SpecterOps Blog

BloodHound

Announcing Azure in BloodHound Enterprise

In July of 2021, we launched BloodHound Enterprise. Since then, our customers have been using BHE to easily identify and…

Research & Tradecraft

Revisiting Phishing Simulations

This post was written by Matt Hand and the rest of the SpecterOps team. Overview SpecterOps is a huge proponent…

Attack Path Management Pillars: Part 3 — Safe AD Security Remediation Guidance

Attack Path Management Pillars: Part 3 —Practical AD Security Remediation Guidance Historically, Identity Attack Paths are a double edge sword;…

Dylib Loads that Tickle your Fancy

Loading malicious dylibs into the Tclsh binary Background As detection of osascript command-line executions has increased, I started looking more into…

Research & Tradecraft

Introducing BloodHound 4.1 — The Three Headed Hound

Introducing BloodHound 4.1 — The Three Headed Hound Prior Work Analyzing Active Directory attack paths using graph theory is not a new concept.…

Research & Tradecraft

Apollo 2.0 — New Year, New Features

Introduction At the beginning of 2020, I took my first real foray into programming. Inspired by Cody Thomas’s Mythic, I…

Research & Tradecraft

Mythic 2.3 — An Interface Reborn

Mythic 2.3 — An Interface Reborn New Mythic Search Mythic started off as a proof of concept, open source project in 2018 with…

BloodHound

3 Foundational Pillars for Attack Path Management: Pillar 2 — Empirical Impact Assessment

3 Foundational Pillars for Attack Path Management: Pillar 2 — Empirical Impact Assessment Attack Paths are the chains of abusable privileges and…

Research & Tradecraft

Ghostwriter: Looking Back at 2021

It has been a while since we last published details about the Ghostwriter project, but the project has been steadily…