SpecterOps Blog

Research & Tradecraft

DCOM Again: Installing Trouble

TL;DR I am releasing a DCOM lateral movement beacon object file (BOF) that uses the Windows Installer Custom Action server…

Escaping the Confines of Port 445

TL;DR NTLM relay attacks on SMB restrict lateral movement to port 445/TCP capabilities. To extend beyond, leverage the Service Control…

Research & Tradecraft

Further Adventures With CMPivot — Client Coercion

Further Adventures With CMPivot — Client Coercion Perfectly Generated AI Depiction based on Title TL:DR CMPivot queries can be used to coerce SMB authentication…

Research & Tradecraft

Intune Attack Paths — Part 1

Intune Attack Paths — Part 1 Prior Work Several people have recently produced high-quality work around Intune tradecraft. I want to specifically mention:…

Research & Tradecraft

Attacking Entra Metaverse: Part 1

This is part one in a two (maybe three…) part series regarding attacker tradecraft around the syncing mechanics between Active…

Research & Tradecraft

Maestro: Abusing Intune for Lateral Movement Over C2

If I have a command and control (C2) agent on an Intune admin’s workstation, I should just be able to…

Research & Tradecraft

Maestro: Abusing Intune for Lateral Movement Over C2

BloodHound

Hybrid Attack Paths, New Views and your favorite dog learns an old trick

Introducing Hybrid Attack Paths Death from Above: An Attack Path from Azure to Active Directory With BloodHound When we introduced Azure…

Research & Tradecraft

Lateral Movement with the .NET Profiler

Lateral Movement with the .NET Profiler The accompanying code for this blogpost can be found HERE. Intro I spend a lot of my…