SpecterOps Blog

Research & Tradecraft

Stalking inside of your Chromium Browser

Revisiting Remote Debugging Okay, you got your favorite agent running on the target machine. You did a process listing, but…

Research & Tradecraft

Automating Azure Abuse Research — Part 2

BloodHound

Introducing BloodHound 4.2 — The Azure Refactor

Introducing BloodHound 4.2 — The Azure Refactor The BloodHound Enterprise team is proud to announce the release of BloodHound 4.2 — The Azure Refactor. The…

Research & Tradecraft

The Phantom Credentials of SCCM: Why the NAA Won’t Die

TL;DR — Stop Using Network Access Accounts! If a Windows machine has ever been an SCCM client, there may be credential blobs…

BloodHound

Establish security boundaries in your on-prem AD and Azure environment

Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after years…

Research & Tradecraft

Managed Identity Attack Paths, Part 3: Function Apps

Intro and Prior Work In this three part blog series we have explored attack paths that emerge out of Managed Identity…

Research & Tradecraft

Managed Identity Attack Paths, Part 2: Logic Apps

Intro and Prior Work In this three part blog series we are exploring attack paths that emerge out of Managed Identity…

Research & Tradecraft

Managed Identity Attack Paths, Part 1: Automation Accounts

Intro and Prior Work In this three part blog series we will explore attack paths that emerge out of Managed Identity…

Research & Tradecraft

Automating Azure Abuse Research — Part 1

Automating Azure Abuse Research — Part 1 Intro Back in February of 2020 Karl Fosaaen published a great blog post about abusing Managed…