SpecterOps Blog

The SpecterOps blog covers attack path management, red team operations, detection engineering, and the identity security shifts reshaping the modern enterprise, offering deep technical research and adversary tradecraft from the team behind BloodHound.

Filters

Clear Search

Search results for “attack-path”

All articles & videos

Expanding attack path management to the AI frontier 

AI & Security

Expanding attack path management to the AI frontier 

Attackers don’t move through isolated systems. They move through the relationships between those systems and identities, chaining privileges to move laterally across…

Read More
BOFHound: AD CS Integration

Research & Tradecraft

BOFHound: AD CS Integration

TL;DR: BOFHound can now parse Active Directory Certificate Services (AD CS) objects, manually queried from LDAP, for review and attack…

By: Matt Creel

14 mins
Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs

BloodHound

Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs

In conversation: Pete McKernan & Luke Luckett As organizations seek to wrap their arms around potential cybersecurity exposures, CIOs and CISOs…

By: Luke Luckett

6 mins
ADCS Attack Paths in BloodHound — Part 3

Research & Tradecraft

ADCS Attack Paths in BloodHound — Part 3

ADCS Attack Paths in BloodHound — Part 3 In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services…

By: Jonas Bülow Knudsen

22 mins
Navigating the Uncharted: A Framework for Attack Path Discovery

Research & Tradecraft

Navigating the Uncharted: A Framework for Attack Path Discovery

This is the second post in a series on Identity-Driven Offensive Tradecraft, which is also the focus of the new…

By: Elad Shamir

8 mins
BloodHound Operator — Dog Whispering Reloaded

BloodHound

BloodHound Operator — Dog Whispering Reloaded

BloodHound Operator — Dog Whispering Reloaded It’s summer 2024 and we are back! Actually, we are SO back, so I decided that…

By: SadProcessor

20 mins
Hybrid Attack Paths, New Views and your favorite dog learns an old trick

BloodHound

Hybrid Attack Paths, New Views and your favorite dog learns an old trick

Introducing Hybrid Attack Paths Death from Above: An Attack Path from Azure to Active Directory With BloodHound When we introduced Azure…

By: Justin Kohler

6 mins
ADCS Attack Paths in BloodHound — Part 2

Research & Tradecraft

ADCS Attack Paths in BloodHound — Part 2

ADCS Attack Paths in BloodHound — Part 2 In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services…

By: Jonas Bülow Knudsen

13 mins
ADCS ESC14 Abuse Technique

Research & Tradecraft

ADCS ESC14 Abuse Technique

The altSecurityIdentities attribute of Active Directory (AD) computers and users allows you to specify explicit certificate mappings. An explicit certificate…

By: Jonas Bülow Knudsen

38 mins
ADCS ESC13 Abuse Technique

Research & Tradecraft

ADCS ESC13 Abuse Technique

It is possible to configure an Active Directory Certificate Services (ADCS) certificate template with an issuance policy having an OID…

By: Jonas Bülow Knudsen

15 mins

Ready to get started?

See how BloodHound Enterprise eliminates millions of attack paths while focusing your defenses on the routes attackers actually use to reach your critical assets.

Learn More