@specterops.io@rss-parrot.net
I'm an automated parrot! I relay a website's RSS feed to the Fediverse. Every time a new post appears in the feed, I toot about it. Follow me to get all new posts in your Mastodon timeline! Brought to you by the RSS Parrot.
---
Site URL: specterops.io/
Feed URL: specterops.io/feed
Posts: 53
Followers: 1
Attack of The Extensions
https://specterops.io/blog/2026/08/13/chromium-extension-c2-persistence/
Published: August 13, 2026 16:00
TL;DR: Browser extensions can turn Chromium into a persistent foothold. This post introduces a way to silently install extensions turning Chromium browsers into a command and control (C2) platform for persistent cookie theft. Intro This blog is a…
Return of the Cookie Monster
https://specterops.io/blog/2026/08/13/chrome-devtools-protocol-cookie-theft/
Published: August 13, 2026 16:00
TL;DR: Cookie protections have made traditional session theft harder, but they do not eliminate the value of an authenticated browser session to adversaries. This post explores enabling the Chrome DevTools Protocol (CDP) inside a running Chromium browser…
Blacklight: Illuminating AI Agent Artifacts for Attackers and Defenders
https://specterops.io/blog/2026/08/12/blacklight-ai-agent-endpoint-artifacts/
Published: August 12, 2026 16:00
TL;DR: Blacklight is an open-source security research toolkit for discovering and analyzing AI agent artifacts that reside on endpoints. It helps authorized security teams assess exposure, guide next decisions, and develop detection and hardening guidance.…
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 1
Published: August 5, 2026 17:15
TL;DR: This is part 1 of a 2 part blog series sharing what I have discovered in my Windows Service Update Service (WSUS) research. If the WSUS database is configured on a separate server from the upstream WSUS server, we can coerce the WSUS computer…
Turning Enterprise Update Servers Into Backdoor Factories (0_o) – Part 2
Published: August 5, 2026 17:15
TL;DR: When WSUS downloads files for updates, it requires the server to leverage the BITS protocol. WSUS normally requires executables to be digitally signed, however this can be bypassed by appending the .esd or .txt file extensions. Introduction In Part…
Of Course We Built a WSUS Ludus Lab
https://specterops.io/blog/2026/08/05/built-a-wsus-ludus-lab/
Published: August 5, 2026 17:15
TL;DR: This blog walks you through setting up a WSUS lab using Ludus for testing. The associated GitHub repo is here. Introduction I have been researching the Windows Service Update Service (WSUS) and discovered a new way we could take over the WSUS…
Weaponizing Windows Updates with NotWSUSpicious
https://specterops.io/blog/2026/08/05/weaponizing-windows-updates-with-notwsuspicious/
Published: August 5, 2026 17:15
TL;DR: NotWSUSpicious is a tool repo to aid in creating custom updates after gaining access to a WSUS database server. The Turning Enterprise Update Servers Into Backdoor Factories (0_o) series covers how the database takeover works. This blog strictly…
Mythic 4 Public Beta: More Than a New Coat of Paint
https://specterops.io/blog/2026/08/04/mythic-4-public-beta/
Published: August 4, 2026 20:09
TL;DR: Mythic 4 is now available on the Mythic-v4.0.0 branch and is entering a public beta for the next few months for the community to update their services. Mythic 4 has some breaking changes, new features, AI chat container support, and so much more.…
ConfigManBearPig 2.0 – Things Are Getting Cereal
https://specterops.io/blog/2026/08/03/configmanbearpig-2-0/
Published: August 3, 2026 16:00
TL;DR – In the past several years, security researchers have discovered 30+ unique attack techniques targeting Microsoft Configuration Manager (formerly SCCM), as its widespread control of an organization’s devices makes it an appealing target.…
Clustered Points of Failure
https://specterops.io/blog/2026/07/29/clustered-points-of-failure/
Published: July 29, 2026 16:00
TL;DR – Windows Server Failover Clusters share resource credentials. Compromising one cluster node results in complete compromise of the entire cluster. Acknowledgments The content I’m sharing here is the result of collaboration with or inspiration from…
Introducing Attack Path Management for Entra Agents in BloodHound Enterprise
Published: July 28, 2026 11:56
AI agents are becoming a new layer of enterprise infrastructure and enterprise identity. They answer questions, invoke tools, execute workflows, access data, authenticate to downstream services, communicate with other agents, and increasingly act on…
