SpecterOps Blog

Research & Tradecraft

AI Gated Loader: Teaching Code to Decide Before It Acts

TL;DR AI gated loaders collect telemetry, apply a policy with an LLM, and execute only when defined OPSEC rules are…

Research & Tradecraft

This One Weird Trick: Multi-Prompt LLM Jailbreaks (Safeguards Hate It!)

TL;DR: Using multiple prompts within the context of a conversation with an LLM can lead to safeguard bypasses. How can…

Research & Tradecraft

Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP

TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP…

Research & Tradecraft

Transforming Red Team Ops with Mythic’s Hidden Gems: Browser Scripting

TL;DR Mythic’s browser scripting provides tons of flexibility that operators can tailor to their unique needs to best analyze the…

Pantheon Introduction: A Guide and Script Collection for Mythic Eventing

TL;DR Mythic Eventing automates repetitive tasks during red team operations (RTO). This blog documents the eventing system and provides a…

Research & Tradecraft

Nemesis 2.0

TL;DR We took a chainsaw to Nemesis 1.0, kept the parts that operators loved (i.e., automated file processing), and rebuilt…

Research & Tradecraft

Make Sure to Use SOAP(y) – An Operators Guide to Stealthy AD Collection Using ADWS

Learn how to perform stealthy recon of Active Directory environments over ADWS for Red Team Assessments

Research & Tradecraft

Ghostwriter v6 is Live!

TL;DR: Ghostwriter now supports real-time collaborative editing for observations, findings, and report fields using the YJS framework, Tiptap editor, and…

BloodHound

LudusHound: Raising BloodHound Attack Paths to Life

TL;DR LudusHound is a tool for red and blue teams that transforms BloodHound data into a fully functional, Active Directory…