![SpecterOps](/img/default-banner.jpg)
- 159
- 254 042
SpecterOps
United States
Registrace 22. 09. 2017
To Infinity and Beyond: Building Purple Team Test Cases
This webinar explores SpecterOps' approach to Purple Teaming. The presenters examine the intricacies of evaluating security controls in the context of User Hunting, a popular attack technique used to discover where high-value users are logged in throughout the network to target their identity. They cover many common mistakes defenders make in designing, testing, and evaluating detection strategies.
Topics include understanding the various procedures available to attackers, assessing the difference between tool, modality, and behavior-based detection, designing test cases, calculating probability in the face of uncertainty, and more. If you've ever wondered whether your detection program is ready for battle, this webinar is for you!
Topics include understanding the various procedures available to attackers, assessing the difference between tool, modality, and behavior-based detection, designing test cases, calculating probability in the face of uncertainty, and more. If you've ever wondered whether your detection program is ready for battle, this webinar is for you!
zhlédnutí: 285
Video
Demo: Attack Path Management, the BloodHound Enterprise Way (June 25, 2024)
zhlédnutí 221Před 21 dnem
In this webinar, Sergio Gonzalez breaks down the key concepts around Active Directory Attack Path Management. Through this interactive walkthrough he covers why you should care about Attack Paths and how BloodHound approaches identification and elimination. Sergio discusses how security teams can operationalize continuous Attack Path mapping, measuring impact, and prioritizing mitigation effort...
Ghosts on the Node - Will Pearce & Nick Landers [SO-CON 2024]
zhlédnutí 435Před měsícem
2023 was a breakthrough year for all things Machine Learning, especially for generative use cases. The community saw models and frameworks released at a blistering pace thanks to innovative solutions to fit LLMs onto smaller and smaller devices (LoRA, PEFT, etc). The industry saw the rise of risk assessment frameworks and legislative actions, leading to new requirements for organizations to fol...
Building Our Nemesis
zhlédnutí 569Před měsícem
This webinar delves into the recent release of Nemesis 1.0, our offensive-focused data enrichment pipeline years in the making. Nemesis aims to unify all post-exploitation data from offensive engagements in order to improve operator workflows, provide tradecraft assistance, and uncover new data-driven research opportunities. The presenters cover various red team challenges that influenced Nemes...
No Cert? No Problem - ClickOnce (Ab)Use for Trusted Code Execution
zhlédnutí 331Před měsícem
Initial access payloads have historically had limited methods that work seamlessly in phishing campaigns and can maintain a level of evasion. This payload category has been dominated by Microsoft Office types, but as recent news has shown, the lifespan of even this technique is shortening. A vehicle for payload delivery that has been greatly overlooked for initial access is ClickOnce. ClickOnce...
Analyzing and Executing ADCS Attack Paths with BloodHound- Andy Robbins & Jonas Knudsen[SO-CON 2024]
zhlédnutí 294Před měsícem
Active Directory Certificate Services (ADCS) is Microsoft’s native PKI solution, used by many organizations to facilitate smart card authentication, TLS certificate issuance and verification, code signing, and other tasks. ADCS is a complicated system with many moving parts and possible configurations, out of which privilege escalation opportunities often emerge. Discovering those opportunities...
KubeHound and Beyond: Evolving Security Through Graphs & Automation - Jeremy Fox [SO-CON 2024]
zhlédnutí 280Před měsícem
The attack surface within modern cloud-native organisations is vast, with often tens or hundreds of thousands of application instances. Understanding interdependencies in a system of this scale, in particular gaps left open by seemingly innocent configuration changes, is beyond human capability. As such, the current mental model of defense remains list-based; attempting to identify vulnerable c...
