Our Services

We Help Build Best In-Class Security Operations

We are experts in developing and improving security operations capabilities, increasing our client’s readiness against adversary attacks. We leverage our deep experience and knowledge of adversary techniques to support our clients, all the way from point-in-time assessments improving specific defensive capabilities, to serving as the trusted advisor and partner driving improvements across the entire security operations program.

Who we are

Our Specialty is Understanding Adversary Tradecraft

Our experience across hundreds of government, defense industry, financial, and healthcare environments has taught us that the most vital component of a robust security posture is understanding how adversaries will operate against the organization’s enterprise environment. We build our services around that perspective, focused on analyzing and improving attack path detection capabilities and validating defensive efforts through attack simulation. We believe that technical capabilities have their place, but the human component to any security program is absolutely critical. Our objective is to train and arm our clients with the knowledge of how the effective use of the interlocking components of their security program provide a robust security posture and readiness against active directory attacks and other vulnerable system attacks.

Our assessments focus on adversary capabilities and techniques present in the “real world,” translating risk into actions an organization can achieve. Our advisory services are designed not to just help the organization install another technology, but to help improve attack path detection and response capabilities over time, keeping our clients informed of adversary capabilities and preventing effective operations of advanced threat actors.

What to Expect

“Assume Breach” Mindset

The question is not whether you will be breached, but when. We focus on helping effectively detect and eradicate the adversary before they can impact the organization.

Pioneering Industry Capabilities

Our team is at the cutting edge of developing and demystifying new attacks and techniques

Transparent Approaches

We are transparent in every service we execute; every engagement is a learning opportunity

Industry Experts

You can benchmark the caliber of our team members simply by listening to our talks, reading our content, or utilizing the tools we produce.

Tailored Execution

Every service is effectively built and best suited to the specifics of your environment

Actionable Deliverables

We strive for actionable results focused on improving organizational security

Our Services

Program Development

Whether you are building new adversary detection and simulation teams or looking to mature existing competencies, we provide an effective approach focused on comprehensively integrating technical components into the overall security operations program, ensuring robust prevention, detection, and response capabilities. SpecterOps team members bring extensive security experience from finance, healthcare, military, intelligence community, and federal programs. Leveraging lessons learned building and supporting teams across these diverse environments, we tailor our approach to your capability development and maturation needs. Save the wasted effort of months of ineffective trial and error by focusing your approach on building transparent, effective, and repeatable adversary simulation and assessment capabilities that measurably improve organizational security.

Developing Capabilities
Expert Support

It can be difficult to build out or grow a new adversary simulation and detection capability without prior experience. Whether you are trying to stand up an internal Penetration Testing, Red Team engagement, Purple Team, Threat Hunting, or Detection program, SpecterOps has the background to ensure your success. We work to ensure there are attainable goals and metrics and design a path to success. We strive to build a program that is owned and operated by you, not continually dependent on us, meeting your organization needs and avoiding common pitfalls plagued by many organizations.

ADVERSARY DETECTION PROGRAM DEVELOPMENT
Identify security gaps between current operational capabilities and strategic objectives, including staff skillsets, technical capabilities, and program support infrastructure. Develop and execute a strategic plan with a roadmap for bringing current detection capabilities to desired outcomes.
Evaluate internal adversary simulation and assessment capabilities against program objectives. Support capability development through skillset development, operational training, technical maturation, documentation and communications strategies.

Security Assessments

SpecterOps provides a third-party adversary focused perspective of your enterprise environments. Leveraging expertise built through years of experience and assessments across industries and hundreds of environments, our operators use our understanding of advanced Tactics, Techniques, and Procedures (TTPs) to effectively assess and improve your security posture and ability to respond to today’s sophisticated attacks.

Penetration Testing Services
Red Team Engagements
Purple Team Assessments
Maturity Assessments
Attack Path Assessments

The objective of our penetration tests is to assist the organization in understanding the full impact of a potential breach and evaluate how effective security controls work to protect the most critical assets. Our team of experts will work with you to design penetration testing engagements that will achieve the greatest impact on assessing your risk visibility into your environment. Our experience enables us to execute a methodology while also assuring penetration testing is cost-effective and timely.

The difference in our penetration testing service is that we focus on impact objective driven testing. Whether we are attempting to access sensitive information, breach security boundaries, or access management systems, you can be sure that our time is efficiently spent on comprehensively testing your organization’s capability to protect critical assets.

