SpecterOps Blog

Research & Tradecraft

On Detection: Tactical to Functional

Part 9: Perception vs. Conception The concepts discussed in this post are related to those discussed in the 9th session…

Research & Tradecraft

BloodHound Enterprise: Securing Active Directory Using Graph Theory

BloodHound Enterprise: Securing Active Directory Using Graphs Prior to my employment at SpecterOps, I hadn’t worked in the information security…

Research & Tradecraft

Part 9: Perception vs. Conception

Research & Tradecraft

Uncovering RPC Servers through Windows API Analysis

Intro Have you ever tried to reverse a simple Win32 API? If not, let’s look at one together today! This…

Research & Tradecraft

Perfect Loader Implementations

Thank you to SpecterOps for supporting this research and to Lee and Sarah for proofreading and editing! Crossposted on GitHub. TLDR:…

Research & Tradecraft

SCCM Hierarchy Takeover

One Site to Rule Them All tl;dr: There is no security boundary between sites in the same hierarchy. When an administrative…

Research & Tradecraft

Ghostwriter v4: 2FA, RBAC, and Logging, Oh My!

Ghostwriter v4 is officially here! Technically, it’s been available as a release candidate for a while, but we have arrived…

Research & Tradecraft

Reactive Progress and Tradecraft Innovation

Detection as Prediction The overarching goal of a security operations program is to prevent or mitigate the impact of an…

Industry Insights

What is Tier Zero — Part 2

What is Tier Zero — Part 2 Round 2! This is Part 2 of our webinar and blog post series Defining the Undefined:…