Designing an MCP Server for AI Agents: Why Wrapping Your API Is the Wrong Abstraction
https://specterops.io/blog/2026/07/28/designing-an-mcp-server-for-ai-agents-bloodhound-hunter/
Published: July 28, 2026 11:50
An MCP server for AI agents is not just a wrapper around your existing REST API. The tools have to be shaped around agent intent rather than backend implementation. This post explains why wrapping your API is the wrong abstraction and how to design MCP…
Expanding attack path management to the AI frontier
https://specterops.io/blog/2026/07/28/bloodhound-enterprise-aws-attack-path-management/
Published: July 28, 2026 11:50
Attackers don’t move through isolated systems. They move through the relationships between those systems and identities, chaining privileges to move laterally across the attack surface until they reach critical assets.  Hybrid, decentralized environments…
Attack Path Management Comes to AWS
https://specterops.io/blog/2026/07/28/attack-path-management-comes-to-aws/
Published: July 28, 2026 11:50
At SpecterOps, we have been hard at work modeling identity providers in our BloodHound Enterprise platform. Everything from Active Directory to Okta and Github, we focused on the hybrid technologies that matter most to the enterprise identity security.…
Introducing the SpecterOps Tradecraft Academy
https://specterops.io/blog/2026/07/21/introducing-the-specterops-tradecraft-academy/
Published: July 21, 2026 13:00
TL;DR: SpecterOps Tradecraft Academy is now live at academy.specterops.io, offering free, on-demand courses built by SpecterOps: BloodHound Basics, Software Supply Chain Security for Red Teamers, and Kubernetes for Red Teamers, with adversary tradecraft…
Why “Least Privilege” Fails in Real Environments
https://specterops.io/blog/2026/07/15/why-least-privilege-fails-in-real-environments/
Published: July 15, 2026 19:54
The answer isn’t to abandon least privilege as a principle. It remains the right objective. What needs to change is how organizations approach achieving it. Defending a graph requires seeing the graph. That means moving away from point-in-time audits and…
There and Back Again: An Operators Guide on NTLM Relaying Egress
Published: July 15, 2026 16:00
TL;DR – What’s old is new again. Remember coercing SMB NTLM egress tradecraft to crack challenge response back in the day? We see a lot of situations in our assessments where relaying NTLM from coerced network egress is ideal when escalating locally over…
Finding SOCKS with Proxywatch
https://specterops.io/blog/2026/07/09/finding-socks-with-proxywatch/
Published: July 9, 2026 16:00
TL;DR: Adversaries use SOCKS proxy tunnels to pivot within environments and to execute code against compromised systems without bringing tools to the system. Defenders often lack reliable guidance to detect proxying behavior, falling back to preset rules…
Building a Mental Model for Kubernetes Security Research
https://specterops.io/blog/2026/07/08/building-a-mental-model-for-kubernetes-security-research/
Published: July 8, 2026 16:00
TL;DR: How Codex helped me turn Kubernetes security research into a usable mental model and research framework During security engagements involving Kubernetes (sometimes abbreviated to k8s), one of the recurring challenges I keep running into is how…
How to Set Red Team Objectives that Produce Value
https://specterops.io/blog/2026/07/07/how-to-set-red-team-objectives-that-produce-value/
Published: July 7, 2026 16:00
TL;DR: A red team engagement is only as useful as the questions it is designed to answer. Strong objectives help teams produce valuable root-cause findings leadership can act on. The value of a red team engagement is largely determined before execution…
Accelerating EDR Evasion with LLM-Driven Analysis
https://specterops.io/blog/2026/06/29/llm-powered-edr-analysis/
Published: June 29, 2026 21:03
Over the years I have enjoyed disassembling and debugging endpoint detection and response (EDR) and antivirus (AV) engines. For as long as I can remember I’d have evenings where I’d throw on some music, boot a virtual machine with kernel debugging enabled,…
Jailbreaker: LLM Jailbreak Testing You Can Actually Repeat
https://specterops.io/blog/2026/06/29/llm-jailbreak-testing-with-jailbreaker/
Published: June 29, 2026 18:59
