SpecterOps Blog

Research & Tradecraft

Beyond Procedures: Digging into the Function Call Stack

Within the cybersecurity industry, many of us have a natural inclination towards digging into technical concepts and understanding what is…

BloodHound

FOSS BloodHound 4.3.1 release

We are excited to share the release of BloodHound version 4.3.1. We have accepted a lot of pull requests made…

Industry Insights

Security Distilled: Building a First-Principles Approach to Understanding Security

By Nathan Davis This body of work also appears in the form of a webinar, which can be accessed here. What is…

Research & Tradecraft

From DA to EA with ESC5

There’s a new, practical way to escalate from Domain Admin to Enterprise Admin. ESC5 You’ve heard of ESC1 and ESC8.…

Research & Tradecraft

C2 and the Docker Dance: Mythic 3.0’s Marvelous Microservice Moves

— Title by ChatGPT for introducing Mythic 3.0 What is Mythic? Mythic is a plug-n-play command and control (C2) framework that heavily…

Research & Tradecraft

Exploring Impersonation through the Named Pipe Filesystem Driver

Introduction Impersonation happens often natively in Windows, however, adversaries also use it to run code in the context of another…

Research & Tradecraft

Introducing BloodHound 4.3 — Get Global Admin More Often

Introducing BloodHound 4.3 — Get Global Admin More Often Discover new attack paths traversing Microsoft Graph and seven new Azure Resource Manager objects. Checking…

Research & Tradecraft

I’d TAP That Pass

Summary: Given that: Temporary Access Passes (TAP) are enabled in the Azure AD tenant AND You have an authentication admin…

Uncovering Windows Events

Threat Intelligence ETW Not all manifest-based Event Tracing for Windows (ETW) providers that are exposed through Windows are ingested into…