Misconfiguration Manager: Overlooked and Overprivileged- Duane Michael & Chris Thompson[SO-CON 2024]
zhlédnutí 355Před měsícem
Configuration Manager (SCCM) attack paths have become more and more common recently. The impact of these attack paths is significant, as they often directly lead to domain compromise, else enable it. In this talk we discuss some of the most critical and common SCCM attack paths we've discovered and abused in the wild and how to best mitigate and manage them. Additionally, we introduce a model f...
The BloodHound Enterprise State of Attack Path Management - Justin Kohler [SO-CON 2024]
zhlédnutí 176Před měsícem
Three years after we published the Attack Path Management Manifesto, BloodHound Enterprise (BHE) has become a cornerstone of the Identity security strategy for hundreds of organizations, uncovering and mitigating billions of Attack Paths in the process. Join this session to delve into the practical insights gained from real-world deployments and explore leading practices for managing Identity A...
Beyond the Shell: Unconventional Agents for Red Teaming Success - Cody Thomas [SO-CON 2024]
zhlédnutí 997Před měsícem
In this presentation, we delve into the uncharted territories of offensive security using the Mythic C2 platform. Moving beyond traditional red teaming approaches, we explore unconventional agents that redefine how operators interact with target environments. Discover the power of remotely controlling webshells seamlessly alongside beaconing agents from a unified interface, and the creation of ...
Manually Enumerating AD Attack Paths with BOFHound - Matt Creel & Adam Brown [SO-CON 2024]
zhlédnutí 297Před měsícem
Manually Enumerating AD Attack Paths with BOFHound - Matt Creel & Adam Brown [SO-CON 2024]
Identity Providers for Red Teamers - Adam Chester [SO-CON 2024]
zhlédnutí 2,2KPřed měsícem
Identity Providers for Red Teamers - Adam Chester [SO-CON 2024]
Attack Path Based Detection Engineering: Leveraging BloodHound for Ro... -Olaf Hartong [SO-CON 2024]
zhlédnutí 1,4KPřed měsícem
Attack Path Based Detection Engineering: Leveraging BloodHound for Ro... -Olaf Hartong [SO-CON 2024]
Graphs are Hard - John Hopper & Rohan Vazarkar [SO-CON 2024]
zhlédnutí 225Před měsícem
Security domains like Microsoft Entra, Active Directory, AWS IAM and others are highly complex and difficult to examine. BloodHound is a tool that utilizes graph constructs to make these domains easier to reason with to shorten time to discovery of interesting attack vectors. Throughout SpecterOps' journey in producing BloodHound with a focus on Attack Path Management there have been many engin...
LSA Whisperer - Evan McBroom [SO-CON 2024]
zhlédnutí 271Před měsícem
Accessing LSASS memory has been a common goal for attackers due to its management of user credential material. Microsoft has added multiple features to Windows to make gaining such access more difficult including Credential Guard, Remote Credential Guard, and Protected Processes Light (PPL). These features are helpful but irrelevant if an attacker is able to request credentials from the LSA dir...
The Dog Ate My Homework... (re)Building a PowerShell module for the... - JD Douillard [SO-CON 2024]
zhlédnutí 143Před měsícem
BloodHound has been my faithful companion for some years now, so I was really excited when the BloodHound team announced the release of the new BloodHound Community Edition earlier last year… but then I quickly realized most of the custom BloodHound tooling I had built over the years wouldn't work anymore in the new BloodHound version. Past a moment of despair, and rather than trying to adapt m...
Domain Persistence: Detection, Triage, and Recovery - Josh Prager & Nico Shyne [SO-CON 2024]
zhlédnutí 627Před měsícem
We'll dive into Active Directory domain persistence techniques focused on identifying attacks and reclaiming control over organizational domains after a breach. The presentation explores various advanced adversarial techniques such as credential theft on domain controllers, NTDS access, DCSync, and the creation of Golden and Diamond Tickets. It emphasizes the importance of detecting these metho...
