SpecterOps Blog

Research & Tradecraft

Automating Azure Abuse Research — Part 1

Automating Azure Abuse Research — Part 1 Intro Back in February of 2020 Karl Fosaaen published a great blog post about abusing Managed…

Research & Tradecraft

Abusing Azure Container Registry Tasks

Intro and Prior Work More and more organizations are adopting cloud computing, migrating existing business processes and creating new business processes…

BloodHound

Announcing Azure in BloodHound Enterprise

In July of 2021, we launched BloodHound Enterprise. Since then, our customers have been using BHE to easily identify and…

Attack Path Management Pillars: Part 3 — Safe AD Security Remediation Guidance

Attack Path Management Pillars: Part 3 —Practical AD Security Remediation Guidance Historically, Identity Attack Paths are a double edge sword;…

BloodHound

3 Foundational Pillars for Attack Path Management: Pillar 2 — Empirical Impact Assessment

3 Foundational Pillars for Attack Path Management: Pillar 2 — Empirical Impact Assessment Attack Paths are the chains of abusable privileges and…

BloodHound

3 Foundational Pillars for Attack Path Management: Pillar 1 — Continuous & Comprehensive Mapping

3 Foundational Pillars for Attack Path Management: Pillar 1 — Continuous & Comprehensive Mapping When we coined the term “Attack Path Management”…

Research & Tradecraft

Azure Privilege Escalation via Azure API Permissions Abuse

Intro and Prior Work Microsoft’s Azure is a complicated system of principals, securable objects, and the various ways access is…

Research & Tradecraft

Azure Privilege Escalation via Service Principal Abuse

Intro and Prior Work On-prem Active Directory is here to stay, and so is Azure Active Directory. While these products…

Research & Tradecraft

AWS ReadOnlyAccess: Not Even Once