Learning Machine Learning Part 2: Attacking White Box Models
https://posts.specterops.io/learning-machine-learning-part-2-attacking-white-box-models-1a10bbb4a2ae
https://posts.specterops.io/learning-machine-learning-part-2-attacking-white-box-models-1a10bbb4a2ae
Medium
Learning Machine Learning Part 2: Attacking White Box Models
In the previous post, I went through a very brief overview of some machine learning concepts, talked about the Revoke-Obfuscation project…
Learning Machine Learning Part 3: Attacking Black Box Models
https://posts.specterops.io/learning-machine-learning-part-3-attacking-black-box-models-3efffc256909
https://posts.specterops.io/learning-machine-learning-part-3-attacking-black-box-models-3efffc256909
Medium
Learning Machine Learning Part 3: Attacking Black Box Models
In the first post in this series we covered a brief background on machine learning, the Revoke-Obfuscation approach for detecting…
EntropyCapture: Simple Extraction of DPAPI Optional Entropy
https://posts.specterops.io/entropycapture-simple-extraction-of-dpapi-optional-entropy-6885196d54d0
https://posts.specterops.io/entropycapture-simple-extraction-of-dpapi-optional-entropy-6885196d54d0
Medium
EntropyCapture: Simple Extraction of DPAPI Optional Entropy
EntropyCapture extracts the DPAPI optional entropy using API hooking.
DeepPass — Finding Passwords With Deep Learning
https://posts.specterops.io/deeppass-finding-passwords-with-deep-learning-4d31c534cd00
https://github.com/GhostPack/DeepPass
https://posts.specterops.io/deeppass-finding-passwords-with-deep-learning-4d31c534cd00
https://github.com/GhostPack/DeepPass
Medium
DeepPass — Finding Passwords With Deep Learning
One of the routine tasks operators regularly encounter on most engagements is data mining. While exactly what operators are after varies…
Ghostwriter v2.3 RC2 releases: The SpecterOps project management and reporting engine
https://securityonline.info/ghostwriter/
https://securityonline.info/ghostwriter/
securityonline.info
Ghostwriter v4.0.1 releases: The SpecterOps project management and reporting engine
Ghostwriter is a part of your team. It helps you manage clients, projects, reports, and infrastructure in one application.
Managed Identity Attack Paths, Part 2: Logic Apps
https://posts.specterops.io/managed-identity-attack-paths-part-2-logic-apps-52b29354fc54
https://posts.specterops.io/managed-identity-attack-paths-part-2-logic-apps-52b29354fc54
Medium
Managed Identity Attack Paths, Part 2: Logic Apps
Intro and Prior Work
Establish security boundaries in your on-prem AD and Azure environment
https://posts.specterops.io/establish-security-boundaries-in-your-on-prem-ad-and-azure-environment-dcb44498cfc2?gi=b18c825d4a9a
https://posts.specterops.io/establish-security-boundaries-in-your-on-prem-ad-and-azure-environment-dcb44498cfc2?gi=b18c825d4a9a
Medium
Establish security boundaries in your on-prem AD and Azure environment
Preventing escalation from initial access in your Active Directory (AD) environment to Domain Admins can feel impossible, especially after…
The Phantom Credentials of SCCM: Why the NAA Won’t Die
https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9
https://posts.specterops.io/the-phantom-credentials-of-sccm-why-the-naa-wont-die-332ac7aa1ab9
SpecterOps
The Phantom Credentials of SCCM: Why the NAA Won’t Die - SpecterOps
Explore the risks lurking within SCCM's Network Access Accounts, why transitioning to Enhanced HTTP isn't enough, and why disabling NAAs from AD is crucial.
How to Find New Attack Primitives in Microsoft Azure
https://www.darkreading.com/attacks-breaches/how-to-find-new-attack-primitives-in-microsoft-azure
https://www.darkreading.com/attacks-breaches/how-to-find-new-attack-primitives-in-microsoft-azure
Dark Reading
How to Find New Attack Primitives in Microsoft Azure
Abuse primitives have a longer shelf life than bugs and zero-days and are cheaper to maintain. They're also much harder for defenders to detect and block.
An Introduction to Manual Active Directory Querying with Dsquery and Ldapsearch
https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb
https://posts.specterops.io/an-introduction-to-manual-active-directory-querying-with-dsquery-and-ldapsearch-84943c13d7eb
SpecterOps
Introduction to Manual Active Directory Querying | SpecterOps
Learn to perform manual Active Directory queries with dsquery and ldapsearch. Master basic commands to efficiently navigate AD environments.
Relaying NTLM Authentication from SCCM Clients
https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867
https://posts.specterops.io/relaying-ntlm-authentication-from-sccm-clients-7dccb8f92867
Medium
Relaying NTLM Authentication from SCCM Clients
tl;dr: Seriously, please disable NTLM
Hang Fire: Challenging our Mental Model of Initial Access | by Matt Hand
https://posts.specterops.io/hang-fire-challenging-our-mental-model-of-initial-access-513c71878767
https://posts.specterops.io/hang-fire-challenging-our-mental-model-of-initial-access-513c71878767
Medium
Hang Fire: Challenging our Mental Model of Initial Access
For as long as I’ve been working in security, initial access has generally looked the same. While there are high degrees of variation…
Dealing with Failure: Failure Escalation Policy in CLR Hosts
https://posts.specterops.io/dealing-with-failure-failure-escalation-policy-in-clr-hosts-54ca8b728faa
https://posts.specterops.io/dealing-with-failure-failure-escalation-policy-in-clr-hosts-54ca8b728faa
Medium
Dealing with Failure: Failure Escalation Policy in CLR Hosts
Offensive tooling built upon the .NET framework and its runtime environment, the Common Language Runtime (CLR), is an important part of…
On Detection: Tactical to Functional
Part 2: Operations
https://posts.specterops.io/on-detection-tactical-to-functional-37ddcd75234b
Part 2: Operations
https://posts.specterops.io/on-detection-tactical-to-functional-37ddcd75234b
Medium
Part 2: Operations
Welcome back to my On Detection: Tactical to Functional series. In the first post in this series, we explored the source code for Mimikatz’s sekurlsa::logonPasswords command. We discovered that…