SpecterOps Blog

BloodHound

Introducing BloodHound Enterprise: Attack Path Management for Everyone

Five years ago, we released BloodHound on stage at DEFCON 24. Since then, BloodHound has helped reshape how penetration testers and…

Research & Tradecraft

Learning from our Myths

Research & Tradecraft

Certified Pre-Owned

L;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate…

Research & Tradecraft

Shadow Credentials: Abusing Key Trust Account Mapping for Account Takeover

Research & Tradecraft

Proxy Windows Tooling via SOCKS

BloodHound

BloodHound versus Ransomware: A Defender’s Guide

Intro You don’t need me to tell you how dangerous and destructive ransomware is. It seems like every week there…

Research & Tradecraft

An Introduction to Manual Active Directory Querying with Dsquery and Ldapsearch

Introduction Let’s be honest, BloodHound and PowerView are objectively better tools for querying, enumerating, and investigating Active Directory (AD). They are more efficient, intuitive…

Research & Tradecraft

Evadere Classifications

Introduction The term evasion is derived from the Latin word “evadere” which means — “To escape, to get away.” The DOD defines…

Research & Tradecraft

Saving Your Access

Screensavers for macOS Persistence Background After revisiting old internal discussions, an area of interest was the possibility of using screensavers…