blog category
Research & Tradecraft
Research & Tradecraft
SpecterOps has released Ghostwriter v3.2 with some significant enhancements we think you’ll like. We overhauled how...
Feb 8, 2023 • 4 min read
Read Post
Research & Tradecraft
At the Edge of Tier Zero: The Curious Case of the RODC
The read-only Domain Controller (RODC) is a solution that Microsoft introduced for physical locations that don’t...
Jan 25, 2023 • 19 min read
Read Post
Research & Tradecraft
SCCM Site Takeover via Automatic Client Push Installation
tl;dr: Install hotfix KB15599094 and disable NTLM for client push installation. While reading SCCM Current Branch...
Jan 12, 2023 • 9 min read
Read Post
Research & Tradecraft
Passwordless Persistence and Privilege Escalation in Azure
Adversaries are always looking for stealthy means of maintaining long-term and stealthy persistence and privilege in...
Dec 21, 2022 • 16 min read
Read Post
Research & Tradecraft
Stalking inside of your Chromium Browser
Revisiting Remote Debugging Okay, you got your favorite agent running on the target machine. You did...
Dec 1, 2022 • 8 min read
Read Post
Research & Tradecraft
Certificates and Pwnage and Patches, Oh My!
This post was written by Will Schroeder and Lee Christensen. A lot has happened since we...
Nov 9, 2022 • 20 min read
Read Post
Research & Tradecraft
The Defender’s Guide to the Windows Registry
It’s dangerous to defend the registry alone! Take this! Authors: Luke Paine & Jonathan Johnson Introduction Welcome to...
Oct 31, 2022 • 12 min read
Read Post
Research & Tradecraft
Ghostwriter v3.1 Now Available
Ghostwriter v3.1 is now available! This release introduces several new features along with a host of...
Oct 19, 2022 • 5 min read
Read Post
Research & Tradecraft
Prioritization of the Detection Engineering Backlog
Written by Joshua Prager and Emily Leidy Introduction Strategically maturing a detection engineering function requires us to...