SpecterOps Blog

Research & Tradecraft

Entering a Covenant: .NET Command and Control

Industry Insights

Getting the Most Value Out of the OSCP: Pre-Course Prep

TL;DR The first post in a five-part practical guide series on maximizing the professional, educational, and financial value of the…

BloodHound

Enhancements for BloodHound v7.0 Provide Fresh User Experience and Attack Path Risk Optimizations

TL;DR: Refreshed user interface with a new vertical navigation layout for improved user experience. General Availability of “Improved Analysis Algorithm”…

Research & Tradecraft

Forging a Better Operator Quality of Life

A new Mythic add-on for Windows Agents Mythic provides flexibility to agent developers for how they want to describe and execute…

Research & Tradecraft

Further Adventures With CMPivot — Client Coercion

Further Adventures With CMPivot — Client Coercion Perfectly Generated AI Depiction based on Title TL:DR CMPivot queries can be used to coerce SMB authentication…

Research & Tradecraft

SlackPirate Set Sails Again! Or: How to Send the Entire “Bee Movie” Script to Your Friends in Slack

TLDR: SlackPirate has been defunct for a few years due to a breaking change in how the Slack client interacts…

BloodHound

Insurance companies can reduce risk with Attack Path Management

TL;DR Insurance companies host large amounts of sensitive data (PII, PHI, etc.) and often have complex environments due to M&A…

Research & Tradecraft

Entra Connect Attacker Tradecraft: Part 2

Now that we know how to add credentials to an on-premises user, lets pose a question: “Given access to a…

Company Updates

Life at SpecterOps Part II: From Dream to Reality

TL;DR We are hiring consultants at various levels. The job posting can be found under the Consultant opening here: https://specterops.io/careers/#careers…