SpecterOps Blog

Research & Tradecraft

Mythic 2.3 — An Interface Reborn

Mythic 2.3 — An Interface Reborn New Mythic Search Mythic started off as a proof of concept, open source project in 2018 with…

BloodHound

3 Foundational Pillars for Attack Path Management: Pillar 2 — Empirical Impact Assessment

3 Foundational Pillars for Attack Path Management: Pillar 2 — Empirical Impact Assessment Attack Paths are the chains of abusable privileges and…

Research & Tradecraft

Ghostwriter: Looking Back at 2021

It has been a while since we last published details about the Ghostwriter project, but the project has been steadily…

BloodHound

3 Foundational Pillars for Attack Path Management: Pillar 1 — Continuous & Comprehensive Mapping

3 Foundational Pillars for Attack Path Management: Pillar 1 — Continuous & Comprehensive Mapping When we coined the term “Attack Path Management”…

Research & Tradecraft

Azure Privilege Escalation via Azure API Permissions Abuse

Intro and Prior Work Microsoft’s Azure is a complicated system of principals, securable objects, and the various ways access is…

BloodHound

Active Directory Attack Paths — “Is everyone this bad?”

Active Directory Attack Paths — “Is it always this bad?” We launched BloodHound Enterprise to help organizations manage Attack Paths in Active Directory…

Research & Tradecraft

Capability Abstraction Case Study: Detecting Malicious Boot Configuration Modifications

Research & Tradecraft

Azure Privilege Escalation via Service Principal Abuse

Intro and Prior Work On-prem Active Directory is here to stay, and so is Azure Active Directory. While these products…

Research & Tradecraft

AWS ReadOnlyAccess: Not Even Once