NETWORK PENETRATION TESTING
Assess the effectiveness of enterprise environment defenses against advanced adversaries attempting to gain access to sensitive data and resources through internal or external attack vectors.
Assess the effectiveness of the application stack’s defenses against advanced adversaries attempting to gain access to sensitive data and resources through authenticated and unauthenticated attack paths.
Evaluate the defensive capabilities of complex, specialized, and cutting-edge technology stacks in securing critical assets and detecting advanced attacks.
All our penetration testing services are designed to provide an technically experienced, unbiased, third-party perspective of the security posture presented by in-scope systems.
Get Started

Defend Against
Advanced Attacks.

In the spotlight

Security Topics We’re Discussing

Active Directory

Azure Key Vault Tradecraft with BARK

Brief This post details the existing and new functions in BARK that support adversarial tradecraft research relevant to the Azure Key Vault service. The latter part of the post shows an example of how a red team operator may use these commands during the course of an assessment. Authentication Azure Key Vault is one of […]

7 min read | Nov 20
Andy Robbins
Active Directory

Maestro: Abusing Intune for Lateral Movement Over C2

If I have a command and control (C2) agent on an Intune admin’s workstation, I should just be able to use their privileges to execute a script or application on an Intune-enrolled device, right? Not so fast. I Wanna Go Fast! Take me to the GitHub repo! Take me to the attack path walkthrough! Take me to the defensive […]

12 min read | Oct 31
Chris Thompson
Active Directory

BOFHound: AD CS Integration

TL;DR: BOFHound can now parse Active Directory Certificate Services (AD CS) objects, manually queried from LDAP, for review and attack path mapping within BloodHound Community Edition (BHCE). Background My last BOFHound-related post covered the support and usage strategies for Beacon object files (BOFs) enabling the manual collection of data required for BloodHound’s AdminTo and HasSession edges, […]

13 min read | Oct 30
matt creel
Active Directory

Closing the Gaps: How Attack Path Management Improves Vulnerability Management Programs

In conversation: Pete McKernan & Luke Luckett As organizations seek to wrap their arms around potential cybersecurity exposures, CIOs and CISOs are increasingly pushing their vulnerability management teams to widen scope. With such a focus, the growing concept of continuous threat exposure management (CTEM) aims to prioritize whatever most threatens the enterprise, whether or not such […]

5 min read | Oct 02
luke luckett
Active Directory

Dotnet Source Generators in 2024 Part 1: Getting Started

Introduction In this blog post, we will cover the basics of a source generator, the major types involved, some common issues you might encounter, how to properly log those issues, and how to fix them. Source Generators have existed since .NET 5 was first introduced in late 2020. They have seen numerous improvements since that initial release, […]

34 min read | Oct 01
jonathan owens
Active Directory

Ghostwriter v4.3: SSO, JSON Fields, and Reporting with BloodHound

Ghostwriter v4.3 is available now, and it enhances features introduced in previous versions of v4 in some exciting ways! In particular, this article will dive into how you can integrate a tool like BloodHound Community Edition (BHCE) with Ghostwriter v4.3. First, we would be remiss if we did not mention the refreshed single sign-on (SSO) feature. […]

6 min read | Sep 23
Christopher Maddalena
Active Directory

ADCS Attack Paths in BloodHound — Part 3

ADCS Attack Paths in BloodHound — Part 3 In Part 1 of this series, we explained how we incorporated Active Directory Certificate Services (ADCS) objects into BloodHound and demonstrated how to effectively use BloodHound to identify attack paths, including the ESC1 domain escalation technique. Part 2 covered the Golden Certificates and the ESC3 techniques. In this blog post, […]

21 min read | Sep 11
Jonas Bülow Knudsen
Active Directory

Mythic 3.3 — Out of Beta

Mythic 3.3 — Out of Beta Mythic 3.3 was released in a Beta six weeks ago, and since then there has been a bunch of feedback, not just about new Mythic 3.3 features but about the framework overall. Now that Mythic is exiting Beta and going to a full release, I wanted to take a moment and highlight […]

8 min read | Aug 28
Cody Thomas
Active Directory

Ghostwriter ❤ Tool Integration

Incorporating new components into existing systems is such a pain, this process has been labeled “Integration Hell”. To ease tool integration, Ghostwriter v3.0.0 shipped with a GraphQL API. This API allows outside entities to easily query and manipulate Ghostwriter’s data. In this blogpost, we’ll use our Operation Log Generator to demonstrate the capabilities of this API. […]

4 min read | Aug 27
Alexander Sou
Active Directory

Life at SpecterOps: The Red Team Dream

TL;DR We are hiring consultants at various levels. The job posting can be found under the Consultant opening here: https://specterops.io/careers/#careers Introduction Hey there! I’m Duane Michael, a Managing Consultant and red teamer at SpecterOps. Over the past four years, I’ve had a front-row seat to the company’s incredible journey. In that time, we’ve grown by […]

8 min read | Aug 21
Duane Michael