SpecterOps Blog

Research & Tradecraft

Abusing Azure App Service Managed Identity Assignments

Intro Azure App Service is a Platform-as-a-Service product that promises to improve web application deployment, hosting, availability, and security. Web…

Telemetry Layering

Introduction Creating detections can be challenging. There often isn’t a “simple” way to detect something, and once we see an…

Research & Tradecraft

Ghostwriter v3.2 Release

SpecterOps has released Ghostwriter v3.2 with some significant enhancements we think you’ll like. We overhauled how you interact with operation…

Research & Tradecraft

At the Edge of Tier Zero: The Curious Case of the RODC

The read-only Domain Controller (RODC) is a solution that Microsoft introduced for physical locations that don’t have adequate security to…

The Defender’s Guide to Windows Services

It’s dangerous to find malicious services alone! Take this! Authors: Luke Paine & Jonathan Johnson Introduction This is the second installment of…

Research & Tradecraft

SCCM Site Takeover via Automatic Client Push Installation

tl;dr: Install hotfix KB15599094 and disable NTLM for client push installation. While reading SCCM Current Branch Unleashed and stepping through…

Research & Tradecraft

Passwordless Persistence and Privilege Escalation in Azure

Adversaries are always looking for stealthy means of maintaining long-term and stealthy persistence and privilege in a target environment. Certificate-Based…

Research & Tradecraft

Stalking inside of your Chromium Browser

Revisiting Remote Debugging Okay, you got your favorite agent running on the target machine. You did a process listing, but…

Uncovering Window Security Events

Part 1: TelemetrySource Data is the foundation by which defense is built upon. This data can come from various telemetry…