SpecterOps Blog

Research & Tradecraft

Dotnet Source Generators in 2024 Part 1: Getting Started

Introduction In this blog post, we will cover the basics of a source generator, the major types involved, some common…

Research & Tradecraft

Sleeping With the Phishes

Hiding C2 With Stealthy Callback Channels Write a custom command and control (C2) implant — Check ✅ Test it on…

Research & Tradecraft

Lateral Movement with the .NET Profiler

Lateral Movement with the .NET Profiler The accompanying code for this blogpost can be found HERE. Intro I spend a lot of my…

Telemetry Layering

Introduction Creating detections can be challenging. There often isn’t a “simple” way to detect something, and once we see an…

The Defender’s Guide to Windows Services

It’s dangerous to find malicious services alone! Take this! Authors: Luke Paine & Jonathan Johnson Introduction This is the second installment of…

Research & Tradecraft

Dealing with Failure: Failure Escalation Policy in CLR Hosts

Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is an important part of…

Research & Tradecraft

Learning Machine Learning Part 2: Attacking White Box Models

In the previous post, I went through a very brief overview of some machine learning concepts, talked about the Revoke-Obfuscation…

Research & Tradecraft

1Password Secret Retrieval — Methodology and Implementation

Background and Motivation 1Password is a password manager developed by AgileBits Inc., providing a place for users to store various passwords, software licenses,…

Research & Tradecraft

Proxy Windows Tooling via SOCKS