SpecterOps Blog

Industry Insights

Security Distilled: Building a First-Principles Approach to Understanding Security

By Nathan Davis This body of work also appears in the form of a webinar, which can be accessed here. What is…

Research & Tradecraft

From DA to EA with ESC5

There’s a new, practical way to escalate from Domain Admin to Enterprise Admin. ESC5 You’ve heard of ESC1 and ESC8.…

Research & Tradecraft

C2 and the Docker Dance: Mythic 3.0’s Marvelous Microservice Moves

— Title by ChatGPT for introducing Mythic 3.0 What is Mythic? Mythic is a plug-n-play command and control (C2) framework that heavily…

Research & Tradecraft

Exploring Impersonation through the Named Pipe Filesystem Driver

Introduction Impersonation happens often natively in Windows, however, adversaries also use it to run code in the context of another…

Research & Tradecraft

Introducing BloodHound 4.3 — Get Global Admin More Often

Introducing BloodHound 4.3 — Get Global Admin More Often Discover new attack paths traversing Microsoft Graph and seven new Azure Resource Manager objects. Checking…

Research & Tradecraft

I’d TAP That Pass

Summary: Given that: Temporary Access Passes (TAP) are enabled in the Azure AD tenant AND You have an authentication admin…

Uncovering Windows Events

Threat Intelligence ETW Not all manifest-based Event Tracing for Windows (ETW) providers that are exposed through Windows are ingested into…

Research & Tradecraft

Abusing Azure App Service Managed Identity Assignments

Intro Azure App Service is a Platform-as-a-Service product that promises to improve web application deployment, hosting, availability, and security. Web…

Telemetry Layering

Introduction Creating detections can be challenging. There often isn’t a “simple” way to detect something, and once we see an…