2023 SANS SOC Survey Review: Highlights and Deep Dive - Christopher Crowley [SO-CON 2024]
zhlédnutí 134Před měsícem
2023 SANS SOC Survey Review: Highlights and Deep Dive - Christopher Crowley [SO-CON 2024]
Project Apeman: Mapping AWS Identity Attack Paths - Daniel Heinsen [SO-CON 2024]
zhlédnutí 296Před měsícem
Project Apeman: Mapping AWS Identity Attack Paths - Daniel Heinsen [SO-CON 2024]
The New SaaS Cyber Kill Chain - Luke Jennings [SO-CON 2024]
zhlédnutí 401Před měsícem
The New SaaS Cyber Kill Chain - Luke Jennings [SO-CON 2024]
Attack Path Management, the BloodHound Enterprise Way (May 23, 2024)
zhlédnutí 272Před měsícem
Attack Path Management, the BloodHound Enterprise Way (May 23, 2024)
Attack Path Management, the BloodHound Enterprise Way
zhlédnutí 355Před 2 měsíci
Attack Path Management, the BloodHound Enterprise Way
Defining the Undefined: What is Tier Zero Part III
zhlédnutí 548Před 3 měsíci
Defining the Undefined: What is Tier Zero Part III
Domain Persistence: Detection, Triage, and Recovery
zhlédnutí 933Před 4 měsíci
Domain Persistence: Detection, Triage, and Recovery
Microsoft Breach: What Happened? What Should Azure Admins Do?
zhlédnutí 7KPřed 6 měsíci
Microsoft Breach: What Happened? What Should Azure Admins Do?
BloodHound Enterprise | Attack Path Management for All
zhlédnutí 1,9KPřed 8 měsíci
BloodHound Enterprise | Attack Path Management for All
Awesome talk! There should be a 2024 version now
Wow amazing
Thanks for posting. 🎉 very interesting
amazing work!
Great talk. Thank you. 🎉
first.
So you really don't think anyone can totally understand kerberos will watch your video😂😅😊
still relevant and good!
Answer me people cos im stuck
It didnt generate password
What im supposed to do
Everything is fine..also kindly tell us to remove this whole neo4j server from our system?
Really enjoyed this vid, I manage some Azure Tenants and all cloud providers are a whole discipline in themselves, so much to look over and keep an eye on
Learned a lot! Thanks
Make content losers.
Man...I had a blast! thank you so much for your brilliant explanation Andy! keep coming!
It's my pleasure, thank you for watching. I hope the information was useful.
Best OS C2 in 2024. Thank you Cody and SpecterOps.
Great stuff, got useful for personal project
oh man this is pure gold thanks!!
thanks guys. very very comprehensive overview
Having an AUDIENCE for this video that asks questions and clarifies things is GREAT.
Thank you for that feedback, Dave, and thank you for watching our video
For next video would appreciate it for us old ppl that you have a SLIGHTLY BIGGER terminal font :)
Thank you for that note, Dave, I will make sure terminals are easily legible the next time we make a video
Great Stuff. Do you have a discord link or Telegram?
We are not on Discord or Telegram. You can follow us on: X: twitter.com/SpecterOps LinkedIn: www.linkedin.com/company/specterops Mastodon: infosec.exchange/@SpecterOps You can also join the conversation on our BloodHound Gang Slack channel at ghst.ly/BHSlack
Can you elaborate on what you said at 30:55, that disabling user consent would not have prevented SVR from granting consent to the malicious OAuth applications?
Awesome explanation.
Thank you
Great session, thanks for uploading it.
It's our pleasure. Thank you for watching the video
Amazing video! Always love to hear from Andy :)
So con deez nutz
please share slide.
You can view the slides at: ghst.ly/48KrccT
Bloodhound is pure terror evey time!
please share slide
You can view the slides at: ghst.ly/48KrccT
This is what makes being on the blue team fun. Red can develop some undetected tradecraft but once that is dropped in an exercise, the best blue teamers will expand that into coverage and tests for all the most generic detects possible over as many variations as nessecary. On Windows alone I’ve seen process injection and friends covered by 9 unique combinations of the related events. And tests for all of them. So while colbalt strike may be the most reliable red team approach for exercises, developing test coverage that can run in CI even remotely reliably is a separate challenge. These issues can often lead to frustration on the red side because blue (in my experience) always need more time than red teamers have the patience for.
