SpecterOps Blog

Research & Tradecraft

Getting Started with BHE — Part 2

Contextualizing Tier Zero TL;DR An accurately defined Tier Zero provides an accurate depiction of Attack Path Findings in your BHE tenant. Different…

Research & Tradecraft

Getting Started with BHE — Part 1

Understanding Collection, Permissions, and Visibility of Your Environment TL;DR Attack Path visibility is dependent upon scope of collection; complete collection…

Research & Tradecraft

Decrypting the Forest From the Trees

TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is…

BloodHound

Fueling the Fight Against Identity Attacks

When we founded SpecterOps, one of our core principles was to build a company which brought unique insight into high-capability…

Industry Insights

Getting the Most Value Out of the OSCP: The PEN-200 Course

TL;DR In this second post of a five-part series, I provide advice on how to best utilize the PEN-200 course…

Research & Tradecraft

Don’t Touch That Object! Finding SACL Tripwires During Red Team Ops

During red team operations, stealth is a critical component. We spend a great deal of time ensuring our payloads will…

Research & Tradecraft

Entering a Covenant: .NET Command and Control

Industry Insights

Getting the Most Value Out of the OSCP: Pre-Course Prep

TL;DR The first post in a five-part practical guide series on maximizing the professional, educational, and financial value of the…

BloodHound

Enhancements for BloodHound v7.0 Provide Fresh User Experience and Attack Path Risk Optimizations

TL;DR: Refreshed user interface with a new vertical navigation layout for improved user experience. General Availability of “Improved Analysis Algorithm”…