The SpecterOps Difference

SpecterOps aspires to set the cadence for the rest of the security industry and bring unique insight into the advanced threat actor tradecraft. Our team has deep experience built through helping hundreds of clients shut down attack paths, evaluate, and develop security operations programs, providing premier training courses to thousands of students in advanced adversary Tactics, Techniques, and Procedures (TTPs), and sponsoring numerous projects to help the industry as a whole.

Industry Experts

Our team consists of some of the most sought-after industry experts, bringing deep knowledge of adversary tradecraft and years of experience in attack path management and improving detection and response capabilities across both commercial and government sectors.

Community Contributions

You have likely found many of our team members speaking at industry conferences on the latest adversary tools and techniques, providing numerous research papers and posts, and developing some of the most widely used open-source tools in the industry.

Unsurpassed Transparency

Our team members are on the forefront of security research, and we are always willing to share our knowledge openly. The objective of every solution we offer is to provide our customers with capabilities to improve their own security operations, not only while we’re there, but even after we’re gone.

How we can help

We Outfit Your Organization for Defense


Assessment Services


Assessment Services

Leveraging expertise built through years of experience and assessments across industries and hundreds of environments, our operators use our understanding of advanced Tactics, Techniques, and Procedures (TTPs) to effectively assess and improve your security posture and ability to respond to today’s sophisticated attacks.


Program Development


Program Development

Whether you are building new adversary detection and simulation teams or looking to mature existing competencies, we provide an effective approach focused on comprehensively integrating technical components into the overall security operations program, ensuring robust prevention, detection, and response capabilities.


Training Solutions


Training Solutions

The human component to any security program is critical. Building fundamental knowledge and perfecting the skills necessary to protect the enterprise through realistic training is essential to robust security programs. Our training courses and solutions equip participants with the skills to attack, defend, and harden their environments against advanced threat actors.


BloodHound Enterprise

BloodHound Enterprise

BloodHound Enterprise

From the creators of BloodHound, an Attack Path Management solution that continuously maps and quantifies Active Directory Attack Paths. Remove millions of Attack Paths within your existing architecture and eliminate the attacker’s easiest, most reliable, and most attractive target.

Our community commitment

We’re Sharing Our Tools Openly For Our Community

In the spotlight

Topics We’re Discussing


Mythic v3.2 Highlights: Interactive Tasking, Push C2, and Dynamic File Browser

TL;DR; Mythic v3.2 has Push C2, Interactive Async Tasking, TypedArray parameters, new graphing libraries in the UI, database migrations, dynamic file browser groupings, and more! Image Generated by Mythic v3.2 It’s been a few months since the last Mythic update, so it’s time to release a new version! This version has many major updates from […]

9 min read | Nov 29
Cody Thomas

Merlin’s Evolution: Multi-Operator CLI and Peer-to-Peer Magic

Image Generated by Over the past year, I’ve been working on making significant updates to Merlin in my free time. Today, I’m ready to release version 2 of Merlin. Some of the more significant updates include: A new command-line interface (CLI) application which allows multiple operators to use Merlin at the same time Peer-to-peer (p2p) agent […]

8 min read | Nov 15
russel van tuyl

On Detection: Tactical to Functional

Part 11: Functional Composition Introduction Welcome back to part 11 of the On Detection blog series. This next article serves as a conceptual foundation upon which we will build over the next few posts. It may not be immediately obvious why this is important, but understanding this concept will make many subsequent ideas much easier […]

19 min read | Nov 14
Jared Atkinson

Lateral Movement without Lateral Movement (Brought to you by ConfigMgr)

Introduction Earlier this year, I submitted a pull request to SharpSCCM’s repository. SharpSCCM is a tool that Chris Thompson developed with the purpose of demonstrating possible attacks against Microsoft Configuration Manager (ConfigMgr, formerly Microsoft Systems Center Configuration Manager [SCCM]) deployments. The submitted PR was meant to extend SharpSCCM’s functionality by implementing the option of executing […]

9 min read | Nov 07
diego lomellini

On Detection: Tactical to Functional

Part 10: Implicit Process Create Introduction Welcome back to another installment of the On Detection: Tactical to Functional series. In the previous article, I argued that we perceive actions within our environment at the Operational level (especially when it comes to endpoint events), which means that we should “conceive” of attacker tradecraft at the Operational level […]

21 min read | Nov 01
Jared Atkinson

Lateral Movement: Abuse the Power of DCOM Excel Application

In this post, we will talk about an interesting lateral movement technique called ActivateMicrosoftApp() method within the distributed component object model (DCOM) Excel application. This technique is built upon Matt Nelson’s initial research on “Lateral Movement using Excel.Application and DCOM”. What is DCOM? DCOM is a Microsoft solution that allows software components to communicate remotely. Its predecessor, […]

9 min read | Oct 30
raj patel

On Detection: Tactical to Functional

Part 9: Perception vs. Conception The concepts discussed in this post are related to those discussed in the 9th session of the DCP Live podcast. If you find this information interesting, I highly recommend checking the session out! At this point in the series, we understand that attack techniques are abstract concepts that must be […]

17 min read | Oct 20
Jared Atkinson

Bloodhound Enterprise: securing Active Directory using graph theory

BloodHound Enterprise: securing Active Directory using graphs Prior to my employment at SpecterOps, I hadn’t worked in the information security industry- as a result, many security related terms and concepts that were tossed around casually (not just within SpecterOps, but also by the open source community using BloodHound) befuddled me, as did trying to apperceive how […]

5 min read | Oct 20
irshad ajmal ahmed

Perfect Loader Implementations

Thank you to SpecterOps for supporting this research and to Lee and Sarah for proofreading and editing! Crossposted on GitHub. TLDR: You may use fuse-loader or perfect-loader as examples for extending an OS’s native loader to support in-memory libraries. Some software applications require the ability to load dynamic libraries from the memory of the application’s own […]

5 min read | Oct 09
Evan McBroom

SCCM Hierarchy Takeover

One Site to Rule Them All tl;dr: There is no security boundary between sites in the same hierarchy. When an administrative user is granted a security role in SCCM, such as Full Administrator or Infrastructure Administrator, in any primary site, the underlying database changes propagate upward to the central administration site (CAS) and then to other […]

12 min read | Sep 25
Chris Thompson