Posts by SpecterOps Team Members

Code Signing Certificate Cloning Attacks and Defenses

Ready to hunt? First, Show me your data!

Nowadays, Threat Hunting is a very popular topic among not just security practitioners in…

Designing Effective Covert Red Team Attack Infrastructure

Adventures in Extremely Strict Device Guard Policy Configuration Part 1 — Device Drivers

The PowerView PowerUsage Series #4

This is a short follow-up to my “A Guide to Attacking Domain Trusts” post, and the fourth post in my “PowerView PowerUsage” series. It follows the same Scenario/Solution/Explanation pattern as the previous entries, with the original post containing a constantly updated…

Lateral Movement Using Outlook’s CreateObject Method and DotNetToJScript

A Look at CVE-2017–8715: Bypassing CVE-2017–0218 using PowerShell Module Manifests

Bypassing Application Whitelisting with runscripthelper.exe

Introduction

While running through one of the labs for our PowerShell course, I stumbled upon a Microsoft-signed PowerShell host process in System32 — runscripthelper.exe. This program was just…

Raphael’s Thoughts: SpecterOps acquires MINIS

Today, SpecterOps announces its acquisition of MINIS LLC. The company is doing its social media thing to spread the word. I wanted to take a moment to share the news and comment on it in my own words. If you want press release language, we have that…