- https://github.com/SpecterOps/ConfigManBearPig
- https://github.com/SpecterOps/MSSQLHound
- https://github.com/subat0mik/Misconfiguration-Manager
- https://github.com/Mayyhem/SharpSCCM
- https://github.com/Mayyhem/Maestro
- https://github.com/garrettfoster13/sccmhunter
I'm Chris. I'm currently a Senior Security Researcher at SpecterOps focusing on adding new attack paths and features to BloodHound and BloodHound Enterprise. Before that I was a Principal Consultant on the Adversary Simulation team, leading and conducting red team operations and pentests.
I enjoy writing tools to test the security of configuration management platforms like SCCM and Intune. I'm the author of SharpSCCM, ConfigManBearPig, MSSQLHound, and Maestro, co-author of Misconfiguration Manager with Duane Michael (@subat0mik) and Garrett Foster (unsigned_sh0rt), and have contributed to a few other offensive security tools, including SCCM Hunter, impacket, pxethiefy, and SCMKit.
- MSSQLHound Now Available in Go
- Ludus SCCM Lab Expansion
- Introducing ConfigManBearPig, a BloodHound OpenGraph Collector for SCCM
- MSSQL and SCCM Elevation of Privilege Vulnerabilities
- Adding MSSQL to BloodHound with OpenGraph
- Do You Own Your Permissions, Or Do Your Permissions Own You?
- Maestro: Abusing Intune for Lateral Movement Over C2
- Rooting Out Risky SCCM Configs with Misconfiguration Manager
- Hierarchy Takeover without SOCKS
- SCCM Hierarchy Takeover
- SCCM Site Takeover via Automatic Client Push Installation
- Relaying NTLM Authentication from SCCM Clients
- Coercing NTLM Authentication from SCCM
- SO-CON 2026: Exposing Hidden Attack Paths in SCCM and MSSQL with BloodHound OpenGraph
- SO-CON 2026: Build Your Own OpenGraph Collector Workshop, with Mat Soulnier (@ScoubiMtl)
- BloodHound OpenGraph, guest of John Hammond (@_JohnHammond) with Justin Kohler (@JustinKohler10)
- IT Defense: Exposing SCCM and MSSQL Attack Paths with BloodHound
- SO-CON 2025: The Admin's Guide to Preventing SCCM Attacks, with Garrett Foster (@unsigned_sh0rt)
- Detection: Challenging Paradigms, with Jared Atkinson (@jaredcatkinson) and Luke Paine (@v3r5ace)
- MMS Flamingo Edition 2024: Defense Against the Dark Arts, Stealing ConfigMgr Credentials, with Tom Degreef (@TomDegreef) and Kim Oppalfens (@TheWMIGuy)
- MMS Flamingo Edition 2024: Defending the Castle, 5 Years Later, guest speaker with Tom Degreef (@TomDegreef) and Kim Oppalfens (@TheWMIGuy)
- DEF CON Demo Labs 2024: Maestro - Abusing Intune for Lateral Movement Over C2
- DEF CON Workshops 2024: Offensive SCCM - Abusing Microsoft's C2 Framework, with Duane Michael (@subat0mik) and Garrett Foster (@unsigned_sh0rt)
- Troopers 2024: Misconfiguration Manager - Overlooked and Overprivileged, with Duane Michael (@subat0mik)
- MMSMOA 2024: Defending the Castle, 5 Years Later, guest speaker with Tom Degreef (@TomDegreef) and Kim Oppalfens (@TheWMIGuy)
- SO-CON 2024: Misconfiguration Manager - Overlooked and Overprivileged, with Duane Michael (@subat0mik)
- Black Hat USA SpecterOps Booth 2023: SharpSCCM - Abusing Microsoft's C2 Framework, with Diego Lomellini (@DiLomSec1]
- Black Hat USA Arsenal 2023: SharpSCCM - Abusing Microsoft's C2 Framework, with Diego Lomellini (@DiLomSec1)
- MMSMOA 2023: Hack the Domain with Your Favorite Management Tool, guest speaker with Sergey Chubarov and Panu Saukko
- DEF CON Demo Labs 2022: SharpSCCM, with Duane Michael (@subat0mik)
- Black Hat USA Arsenal 2022: SharpSCCM, with Duane Michael (@subat0mik)
- Microsoft Online Services (Feb 29, 2024): Getting Intune with Bugs and Tokens: A Journey Through EPM, with Zach Stein (@synzack21), Duane Michael (@subat0mik), and Garrett Foster (@unsigned_sh0rt)
- Microsoft SQL Server Elevation of Privilege (Aug 12, 2025): CVE-2025-49758
- Microsoft Configuration Manager Elevation of Privilege (November 11, 2025): CVE-2025-47179
If you're interested in collaborating, please hit me up on Twitter (@_Mayyhem) or in the BloodHoundGang Slack!