This week, Zac chats with Jude Keenan. Jude is a Director of Red Teaming for Aon. Zac and Jude discuss Bloodhound for Active Directory enumeration (https://github.com/SpecterOps/BloodHound-Legacy), use of nested Microsoft Scheduled Tasks for EDR evasion during an internal penetration test, and finally cover some unique challenges that can arise on physical pentests!
Episode Summary
In Episode 7 of War Stories, host Zac Davis talks with Jude Keenan, a vice president at Aon who runs the red team and manages penetration testing projects. They get into Active Directory attack paths, certificate abuse, and the internal penetration test that turned into a chain of nested scheduled tasks.
Jude studied health policy at Penn State with a focus on security, started his career at a healthcare company, and earned his OSCP on his own after hours to move into penetration testing. He talks through BloodHound for Active Directory enumeration, including how to collect data quietly and analyze it offline in multi-domain environments, and how Active Directory Certificate Services (ADCS) misconfigurations let a tester request a certificate as another user and use it with Rubeus.
His war story is an internal penetration test where the direct route was blocked. Jude mapped the plan on a glass office wall, then built it one scheduled task at a time: copy ProcDump from his share to the first host, schedule a task on the Exchange server from there, keep hopping until he reached the system holding the credentials, dump them, and move the file back the same way. The timing had to be precise, and the nested scheduled tasks helped him avoid EDR along the way.
In This Episode
- Jude Keenan's path from health policy to leading a red team at Aon
- Earning the OSCP independently to break into penetration testing
- BloodHound for Active Directory enumeration and attack path analysis
- Active Directory Certificate Services (ADCS) abuse and certificate-based escalation
- Chaining nested scheduled tasks and ProcDump for credential access and EDR evasion
Could Your EDR See an Attack Like This?
Real attackers chain small, quiet steps until they reach what matters. SEVN-X runs red team engagements, purple team exercises, and internal penetration tests that show how far an attacker could get and whether your detection would catch it. Talk with our team about scoping a test for your organization.
