SpecterOps Blog

BloodHound

Active Directory Attack Paths — “Is everyone this bad?”

Active Directory Attack Paths — “Is it always this bad?” We launched BloodHound Enterprise to help organizations manage Attack Paths in Active Directory…

Research & Tradecraft

Capability Abstraction Case Study: Detecting Malicious Boot Configuration Modifications

Research & Tradecraft

Azure Privilege Escalation via Service Principal Abuse

Intro and Prior Work On-prem Active Directory is here to stay, and so is Azure Active Directory. While these products…

Research & Tradecraft

AWS ReadOnlyAccess: Not Even Once

Research & Tradecraft

Entity Based Detection Engineering with BloodHound Enterprise

Critical Attack Path with Auditing Table of Contents Introduction Enterprise Access Model BloodHound and Detection BloodHound Enterprise Entity Based Detection Engineering Kerberoastable Users…

Research & Tradecraft

1Password Secret Retrieval — Methodology and Implementation

Background and Motivation 1Password is a password manager developed by AgileBits Inc., providing a place for users to store various passwords, software licenses,…

Research & Tradecraft

Playing Detection with a Full Deck

BloodHound

Introducing BloodHound Enterprise: Attack Path Management for Everyone

Five years ago, we released BloodHound on stage at DEFCON 24. Since then, BloodHound has helped reshape how penetration testers and…

Research & Tradecraft

Learning from our Myths