that makes this even more interesting. https://lnkd.in/evXJhYBZBorrowing Windows Hello keys for authentication and persistenceBorrowing Windows Hello keys for authentication and persistence
-
Duane Michael liked thisDuane Michael liked thisNew badge on the shelf: BloodHound Basics Operator. Most of it was familiar ground, but I still walked away with a few “huh, I’ve been doing that slightly wrong for years” moments. What really got me is how well the course is built, and it’s free! Clean pacing, labs that land exactly when they should, zero filler. Making an intro course that works for total beginners and for people who live in the tool is hard, and this one pulls it off. If you’re getting started with BloodHound, start here!BloodHound Basics: Operator was issued by SpecterOps to Javier Nestor Azofra Ovejero.BloodHound Basics: Operator was issued by SpecterOps to Javier Nestor Azofra Ovejero.
-
Duane Michael liked thisDuane Michael liked thisThe "CosmosEscape" vulnerability was disclosed by Yuval Avrahami and Lior Maman from Wiz today. This is another major cross-tenant issue in Azure, and one of several that we have seen over the last few years. Thankfully this one was responsibly disclosed and it doesn't appear to have been exploited in the wild. A big thanks to Raphael Satter for quoting me in today's Reuters article on the issue. https://lnkd.in/gdZGntcbCyber firm Wiz says flaw could have led to mass exposure of Microsoft cloud customersCyber firm Wiz says flaw could have led to mass exposure of Microsoft cloud customers
-
Duane Michael liked thisYes the rumors are true BSides Kristiansand will be back in 2027! Save the dateDuane Michael liked thisHold av datoen – BSides Kristiansand 2027 BSides Kristiansand kommer tilbake! Neste arrangement finner sted den første fredagen i juni: 4. juni 2027 Det blir nok en dag med cybersikkerhet, hacking, forskning, tekniske dypdykk, erfaringer fra den virkelige verden og, viktigst av alt, et fantastisk sikkerhetsmiljø. Foreløpig trenger du bare å sette av 4. juni 2027 i kalenderen. Mer informasjon om sted, Call for Papers, billetter, frivillige og resten av programmet kommer senere. Vi sees i Kristiansand i juni 2027.
Experience
Education
Licenses & Certifications
Volunteer Experience
-
FIRST Robotics Team Mentor
San Dieguito Union High School District
- 10 months
Science and Technology
Publications
Courses
-
Attacking and Defending Active Directory
-
-
Attacking and Defending Containerized Apps and Serverless Tech
AppSec California 2019
-
COM Programming
-
-
Dark Vortex - Offensive Tool Development
-
-
Disney's Approach to Employee Engagement
-
-
Disney's Approach to Quality Service
-
-
Lean Six Sigma Greenbelt
-
-
Offensive Security: Advanced Web Attacks & Exploitation
WEB-300
-
Offensive Security: Cracking the Perimeter
CTP
-
Offensive Security: Evasion Techniques and Breaching Defenses
PEN-300
-
Offensive Security: Penetration Testing with Kali Linux
PEN-200
-
Offensive Security: Windows User Mode Exploit Development
EXP-301
-
Offensive Security: Wireless Attacks
PEN-210
-
Offensive Tool Development
-
-
Outsider Security - Microsoft Entra ID
-
-
Practical Malware Analysis
DEFCON 25
-
Sektor 7: Red Team Operator - Malware Development Essentials
-
-
Sektor 7: Red Team Operator - Malware Development Intermediate
-
-
Silent Break Security: Dark Side Ops I
-
-
Silent Break Security: Dark Side Ops II
-
-
SpecterOps: Adversary Tactics - Mac Tradecraft
-
-
SpecterOps: Adversary Tactics - Red Team Ops
-
-
SpecterOps: Adversary Tactics - Vulnerability Research for Operators
-
-
SpecterOps: Adversary Tactics: Tradecraft Analysis
-
-
Stage 2 Security: Making the Cloud Rain Shells
-
-
Windows Internals I
-
-
Windows Internals II
-
-
Windows Internals III
-
-
Windows: The Undiscovered Country
DEFCON 25
Projects
Honors & Awards
-
Passionate Service Award
Keith Plant
-
Manager Appreciation Award
Alan Kolackovsky
-
Navy & Marine Corps Achievement Medal
1st Marine Raider Support Batallion
Languages
-
English
Native or bilingual proficiency
Organizations
-
Open Web Application Security Project (OWASP)
Member
- PresentMembership #000016679
-
Information Systems Security Association
Member
- PresentMembership #37213975
-
Association for Computing Machinery
Member
- PresentMembership #4958439
-
Institute of Electrical and Electronics Engineers: Computer Society
Member
- PresentMembership #93505370
-
Institute of Electrical and Electronics Engineers
Member
- PresentMembership #93505370
Recommendations received
5 people have recommended Duane
Join now to viewOther similar profiles
Explore top content on LinkedIn
Find curated posts and insights for relevant topics all in one place.
View top content