You may have read about our new GhostWorks initiative here at SpecterOps. As part of this effort, we continually trial different ways of evaluating and improving model behavior to better understand which techniques can be applied to our research. One of…
Time Travel Debugging with Codex
https://specterops.io/blog/2026/06/26/time-travel-debugging-with-codex/
Published: June 26, 2026 20:03
Spoiler warning: this post discusses the FLARE-ON 12 `FlareAuthenticator` challenge and includes the recovered flag. Introduction Before getting into the technical details, this work was made possible through SpecterOps’ partnership with OpenAI’s through…
Disposable Tooling: Building LLM-Generated Mythic Agents from Prompt to Deployment
Published: June 24, 2026 17:29
An area I’ve been very interested in exploring over the past several months is the generation of what I have been calling “disposable tooling”. With the development space now discussing the reduced cost of writing code, the idea is to also explore how…
SpecterOps and OpenAI: Helping to Build a New Security Frontier with Daybreak
https://specterops.io/blog/2026/06/22/specterops-openai-daybreak-ai-cyber-innovation/
Published: June 22, 2026 17:09
Today, OpenAI announced that it is expanding access to its frontier AI cybersecurity capabilities for a trusted circle of industry partners, including SpecterOps, through the OpenAI Daybreak Cyber Partner Program. Since April, SpecterOps has participated…
BloodHound MCP, One Year Later: What I Learned About MCPs, Models, and Context
Published: June 18, 2026 16:30
The first version of BloodHound MCP proved that an LLM could converse with BloodHound. The current version drove home the lesson that MCP design is context design. The most useful changes were smaller but more flexible tools, better error recovery,…
Mythic Embarking on the Open Seas: Containerized Payload Delivery for Kubernetes Assessments
Published: June 16, 2026 16:00
TL;DR: We created new Mythic extensions to simplify container-centric assessments, including Kubernetes and Docker-based ceded access workflows. These tools help operators wrap Mythic payloads in OCI-compatible containers and publish them to a self-hosted…
Building an Indirect Prompt Injection Workflow
https://specterops.io/blog/2026/06/11/building-an-indirect-prompt-injection-workflow/
Published: June 11, 2026 16:00
TL;DR: This post covers how I used OpenAI’s Codex to automate the generation, testing, and refinement of indirect prompt injection payloads against an agentic system using Sonnet 4.5 and 4.6 models on Amazon Bedrock. Introduction This project began as a…
Oops, I Weaponized the Database: Abusing AI Features in SQL Server 2025
Published: June 10, 2026 16:00
TL;DR: Microsoft SQL Server 2025 AI features provide a practical channel for data exfiltration and C2 transport within the database engine itself. Note: All proof-of-concepts contained in this blog can be found in the following repo:…
Prompt Engineering for Security Agents: A Measurable Approach with GEPA
https://specterops.io/blog/2026/06/09/prompt-engineering-security-agents-gepa/
Published: June 10, 2026 02:23
You may have read about our new GhostWorks initiative here at SpecterOps. As part of this effort, we continually trial different methods of evaluating and improving model performance to help understand what techniques can be applied to our research. This…
Introducing GhostWorks: A Practical AI Initiative from SpecterOps
https://specterops.io/blog/2026/06/09/introducing-ghostworks-ai-cybersecurity-research/
Published: June 10, 2026 02:07
GhostWorks is an AI-focused engineering and research initiative at SpecterOps, focused on the disciplined exploration of frontier AI-enabled cybersecurity tooling. It is not a company-wide AI mandate, a replacement for product teams, or a promise that…
User-to-User Authentication: Down the Rabbit Hole – Part 1
https://specterops.io/blog/2026/06/09/user-to-user-authentication-down-the-rabbit-hole-part-1/
Published: June 9, 2026 16:00
TL;DR: This blog post covers Windows internals and how Kerberos user-to-user (U2U) authentication works under the hood versus showing how to execute an attack. U2U authentication came into the spotlight after the Active Directory Certificate Services…
Keeping a Short Leash: New AzureHound Least-Privilege Documentation
Published: June 8, 2026 16:00
TL;DR: AzureHound now has documented least-privilege permissions. This post walks through the research behind those permissions. We recommend least privilege for tighter access control, while recognizing broader read rights can reduce maintenance across…
