SpecterOps Blog

Research & Tradecraft

Ghostwriter: Looking Back at 2021

It has been a while since we last published details about the Ghostwriter project, but the project has been steadily…

BloodHound

3 Foundational Pillars for Attack Path Management: Pillar 1 — Continuous & Comprehensive Mapping

3 Foundational Pillars for Attack Path Management: Pillar 1 — Continuous & Comprehensive Mapping When we coined the term “Attack Path Management”…

Research & Tradecraft

Azure Privilege Escalation via Azure API Permissions Abuse

Intro and Prior Work Microsoft’s Azure is a complicated system of principals, securable objects, and the various ways access is…

BloodHound

Active Directory Attack Paths — “Is everyone this bad?”

Active Directory Attack Paths — “Is it always this bad?” We launched BloodHound Enterprise to help organizations manage Attack Paths in Active Directory…

Research & Tradecraft

Capability Abstraction Case Study: Detecting Malicious Boot Configuration Modifications

Research & Tradecraft

Azure Privilege Escalation via Service Principal Abuse

Intro and Prior Work On-prem Active Directory is here to stay, and so is Azure Active Directory. While these products…

Research & Tradecraft

AWS ReadOnlyAccess: Not Even Once

Research & Tradecraft

Entity Based Detection Engineering with BloodHound Enterprise

Critical Attack Path with Auditing Table of Contents Introduction Enterprise Access Model BloodHound and Detection BloodHound Enterprise Entity Based Detection Engineering Kerberoastable Users…

Research & Tradecraft

1Password Secret Retrieval — Methodology and Implementation

Background and Motivation 1Password is a password manager developed by AgileBits Inc., providing a place for users to store various passwords, software licenses,…