SpecterOps Blog

Industry Insights

Running From Complacency: Getting Off Your InfoSec Hamster Wheels

TL;DR Breaking free from InfoSec complacency: We discuss how security leaders can align their security strategy with business goals, evaluate…

Industry Insights

Getting the Most Value Out of the OSCP: The Exam

TL;DR A practical guide to maximizing the short- and long-term benefits of your upcoming OSCP exam attempt(s). Introduction In the…

Industry Insights

Getting the Most Value Out of the OSCP: The PEN-200 Labs

TL;DR How to leverage the PEN-200 simulated black-box penetration testing scenarios for maximal self-improvement and career success. Introduction In the…

Research & Tradecraft

Decrypting the Forest From the Trees

TL;DR: SCCM forest discovery accounts can be decrypted including accounts used for managing untrusted forests. If the site server is…

Industry Insights

Getting the Most Value Out of the OSCP: The PEN-200 Course

TL;DR In this second post of a five-part series, I provide advice on how to best utilize the PEN-200 course…

Industry Insights

Getting the Most Value Out of the OSCP: Pre-Course Prep

TL;DR The first post in a five-part practical guide series on maximizing the professional, educational, and financial value of the…

Research & Tradecraft

Entra Connect Attacker Tradecraft: Part 2

Now that we know how to add credentials to an on-premises user, lets pose a question: “Given access to a…

Industry Insights

Demystify Active Directory Certification Services (AD CS) Components

Research & Tradecraft

Attacking Entra Metaverse: Part 1

This is part one in a two (maybe three…) part series regarding attacker tradecraft around the syncing mechanics between Active…