SpecterOps Blog

Research & Tradecraft

Maestro: Abusing Intune for Lateral Movement Over C2

If I have a command and control (C2) agent on an Intune admin’s workstation, I should just be able to…

Research & Tradecraft

Maestro: Abusing Intune for Lateral Movement Over C2

Research & Tradecraft

BOFHound: AD CS Integration

TL;DR: BOFHound can now parse Active Directory Certificate Services (AD CS) objects, manually queried from LDAP, for review and attack…

BloodHound

Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs

In conversation: Pete McKernan & Luke Luckett As organizations seek to wrap their arms around potential cybersecurity exposures, CIOs and CISOs…

Research & Tradecraft

Dotnet Source Generators in 2024 Part 1: Getting Started

Introduction In this blog post, we will cover the basics of a source generator, the major types involved, some common…

Research & Tradecraft

Ghostwriter v4.3: SSO, JSON Fields, and Reporting with BloodHound

Ghostwriter v4.3 is available now, and it enhances features introduced in previous versions of v4 in some exciting ways! In…

Research & Tradecraft

ADCS Attack Paths in BloodHound — Part 3

ADCS Attack Paths in BloodHound — Part 3 In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services…

Research & Tradecraft

Mythic 3.3 — Out of Beta

Mythic 3.3 — Out of Beta Mythic 3.3 was released in a Beta six weeks ago, and since then there has been a…

Research & Tradecraft

Ghostwriter ❤ Tool Integration

Incorporating new components into existing systems is such a pain, this process has been labeled “Integration Hell”. To ease tool…