Logan Goins is a lead operator and security consultant on the SpecterOps Adversary Simulation Services team, where he leads teams of operators and executes advanced Adversary Simulation exercises for enterprise clients. His published research focuses on Active Directory, identity attack paths, and operationalizing offensive security capability. He is the author of a variety of offensive identity-driven tools including SOAPy and SharpSuccessor.
A summary of Logan’s security research, capability/tradecraft development, and community contributions, can be found below:
- Experience:
- Consultant, Adversary Simulation at SpecterOps (May 2026 - Present)
- Associate Consultant, Adversary Simulation at SpecterOps (May 2025 to May 2026)
- Offensive Security Consultant Co-op at IBM X-Force Red (January 2025 to May 2025)
- Offensive Security Consultant Intern at IBM X-Force Red (May 2024 to August 2024)
- Education:
- Bachelor of Business Administration, Cybersecurity, UT San Antonio
- Tooling Development:
- BadTakeover, Beacon Object File (BOF) for Using the BadSuccessor Technique for Account Takeover (Sep 2025)
- SharpSuccessor, .NET Proof of Concept (POC) for fully weaponizing Yuval Gordon’s (@YuG0rd) BadSuccessor attack from Akamai. (May 2025)
- Stifle, a .NET post-exploitation utility to exploit strong explicit certificate mappings (ESC14) for account takeover in Active Directory environments. (Feb 2025)
- Krueger, Proof of Concept (PoC) .NET tool for remotely disabling EDR with weaponized WDAC to enable lateral movement. (Dec 2024)
- Cable, .NET post-exploitation toolkit for Active Directory reconnaissance and exploitation. (Nov 2024)
- SOAPy, Proof of Concept (PoC) Python tool for conducting offensive interaction with Active Directory Web Services (ADWS) from Linux hosts. (Aug 2024)
- Major Blogs:
- There and Back Again: An Operators Guide on NTLM Relaying Egress (July 2026)
- Wait, Why is my WebClient Started? - SCCM Hierarchy Takeover via NTLM Relay to LDAP (Jan 2026)
- The (Near) Return of the King: Account Takeover Using the BadSuccessor Technique (Oct 2025)
- Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP (Aug 2025)
- Make Sure to Use SOAP(y) – An Operators Guide to Stealthy AD Collection Using ADWS (July 2025)
- Attacking and Defending Configuration Manager - An Attackers Easy Win (April 2025)
- SOAPy: Stealthy enumeration of Active Directory environments through ADWS (Feb 2025)
- Using Offensive .NET to Enumerate and Exploit Active Directory Environments (Oct 2024)
- NTLM Relaying to LDAP - The Hail Mary of Network Compromise (July 2024)
- Active Directory Certificate Services (AD CS) - A Beautifully Vulnerable and Mis-configurable Mess (May 2024)
- Certifications:
- Offensive Azure AD (Entra ID) and Hybrid AD Security, Outsider Security
- Adversary Tactics: Identity Driven Offensive Tradecraft (IDOT)
- Attacking and Defending Azure & M365
- Certified Red Team Operator (CRTO)
- Offensive Security Certified Professional (OSCP)
- CompTIA Cybersecurity Analyst+ ce (CySA+) - April 2023 to April 2026
- CompTIA Security+ ce - April 2023 to April 2026
- Conference Talks:
- RedTreat 2026, Barcelona Spain, Wait, Why is my WebClient Started? - Remote WebClient Start in SCCM (September 2026)