Ghostwriter v7: Safer Tokens, Scoped Access, and Better Automation
Published: June 4, 2026 16:00
TL;DR: Ghostwriter v7 is a major step forward for authentication and automation. This release replaces user-managed JWT API tokens with opaque credentials, introduces scoped service tokens for non-human integrations, and tightens how tokens are validated…
CVE-2026-4387: StrongDM State File Reuse
https://specterops.io/blog/2026/06/01/cve-2026-4387-strongdm-state-file-reuse/
Published: June 1, 2026 16:00
TL;DR : An attacker could transfer StrongDM state files, which hold session authentication information, between hosts to provide authenticated sessions. The attacker could reuse state files both inside and outside of the environment where an organization…
The Case for Practicing Response Before You Need It
https://specterops.io/blog/2026/05/28/the-case-for-practicing-response-before-you-need-it/
Published: May 28, 2026 16:00
TL;DR: Building a security program and exercising it are not the same investment. Most organizations prioritize the first and defer the second. This post explains what structured practice requires and why it belongs in every mature security program. Most…
Don’t Jump the Turnstile: Lessons from the Field
https://specterops.io/blog/2026/05/28/dont-jump-the-turnstile-lessons-from-the-field/
Published: May 28, 2026 16:00
TL;DR: Phishing sandboxes are a pain. Cloudflare Turnstile can be used as an effective solution to conceal your phishing pages. Intro Recently, I was on a red team engagement that involved email phishing. I thought to myself, “No problem! I have done…
Spelunking through Splunk
https://specterops.io/blog/2026/05/27/spelunking-through-splunk/
Published: May 27, 2026 16:00
TL;DR : Splunk is a daunting SIEM to learn, but this learning curve can be flattened by learning to use the basic building blocks which make up most Splunk searches. A Detection Engineer’s Guide When I first got my start in cybersecurity, Splunk was one of…
The Hidden Risk of Service Accounts and Non-Human Identities
https://specterops.io/blog/2026/05/26/the-hidden-risk-of-service-accounts-and-non-human-identities/
Published: May 26, 2026 13:52
Non-human identities now outnumber human users in many enterprise environments, creating one of the largest attack surfaces in cybersecurity today. In this episode, Mark Wilson from SpecterOps explains the hidden risks behind service accounts, API keys,…
Introducing TailscaleHound: Mapping Tailscale Attack Paths in BloodHound
https://specterops.io/blog/2026/05/21/tailscalehound/
Published: May 21, 2026 16:00
TL;DR: TailscaleHound is an OpenGraph collector for BloodHound that maps Tailscale users, devices, groups, tags, ACLs, grants, SSH rules, routes, app connectors, services, keys, invites, webhooks, and hybrid Azure identity relationships. The result is a…
What Comes Before Tickets
https://specterops.io/blog/2026/05/08/what-comes-before-tickets/
Published: May 8, 2026 16:00
TL;DR: A year ago, my company handed me a project bigger than anything I’d worked on before. The project was OpenGraph, the new extensibility foundation for a cybersecurity tool called BloodHound, and this essay is partly about building it. Mostly it’s…
Shift Happens – Uncovering Two Built-in Command Injections in Windows Context Menus
Published: May 7, 2026 16:00
TL;DR: Two command injection vulnerabilities exist in the Windows Explorer “Open PowerShell window here” context menu due to improper quoting and command injection through user-controlled folder paths. By creating folders with crafted names (e.g., folder;…
How We Think about Red Teaming
https://specterops.io/blog/2026/05/06/how-we-think-about-red-teaming/
Published: May 6, 2026 16:00
TL;DR: Red teaming means different things to different vendors. We discuss how SpecterOps defines it, why engagements start from assumed breach, and what organizations should expect to learn and take away. The terminology problem: not all “red teams” are…
The Accidental C2: Exploring Dev Tunnels for Remote Access
https://specterops.io/blog/2026/05/06/dev-tunnels-the-accidental-c2/
Published: May 6, 2026 16:00
Dev Tunnels aren’t "just port forwarding". They consist of layers of embedded protocols with RPC messages being exchanged. Once you peal the layers, you quickly see how Dev Tunnels are a C2 framework with extra steps. The post The Accidental C2: Exploring…
Identity APM Has Gone Mainstream. The Hard Work Is Just Starting.
