The SpecterOps Difference

SpecterOps aspires to set the cadence for the rest of the security industry and bring unique insight into the advanced threat actor tradecraft. Our team has deep experience built through helping hundreds of clients shut down attack paths, evaluate, and develop security operations programs, providing premier training courses to thousands of students in advanced adversary Tactics, Techniques, and Procedures (TTPs), and sponsoring numerous projects to help the industry as a whole.

Industry Experts

Our team consists of some of the most sought-after industry experts, bringing deep knowledge of adversary tradecraft and years of experience in attack path management and improving detection and response capabilities across both commercial and government sectors.

Community Contributions

You have likely found many of our team members speaking at industry conferences on the latest adversary tools and techniques, providing numerous research papers and posts, and developing some of the most widely used open-source tools in the industry.

Unsurpassed Transparency

Our team members are on the forefront of security research, and we are always willing to share our knowledge openly. The objective of every solution we offer is to provide our customers with capabilities to improve their own security operations, not only while we’re there, but even after we’re gone.

Upcoming Events

Join Us at Our Upcoming Talks & Trainings

We share our operational knowledge and lessons learned in the field with your team to hone their skill sets, their efficiency, and ultimately better secure your business.

How we can help

We Outfit Your Organization for Defense

Evaluate

Assessment Services

Assessment

Assessment Services

Leveraging expertise built through years of experience and assessments across industries and hundreds of environments, our operators use our understanding of advanced Tactics, Techniques, and Procedures (TTPs) to effectively assess and improve your security posture and ability to respond to today’s sophisticated attacks.

Develop

Program Development

Simulation

Program Development

Whether you are building new adversary detection and simulation teams or looking to mature existing competencies, we provide an effective approach focused on comprehensively integrating technical components into the overall security operations program, ensuring robust prevention, detection, and response capabilities.

Equip

Training Solutions

Training

Training Solutions

The human component to any security program is critical. Building fundamental knowledge and perfecting the skills necessary to protect the enterprise through realistic training is essential to robust security programs. Our training courses and solutions equip participants with the skills to attack, defend, and harden their environments against advanced threat actors.

Secure

BloodHound Enterprise

BloodHound Enterprise

BloodHound Enterprise

From the creators of BloodHound, an Attack Path Management solution that continuously maps and quantifies Active Directory Attack Paths. Remove millions of Attack Paths within your existing architecture and eliminate the attacker’s easiest, most reliable, and most attractive target.

Our community commitment

We’re Sharing Our Tools Openly For Our Community

In the spotlight

Topics We’re Discussing

Blog

Browserless Entra Device Code Flow

Zugspitze, Bavaria, Germany. Photo by Andrew Chiles Did you know that it is possible to perform every step in Entra’s OAuth 2.0 Device Code flow — including the user authentication steps — without a browser? Why that matters: Automating authentication flows enables and accelerates comprehensive and ongoing offensive research Headless authentication frees red teamers and pentesters from requiring browser or cookie access Demonstrating […]

8 min read | Mar 06
Andy Robbins
Blog

Misconfiguration Manager: Overlooked and Overprivileged

TL;DR: Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance. We’re also presenting this material at SO-CON 2024 on March 11, 2024. We’ll update this post with a link to the recording when it becomes available. Background Suppose you’ve been following offensive security research […]

12 min read | Mar 05
Duane Michael
Blog

Final Steps to BloodHound Federal — FedRAMP High Compliance

Final Steps to BloodHound Federal — FedRAMP High Compliance Ever since SpecterOps first launched BloodHound Enterprise (BHE) in July 2021, one of our team’s biggest frustrations involved a lack of FedRAMP qualifications, which prevented us from supporting a large set of desired users; specifically in the federal space. This is why I am both proud and happy […]

2 min read | Mar 05
Justin Kohler
Blog

ADCS ESC13 Abuse Technique

It is possible to configure an Active Directory Certificate Services (ADCS) certificate template with an issuance policy having an OID group link to a given AD group.

14 min read | Feb 14
Jonas Bülow Knudsen
Blog

Spinning Webs — Unveiling Arachne for Web Shell C2

Spinning Webs — Unveiling Arachne for Web Shell C2 What is a web shell? A web shell is a payload that allows continued access to a remote system, just like other “shells” we refer to in computer security. What makes a web shell a little different is that it’s not beaconing out to a command-and-control (C2) server, nor is […]

11 min read | Feb 07
Cody Thomas
Blog

ADCS Attack Paths in BloodHound — Part 1

ADCS Attack Paths in BloodHound — Part 1 Since Will Schroeder and Lee Christensen published the Certified Pre-Owned whitepaper, the BloodHound Enterprise team at SpecterOps has been eager to implement Active Directory Certificate Services (ADCS) attack paths in BloodHound. However, the complexity of ADCS presented challenges in creating simple-to-use BloodHound edges for covering ADCS domain escalations. That’s why […]

14 min read | Jan 24
Jonas Bülow Knudsen
Blog

Cypher Queries in BloodHound Enterprise

BloodHound Enterprise (BHE) recently saw the addition of a new, game-changing feature: open-ended Cypher searches. For those unfamiliar, Cypher is a declarative query language used for retrieving data from a graph database (in this case, Neo4j). As you’ll soon see, the nature of Cypher is one that helps drive the concept of relationships between nodes […]

10 min read | Jan 10
nathan d.
Blog

Sleepy — Python Tooling for Sleep

Sleepy — Python Tooling for Sleep Thank you to SpecterOps for supporting this research and to Sarah, Cody, and Daniel for proofreading and editing! Crossposted on the GitHub. TL;DR: You can use sleepy to automate common tasks when working with Sleep code. Raphael Mudge created the embeddable scripting language, Sleep, in April 2002. Sleep was designed to extend Java applications […]

6 min read | Dec 14
Evan McBroom
Blog

Mythic v3.2 Highlights: Interactive Tasking, Push C2, and Dynamic File Browser

TL;DR; Mythic v3.2 has Push C2, Interactive Async Tasking, TypedArray parameters, new graphing libraries in the UI, database migrations, dynamic file browser groupings, and more! Image Generated by https://hotpot.ai/art-generator Mythic v3.2 It’s been a few months since the last Mythic update, so it’s time to release a new version! This version has many major updates from […]

9 min read | Nov 29
Cody Thomas
Blog

Merlin’s Evolution: Multi-Operator CLI and Peer-to-Peer Magic

Image Generated by https://hotpot.ai/art-generator Over the past year, I’ve been working on making significant updates to Merlin in my free time. Today, I’m ready to release version 2 of Merlin. Some of the more significant updates include: A new command-line interface (CLI) application which allows multiple operators to use Merlin at the same time Peer-to-peer (p2p) agent […]

8 min read | Nov 15
russel van tuyl