Published inPosts By SpecterOps Team Members·PinnedCertified Pre-OwnedTL;DR Active Directory Certificate Services has a lot of attack potential! Check out our whitepaper “Certified Pre-Owned: Abusing Active Directory Certificate Services” for complete details. We’re also presenting this material at Black Hat USA 2021. [EDIT 06/22/21] — We’ve updated some of the details for ESC1 and ESC2 in this…Active Directory22 min readActive Directory22 min read
Published inPosts By SpecterOps Team Members·Aug 9Hacking With Your NemesisIn the first post in this series, On (Structured) Data, we talked about the gap area of offensive structured data and ended with the question, “If all of our offensive tools produced and worked with structured data, what would be possible?” The second post, Challenges In Post-Exploitation Workflows, covered several…Offensive Security18 min readOffensive Security18 min read
Published inPosts By SpecterOps Team Members·Aug 2Challenges In Post-Exploitation WorkflowsIn our previous post, we talked about the problem of structured data in the post-exploitation community. We touched on the existing relationship between our tools and data and covered some of the domain-specific challenges that come with offensive data collection. We ended with the question “If all of our offensive…Red Team13 min readRed Team13 min read
Published inPosts By SpecterOps Team Members·Jul 26On (Structured) DataIntroduction The offensive security industry is a curious one. On one hand, we are ahead in various trends (or “thought leadership,” as some would have us term it) and are used to literally “moving fast and breaking things.” On the other hand, we’re far behind similar disciplines. One major area where…Offensive Security9 min readOffensive Security9 min read
Published inPosts By SpecterOps Team Members·Nov 9, 2022Certificates and Pwnage and Patches, Oh My!This post was written by Will Schroeder and Lee Christensen. A lot has happened since we released the “Certified Pre-Owned” blog post and whitepaper in June of last year. While the paper details a LOT of tradecraft ranging from credential theft to domain persistence, the part that caught most people’s…Active Directory16 min readActive Directory16 min read
Published inPosts By SpecterOps Team Members·Jul 7, 2022Koh: The Token StealerEdit 07/13/22: After an awesome back and forth with Clément Notin and @SteveSyfuhs on Twitter on the effects of “TokenLeakDetectDelaySecs” and “Protected Users” for mitigating token theft, I’ve updated the Koh README to reflect these mitigations. Years ago I was chatting with a few experienced red teamers and one was…Windows11 min readWindows11 min read
Published inPosts By SpecterOps Team Members·Jun 1, 2022DeepPass — Finding Passwords With Deep LearningOne of the routine tasks operators regularly encounter on most engagements is data mining. While exactly what operators are after varies from environment to environment, there is one common target that everyone’s always interested in: passwords. After diving into machine learning from an adversarial perspective I started to pay attention…Machine Learning12 min readMachine Learning12 min read
Published inPosts By SpecterOps Team Members·May 4, 2022Learning Machine Learning Part 3: Attacking Black Box ModelsIn the first post in this series we covered a brief background on machine learning, the Revoke-Obfuscation approach for detecting obfuscated PowerShell scripts, and my efforts to improve the dataset and models for detecting obfuscated PowerShell. …Machine Learning24 min readMachine Learning24 min read
Published inPosts By SpecterOps Team Members·Apr 26, 2022Learning Machine Learning Part 2: Attacking White Box ModelsIn the previous post, I went through a very brief overview of some machine learning concepts, talked about the Revoke-Obfuscation project, and detailed my efforts at improving the dataset and models for detecting obfuscated PowerShell scripts. That resulted in three separate tuned models for obfuscated PowerShell script detection: a Logistic…Machine Learning25 min readMachine Learning25 min read
Published inPosts By SpecterOps Team Members·Apr 5, 2022Learning Machine Learning Part 1: Introduction and Revoke-ObfuscationFor the past two years I’ve been trying to get a grasp on the field of machine learning with the hopes of applying it to both offense and defense. At the beginning of this journey I had no idea what Random Forests were, the tradeoffs of underfitting and overfitting, what…Machine Learning28 min readMachine Learning28 min read