Published: April 28, 2026 13:30
Today SpecterOps published the “Trends in Identity Attack Path Management 2026” report. The survey, conducted by Omdia on our behalf, covers more than 500 cybersecurity decision-makers at enterprises across the U.S., U.K., Canada, France, Germany, and…
MSSQLHound Now Available in Go
https://specterops.io/blog/2026/04/23/mssqlhound-now-available-in-go/
Published: April 23, 2026 16:00
TL;DR: Javier Azofra and I vibe-ported MSSQLHound to Go to drastically improve run duration, enable cross-platform execution, support SOCKS proxying for stealth and NT hashes/Kerberos tickets for authentication, enhance logging, detect the latest…
SpecterOps Selected for OpenAI’s Trusted Access for Cyber Program
Published: April 22, 2026 18:05
SpecterOps has been named to OpenAI's inaugural Trusted Access for Cyber (TAC) cohort (alongside Nvidia, CrowdStrike, JPMorgan Chase, and Bank of America and others) giving verified defenders governed access to advanced AI models for legitimate security…
The Vercel Breach Explains Why Identity Attack Path Management Can’t Wait
Published: April 21, 2026 16:02
Every AI tool connected to a corporate identity system is a non-human identity with delegated rights. The Vercel breach shows exactly what happens when no one maps where those rights lead. The post The Vercel Breach Explains Why Identity Attack Path…
Into The Rainbow: Google’s NTLMv1 Rainbow Tables Explained in a Bit Too Much Detail
Published: April 16, 2026 16:00
TL;DR: Google published a blog post with accompanying rainbow tables targeting the Data Encryption Standard (DES) key space. The tables enable recovery of the NT hash used to generate the ciphertexts in NTLMv1 responses. We’ll dive into the tables, the…
What’s New in the BloodHound Query Library: BYOL, OpenGraph, Multi-Server, and More
Published: April 15, 2026 16:00
BloodHound Query Library - queries.bloodhound.io - update details: import custom query sources & shipping with three OpenGraph extension sources (Jamf, GitHub, Okta), multi-server support, new queries including mappings to PurpleKnight, upcoming…
BloodHound 9.0 — Product Updates
https://specterops.io/blog/2026/04/13/bloodhound-9-0-product-updates/
Published: April 13, 2026 19:00
Two weeks ago, we announced the new BloodHound Enterprise with OpenGraph extensions to extend attack path management to environments like Okta, GitHub, and Jamf. Along with this announcement, I’m pleased to share the release of BloodHound 9.0. Attack…
BloodHound Has Changed. Your Course Probably Hasn’t.
https://specterops.io/blog/2026/04/11/bloodhound-course-update/
Published: April 11, 2026 16:00
BloodHound has moved fast and not all courses have kept up. If you create or maintain a course or training that includes BloodHound, now is a good time to review your materials. BloodHound Community Edition (BHCE) has continued to evolve rapidly, with v8.9…
Ghostwriter v6.3.0 and CLI v1.0.0: New Activity Logging, Faster Installs, and Better Writing QA
Published: April 10, 2026 16:00
TL;DR: Ghostwriter v6.3.0 makes day-to-day operations faster and more integrated, with a redesigned activity log that ties actions directly to evidence and terminal recordings, dramatically faster installs via published container images, and built-in…