SpecterOps Blog

Research & Tradecraft

At the Edge of Tier Zero: The Curious Case of the RODC

The read-only Domain Controller (RODC) is a solution that Microsoft introduced for physical locations that don’t have adequate security to…

Research & Tradecraft

Passwordless Persistence and Privilege Escalation in Azure

Adversaries are always looking for stealthy means of maintaining long-term and stealthy persistence and privilege in a target environment. Certificate-Based…

Research & Tradecraft

Certificates and Pwnage and Patches, Oh My!

This post was written by Will Schroeder and Lee Christensen. A lot has happened since we released the “Certified Pre-Owned”…

Research & Tradecraft

Automating Azure Abuse Research — Part 2

BloodHound

Introducing BloodHound 4.2 — The Azure Refactor

Introducing BloodHound 4.2 — The Azure Refactor The BloodHound Enterprise team is proud to announce the release of BloodHound 4.2 — The Azure Refactor. The…

BloodHound

Establish security boundaries in your on-prem AD and Azure environment

Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after years…

Research & Tradecraft

Managed Identity Attack Paths, Part 3: Function Apps

Intro and Prior Work In this three part blog series we have explored attack paths that emerge out of Managed Identity…

Research & Tradecraft

Managed Identity Attack Paths, Part 2: Logic Apps

Intro and Prior Work In this three part blog series we are exploring attack paths that emerge out of Managed Identity…

Research & Tradecraft

Managed Identity Attack Paths, Part 1: Automation Accounts

Intro and Prior Work In this three part blog series we will explore attack paths that emerge out of Managed Identity…