SpecterOps Blog

The SpecterOps blog covers attack path management, red team operations, detection engineering, and the identity security shifts reshaping the modern enterprise, offering deep technical research and adversary tradecraft from the team behind BloodHound.

Filters

Clear Search

Search results for “proxy”

All articles & videos

Expanding attack path management to the AI frontier 

AI & Security

Expanding attack path management to the AI frontier 

Attackers don’t move through isolated systems. They move through the relationships between those systems and identities, chaining privileges to move laterally across…

Read More
Sowing Chaos and Reaping Rewards in Confluence and Jira

Research & Tradecraft

Sowing Chaos and Reaping Rewards in Confluence and Jira

Introduction Let me paint a picture for you. You’re on a red team operation, operating from your favorite C2, and…

By: Craig Wright

11 mins
From DA to EA with ESC5

Research & Tradecraft

From DA to EA with ESC5

There’s a new, practical way to escalate from Domain Admin to Enterprise Admin. ESC5 You’ve heard of ESC1 and ESC8.…

By: Andy Robbins

9 mins
C2 and the Docker Dance: Mythic 3.0’s Marvelous Microservice Moves

Research & Tradecraft

C2 and the Docker Dance: Mythic 3.0’s Marvelous Microservice Moves

— Title by ChatGPT for introducing Mythic 3.0 What is Mythic? Mythic is a plug-n-play command and control (C2) framework that heavily…

By: Cody Thomas

13 mins
SCCM Site Takeover via Automatic Client Push Installation

Research & Tradecraft

SCCM Site Takeover via Automatic Client Push Installation

tl;dr: Install hotfix KB15599094 and disable NTLM for client push installation. While reading SCCM Current Branch Unleashed and stepping through…

By: Chris Thompson

9 mins
Stalking inside of your Chromium Browser

Research & Tradecraft

Stalking inside of your Chromium Browser

Revisiting Remote Debugging Okay, you got your favorite agent running on the target machine. You did a process listing, but…

By: Kai Huang

8 mins
WMI Internals Part 3

WMI Internals Part 3

Beyond COM In a previous blog post of mine — WMI Internals Part 2: Reversing a WMI Provider I walked through how…

By: Jonathan Johnson

6 mins
Get your SOCKS on with gTunnel

Get your SOCKS on with gTunnel

Get Your SOCKS on with gTunnel tl;dr Steps to setup a wicked fast SOCKS proxy with a tool called gTunnel written…

By: Elliott Grey

15 mins
On Detection: Tactical to Functional

On Detection: Tactical to Functional

Part 3: Expanding the Function Call Graph Introduction In the previous post in this series, I introduced the concept of operations…

By: Jared Atkinson

16 mins
Part 3: Expanding the Function Call Graph

Research & Tradecraft

Part 3: Expanding the Function Call Graph

By: Jared Atkinson

15 mins

Ready to get started?

See how BloodHound Enterprise eliminates millions of attack paths while focusing your defenses on the routes attackers actually use to reach your critical assets.

Learn More