Were you going to incorporate the prebuilt analysis paths into the CE version at some point?
Hi there, are you referring to the pre-built queries? If so, they are available under the Cypher box, then clicking the folder "Open" button on the left-hand side!
Thanks. Found them. @@stephenhinck9204
Thankyou
Best beard in the business
It's very interesting tool
Thanks for this. Just one question though, any options to convert data collected using old legacy Sharphound to the new bloodhound-ce supported format? I noticed that even if I ingest it the UI doesn't give me an error, but the data won't show (I presume the bloodhound-ce doesn't recognize the data collected using with legacy Sharphound). any possibility to make the older data work with CE?
Hi @user-ye3pq6zv5z, sorry for the delay in answering your question. Unfortunately with the major update from Legacy BloodHound to BloodHound Community Edition, we had to make breaking changes that mean data collected from older versions of SharpHound are not compatible with the latest BloodHound.
Can someone help? At 12:57, what does it mean if using FQDN to access something, it will break it?
FQDN to access something refers to specifying the complete domain name for a resource, including the hostname and the domain suffix (e.g., hostname.example.com) "break it" is related to LLMNR. ( look at the example how he got the NTLM hash. break it means in local networks for name resolution when the DNS resolution fails, typically due to DNS server unavailability or misconfiguration. then the LLMNR coming up to play. try to google how FQDN & LLMNR related to each other.
Problems I’ve run into as a detection engineer (blue): * red team NOT willing to share their best tradecraft * red team not understanding the challenge of designing detections that are precise enough to be viable * red team drops undetected kill chain and *mic drops*. “We win, gg”. And gets frustrated with the time it takes for blue to come up with a detection and ship / deploy it, analyze early results, deploy allowlisting, and arrive at a detect worth triaging. Some questions for others doing purps out there in the field: * are you purple teaming on your org’s actual network or a testing (and likely much simpler, less noisy) network? * what info / access are you giving red to start with and what is a successful kill chain? Do they get to drop and exec a file on the box or do they have to start with recon / enumerating the attack surface? * Is there a flag that red must exfil, or is the goal to achieve persistence inside the perim, or domain admin?
Thanks I did not know Shroud knows INFOSEC!
i swear i thot abt the same thing lol
😂 spot on
Every time SO drops a new tool I'm like: how do you guys consistently crank out such awesome stuff!!!!
I really like this.
This talk really helped me understand why this is useful, thanks for posting!
32:56 This is exactly what happened in HTB Forest. Members of the "Exchange Windows Permissions" group have WriteDacl on the domain. Glad that you explained this part. Suggestion, maybe you guys can do HTB (initial scanning can be skipped), probably not a walkthrough but to just explain the science behind it, how to do it right, and how to defend against this attack
0:29 ACH file is a fixed-width, ASCII file, with each line exactly 94 characters in length. May I know what so special about this? Thanks Andy and Will for all your great jobs
I came here to learn how to use merlin. Ended up learning much more. Very well presented and easy to understand. Never knew the difference between HTTP 1,2, and 3. That alone, for me, was very helpful and something I should have known long ago. Like they say, you don't know, what you don't know. Thank you
I guess my only complaint is that I will now have less time for coffee breaks betweeen queries lol. Awesome update!
Great work. This looks amazing. Congratulations to the team 👏
Really looking forward to this. I've a file of a few gigabytes from a university that was gonna take hours to import into the current bloodhound. Will try again with this one.
No audio for this? I click the link and it says that "This video isn't available any more" Anyway, you guys rocks! cc @harmj0y @SpecterOps