SpecterOps Blog

Research & Tradecraft

Reactive Progress and Tradecraft Innovation

Detection as Prediction The overarching goal of a security operations program is to prevent or mitigate the impact of an…

Industry Insights

What is Tier Zero — Part 2

What is Tier Zero — Part 2 Round 2! This is Part 2 of our webinar and blog post series Defining the Undefined:…

Research & Tradecraft

Shadow Wizard Registry Gang: Structured Registry Querying

Why Do We Need New Tooling for Registry Collection? The Windows registry, an intricate database storing settings for both the…

Research & Tradecraft

Crypto Census: Automating Cryptomining Domain Indicator Detections

Research & Tradecraft

Site Takeover via SCCM’s AdminService API

tl:dr: The SCCM AdminService API is vulnerable to NTLM relaying and can be abused for SCCM site takeover. Prior Work…

Research & Tradecraft

Hacking With Your Nemesis

In the first post in this series, On (Structured) Data, we talked about the gap area of offensive structured data…

BloodHound

BloodHound Community Edition: A New Era

I’m proud to announce the availability of BloodHound Community Edition (BloodHound CE)! What you need to know: The free and open-source…

BloodHound

BloodHound Enterprise Learns Some New Tricks

Summary The BloodHound code-convergence project brings some significant and long-desired feature enhancements to BloodHound Enterprise (BHE): Cypher search, including pre-built…

Research & Tradecraft

Challenges In Post-Exploitation Workflows

In our previous post, we talked about the problem of structured data in the post-exploitation community. We touched on the…