SpecterOps Blog

Research & Tradecraft

Lateral Movement: Abuse the Power of DCOM Excel Application

In this post, we will talk about an interesting lateral movement technique called ActivateMicrosoftApp() method within the distributed component object…

Research & Tradecraft

CVE-2023–4632: Local Privilege Escalation in Lenovo System Updater

Version: Lenovo Updater Version <= 5.08.01.0009 Operating System Tested On: Windows 10 22H2 (x64) Vulnerability: Lenovo System Updater Local Privilege…

Domain of Thrones: Part I

Written by Nico Shyne & Josh Prager The Game of Domain Dominance Just as in the political landscape of Westeros, defenders…

Research & Tradecraft

On Detection: Tactical to Functional

Part 9: Perception vs. Conception The concepts discussed in this post are related to those discussed in the 9th session…

Research & Tradecraft

BloodHound Enterprise: Securing Active Directory Using Graph Theory

BloodHound Enterprise: Securing Active Directory Using Graphs Prior to my employment at SpecterOps, I hadn’t worked in the information security…

Research & Tradecraft

Part 9: Perception vs. Conception

Research & Tradecraft

Uncovering RPC Servers through Windows API Analysis

Intro Have you ever tried to reverse a simple Win32 API? If not, let’s look at one together today! This…

Research & Tradecraft

Perfect Loader Implementations

Thank you to SpecterOps for supporting this research and to Lee and Sarah for proofreading and editing! Crossposted on GitHub. TLDR:…

Research & Tradecraft

SCCM Hierarchy Takeover

One Site to Rule Them All tl;dr: There is no security boundary between sites in the same hierarchy. When an administrative…