SpecterOps Blog

Research & Tradecraft

Catching Credential Guard Off Guard

TL;DR Due to new security features in Windows and the lack of existing research, we set out to find ways…

A Gentle Crash Course to LLMs

TL;DR Large Language Models (LLMs) are an evolution of a long history of turning non-mathy things into mathy things and…

BloodHound

The Clean Source Principle and the Future of Identity Security

TL;DR Modern identity systems are deeply interconnected, and every weak dependency creates an attack path — no matter how strong any…

Research & Tradecraft

AI Gated Loader: Teaching Code to Decide Before It Acts

TL;DR AI gated loaders collect telemetry, apply a policy with an LLM, and execute only when defined OPSEC rules are…

Research & Tradecraft

WriteAccountRestrictions (WAR) – What is it good for?

TL;DR A lot of things. The User-Account-Restrictions property grants read/write permissions to the user-account-control LDAP attribute, which can be used…

Research & Tradecraft

DCOM Again: Installing Trouble

TL;DR I am releasing a DCOM lateral movement beacon object file (BOF) that uses the Windows Installer Custom Action server…

Research & Tradecraft

Operating Outside the Box: NTLM Relaying Low-Privilege HTTP Auth to LDAP

TL;DR When operating out of a ceded access or phishing payload with no credential material, you can use low-privilege HTTP…

Research & Tradecraft

Transforming Red Team Ops with Mythic’s Hidden Gems: Browser Scripting

TL;DR Mythic’s browser scripting provides tons of flexibility that operators can tailor to their unique needs to best analyze the…

Research & Tradecraft

ARM-ed and Dangerous: Dylib Injection on macOS 

Modern Dylib Injection Techniques for AArch64 macOS TL;DR This post details how I extended the Mythic Poseidon agent to support…