Hot Topics

attack-path-management

Navigating the Uncharted: A Framework for Attack Path Discovery

Navigating the Uncharted: A Framework for Attack Path Discovery

| | attack path analysis, attack-path-management, clean-source-principle, identity security
This is the second post in a series on Identity-Driven Offensive Tradecraft, which is also the focus of the new course we will launch in October. In the previous post, I asked, ...
Posts By SpecterOps Team Members - Medium
Hybrid Attack Paths, New Views and your favorite dog learns an old trick

Hybrid Attack Paths, New Views and your favorite dog learns an old trick

| | Active Directory, attack-path-management, azure, BloodHound, bloodhound-enterprise
Introducing Hybrid Attack PathsDeath from Above: An Attack Path from Azure to Active Directory With BloodHoundWhen we introduced Azure Attack Paths into BloodHound, they were added as a completely separate sub-graph. At no ...
Posts By SpecterOps Team Members - Medium
The Security Principle Every Attacker Needs to Follow

The Security Principle Every Attacker Needs to Follow

| | attack path analysis, attack-path-management, clean-source-principle
Earlier this year, I was tasked with developing a follow-on course for our renowned Adversary Tactics: Red Team Operations course. The new course needed to cover the advanced tradecraft we perform on ...
Posts By SpecterOps Team Members - Medium
An AWS Administrator Identity Crisis: Part 1

An AWS Administrator Identity Crisis: Part 1

| | attack-path-management, aws, Cloud Security, IAM policy
BLUF: Every attack path needs a destination. This is a formalized way of describing destinations in AWS. In cloud providers where we only have data plane access, we divert our focus from ...
Posts By SpecterOps Team Members - Medium
Mapping Snowflake’s Access Landscape

Mapping Snowflake’s Access Landscape

| | attack-path-management, Information Security, research, snowflake, specterops
Attack Path ManagementBecause Every Snowflake (Graph) is UniqueIntroductionOn June 2nd, 2024, Snowflake released a joint statement with Crowdstrike and Mandiant addressing reports of “[an] ongoing investigation involving a targeted threat campaign against some ...
Posts By SpecterOps Team Members - Medium
Misconfiguration Manager: Overlooked and Overprivileged

Misconfiguration Manager: Overlooked and Overprivileged

| | attack-path-management, Information Security, information-technology, SCCM
TL;DR: Misconfiguration Manager is a central knowledge base for all known Microsoft Configuration Manager tradecraft and associated defensive and hardening guidance. We’re also presenting this material at SO-CON 2024 on March 11, ...
Posts By SpecterOps Team Members - Medium
Final Steps to BloodHound Federal — FedRAMP High Compliance

Final Steps to BloodHound Federal — FedRAMP High Compliance

| | Active Directory, attack-path-management, azure, BloodHound, bloodhound-enterprise
Final Steps to BloodHound Federal — FedRAMP High ComplianceEver since SpecterOps first launched BloodHound Enterprise (BHE) in July 2021, one of our team’s biggest frustrations involved a lack of FedRAMP qualifications, which prevented us ...
Posts By SpecterOps Team Members - Medium
Cypher Queries in BloodHound Enterprise

Cypher Queries in BloodHound Enterprise

| | Active Directory, active directory security, attack-path-management, BloodHound, bloodhound-enterprise
BloodHound Enterprise (BHE) recently saw the addition of a new, game-changing feature: open-ended Cypher searches. For those unfamiliar, Cypher is a declarative query language used for retrieving data from a graph database ...
Posts By SpecterOps Team Members - Medium
FOSS BloodHound 4.3.1 release

FOSS BloodHound 4.3.1 release

| | active directory security, attack-path-management, BloodHound, Offensive Security, research
We are excited to share the release of BloodHound version 4.3.1. We have accepted a lot of pull requests made by BloodHound users for bug fixes and cool improvements in this release ...
Posts By SpecterOps Team Members - Medium
Attack Path Management Pillars: Part 3 — Safe AD Security Remediation Guidance

Attack Path Management Pillars: Part 3 — Safe AD Security Remediation Guidance

| | Active Directory, active directory security, attack-path-management, BloodHound, bloodhound-enterprise
Attack Path Management Pillars: Part 3 —Practical AD Security Remediation GuidanceHistorically, Identity Attack Paths are a double edge sword; remediation efforts can easily break production applications or create more Attack Paths. Unfortunately, ...
Posts By SpecterOps Team Members - Medium
Load more

Application Security Check Up