SpecterOps Blog

Research & Tradecraft

Encrypting Strings at Compile Time

Thank you to SpecterOps for supporting this research and to Duane and Matt for proofreading and editing! Crossposted on GitHub. TLDR:…

On Detection: Tactical to Functional

Part 1: Discovering API Function Usage through Source Code Review Welcome to my new blog series, “On Detection: Tactical to Functional,”…

Research & Tradecraft

Part 1: Discovering API Function Usage through Source Code Review

Research & Tradecraft

Dealing with Failure: Failure Escalation Policy in CLR Hosts

Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is an important part of…

Research & Tradecraft

Koh: The Token Stealer

Years ago I was chatting with a few experienced red teamers and one was lamenting token abuse. Specifically, they wanted…

Research & Tradecraft

Relaying NTLM Authentication from SCCM Clients

tl;dr: Seriously, please disable NTLM I recently learned that you can coerce NTLM authentication from SCCM servers using any Windows SCCM…

Research & Tradecraft

The Phantom Credentials of SCCM: Why the NAA Won’t Die

TL;DR — Stop Using Network Access Accounts! If a Windows machine has ever been an SCCM client, there may be credential blobs…

Research & Tradecraft

Understanding the Function Call Stack

There’s more than meets the eye under the function call hood This post is based on a September 2021 Twitter thread…

BloodHound

Establish security boundaries in your on-prem AD and Azure environment

Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after years…