SpecterOps Blog

Domain of Thrones: Part I

Written by Nico Shyne & Josh Prager The Game of Domain Dominance Just as in the political landscape of Westeros, defenders…

Research & Tradecraft

Ghostwriter v4: 2FA, RBAC, and Logging, Oh My!

Ghostwriter v4 is officially here! Technically, it’s been available as a release candidate for a while, but we have arrived…

Industry Insights

What is Tier Zero — Part 2

What is Tier Zero — Part 2 Round 2! This is Part 2 of our webinar and blog post series Defining the Undefined:…

Industry Insights

What is Tier Zero — Part 1

What is Tier Zero — Part 1 Tier Zero is a crucial group of assets in Active Directory (AD) and Azure. Its purpose…

Research & Tradecraft

Less SmartScreen More Caffeine: (Ab)Using ClickOnce for Trusted Code Execution

The contents of this blogpost was written by Nick Powers (@zyn3rgy) and Steven Flores (@0xthirteen), and is a written version…

Industry Insights

Security Distilled: Building a First-Principles Approach to Understanding Security

By Nathan Davis This body of work also appears in the form of a webinar, which can be accessed here. What is…

Research & Tradecraft

Introducing BloodHound 4.3 — Get Global Admin More Often

Introducing BloodHound 4.3 — Get Global Admin More Often Discover new attack paths traversing Microsoft Graph and seven new Azure Resource Manager objects. Checking…

Research & Tradecraft

I’d TAP That Pass

Summary: Given that: Temporary Access Passes (TAP) are enabled in the Azure AD tenant AND You have an authentication admin…

Research & Tradecraft

Abusing Azure App Service Managed Identity Assignments

Intro Azure App Service is a Platform-as-a-Service product that promises to improve web application deployment, hosting, availability, and security. Web…