SpecterOps Blog

Research & Tradecraft

Getting Started with BHE — Part 2

Contextualizing Tier Zero TL;DR An accurately defined Tier Zero provides an accurate depiction of Attack Path Findings in your BHE tenant. Different…

Research & Tradecraft

Getting Started with BHE — Part 1

Understanding Collection, Permissions, and Visibility of Your Environment TL;DR Attack Path visibility is dependent upon scope of collection; complete collection…

Industry Insights

Getting the Most Value Out of the OSCP: Pre-Course Prep

TL;DR The first post in a five-part practical guide series on maximizing the professional, educational, and financial value of the…

BloodHound

Enhancements for BloodHound v7.0 Provide Fresh User Experience and Attack Path Risk Optimizations

TL;DR: Refreshed user interface with a new vertical navigation layout for improved user experience. General Availability of “Improved Analysis Algorithm”…

Research & Tradecraft

SlackPirate Set Sails Again! Or: How to Send the Entire “Bee Movie” Script to Your Friends in Slack

TLDR: SlackPirate has been defunct for a few years due to a breaking change in how the Slack client interacts…

Research & Tradecraft

Entra Connect Attacker Tradecraft: Part 2

Now that we know how to add credentials to an on-premises user, lets pose a question: “Given access to a…

Research & Tradecraft

Intune Attack Paths — Part 1

Intune Attack Paths — Part 1 Prior Work Several people have recently produced high-quality work around Intune tradecraft. I want to specifically mention:…

Research & Tradecraft

ADFS — Living in the Legacy of DRS

ADFS — Living in the Legacy of DRS It’s no secret that Microsoft have been trying to move customers away from ADFS for…

Industry Insights

Demystify Active Directory Certification Services (AD CS) Components