SpecterOps Blog

BloodHound

Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs

In conversation: Pete McKernan & Luke Luckett As organizations seek to wrap their arms around potential cybersecurity exposures, CIOs and CISOs…

Research & Tradecraft

ADCS Attack Paths in BloodHound — Part 3

ADCS Attack Paths in BloodHound — Part 3 In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services…

Research & Tradecraft

Lateral Movement with the .NET Profiler

Lateral Movement with the .NET Profiler The accompanying code for this blogpost can be found HERE. Intro I spend a lot of my…

Research & Tradecraft

LSA Whisperer

Thank you to SpecterOps for supporting this research, to Elad for helping draft this blog, and to Sarah, Daniel, and…

Research & Tradecraft

Getting Intune with Bugs and Tokens: A Journey Through EPM

Written by Zach Stein & Duane Michael SpecterOps Hackathon Back in January, SpecterOps held our annual hackathon event, loosely based on…

Research & Tradecraft

Pwned by the Mail Carrier

How MS Exchange on-premises compromises Active Directory and what organizations can do to prevent that. At SpecterOps, we recommend our customers…

Research & Tradecraft

CVE-2023–4632: Local Privilege Escalation in Lenovo System Updater

Version: Lenovo Updater Version <= 5.08.01.0009 Operating System Tested On: Windows 10 22H2 (x64) Vulnerability: Lenovo System Updater Local Privilege…

Research & Tradecraft

Certificates and Pwnage and Patches, Oh My!

This post was written by Will Schroeder and Lee Christensen. A lot has happened since we released the “Certified Pre-Owned”…

On Detection: Tactical to Functional

Part 3: Expanding the Function Call Graph Introduction In the previous post in this series, I introduced the concept of operations…