Overview
SpecterInsight is one of the most advanced threat emulation and red teaming suites available today. Check out one of the many posts that show what you can do with SpecterInsight!
Posts
- AI-Powered Red Teaming with SpecterInsight
T1059.001 PowerShell · T1027 Obfuscation · T1547.001 Run Keys · T1053.005 Scheduled Tasks · T1003.002 SAM Dump · T1562.001 Disable Security Tools · T1046 Network Discovery · T1018 Remote System Discovery · T1134 Access Token Manipulation · T1021.003 WMI Lateral Movement · T1552.001 Credentials in Registry · T1082 System Information Discovery Feature Spotlight August 30,… Read more: AI-Powered Red Teaming with SpecterInsight - How to Build Threat Emulation Workflows
Operator Guide · SpecterInsight v7.0.0 · Threat Emulation THREAT EMULATION WORKFLOWS SpecterInsight workflows let you encode an entire attack chain and run it repeatedly against a lab or authorized environment. In this guide, I’ll build one from initial access through lateral movement and show how I use each phase to check what the endpoint, network… Read more: How to Build Threat Emulation Workflows - Emulating APT28 PRISMEX with SpecterInsight
TLP:AMBER · For authorized operational and training use only SpecterInsight v7.0.0 Adversary Emulation · APT28 / Pawn Storm · 2022–2025 PRISMEX Full kill chain emulation of Pawn Storm / APT28: from spear-phishing delivery through credential harvesting, WMI lateral movement, and a destructive user-profile wiper. Executed as a 33-cell SpecterInsight Workflow. Threat Actor APT28 / Pawn… Read more: Emulating APT28 PRISMEX with SpecterInsight - Feature Spotlight: The Zig Payload Pipelines
SpecterInsight’s Zig payload pipelines give you full cross-platform, native payload generation from a single server. Zig 0.16.0 is bundled as the compiler. It runs identically on Windows and Linux hosts and cross-compiles to any combination of OS (Windows, Linux, macOS) and architecture (x86, x86_64, aarch64) without any additional toolchain setup. Before the compiler sees a… Read more: Feature Spotlight: The Zig Payload Pipelines - Improved RpcGhosting
This is a story about when your AMSI Bypass breaks your own downloader A while back, I was integrating the RpcGhosting AMSI bypass into SpecterInsight and noticed that it broke several of my PowerShell loader pipeline integration tests intermittently. This post is going to describe how I identified and fixed RpcGhosting to not break all… Read more: Improved RpcGhosting - Dumping LSASS Without Touching Disk: Improvements to ShadowDumper
While integrating LSASS dumping techniques into SpecterInsight’s dumper module, I used Offensive-Panda’s ShadowDumper as a reference point. That tool is great collection of LSASS dump techniques, but I also wanted to improve upon their research by addressing some of the issues that might result in detection by an EDR: The rest of this post walks… Read more: Dumping LSASS Without Touching Disk: Improvements to ShadowDumper - Profiling User Activity with EventLogs
Introduction Understanding user logon behavior is a powerful tool in red teaming and adversary simulations. By analyzing who logs into a system, when, from where, and how frequently, operators gain deep situational awareness that can inform stealthy movements, impersonation opportunities, and identify high-value targets. This post presents a PowerShell script built to extract and analyze… Read more: Profiling User Activity with EventLogs - Stealthy Lateral Movement Techniques with WinRM
Overview In this post, I am going to go over how to use WinRM to laterally move within an Active Directory network and to try and blend in with the noise. While WinRM does give you the ability to run remote commands, it may be limited in what it can access without pushing payloads to… Read more: Stealthy Lateral Movement Techniques with WinRM - Bypassing AMSI and Evading AV Detection with SpecterInsight
Introduction A few weeks ago, there was a post on reddit asking for advice on how to get their AMSI bypass through Windows Defender without being detected. Recently, it has become much more difficult to build payloads that can evade detection. Microsoft has out a ton of effort into deploying good heuristic signatures to block… Read more: Bypassing AMSI and Evading AV Detection with SpecterInsight - Building a RuntimeInstaller Payload Pipeline to Evade AV Detection
Overview In this post, we will build an automated pipeline for generating a .NET loader payload that can evade both AV detection and application controls. The tools used in this post are: What is a Payload Pipeline A payload pipeline is an automated process for generating red team payloads that can evade detection by antivirus,… Read more: Building a RuntimeInstaller Payload Pipeline to Evade AV Detection - New AMSI Bypss Technique Modifying CLR.DLL in Memory
Introduction Recently, Microsoft has rolled out memory scanning signatures to detect manipulation of security critical userland APIs such as AMSI.dll::AmsiScanBuffer. You can read about the details on this post. For us red teamers, that means the era of overwriting or hooking that method to bypass the Anti-Malware Scan Interface (AMSI) incoming to an end. So… Read more: New AMSI Bypss Technique Modifying CLR.DLL in Memory - Obfuscating API Patches to Bypass New Windows Defender Behavior Signatures
Introduction I’ve got a short post today based on some recent changes by Windows Defender. Over the weekend, I noticed that some of my unit tests began failing on code that had not been recently changed. Upon further investigation, I found that it was specifically related to the AMSI bypass through API call patching. This… Read more: Obfuscating API Patches to Bypass New Windows Defender Behavior Signatures - Extracting Credentials From Windows LogsOverview During a recent engagement, I observed a lot of members of a particular organization authenticating with remote systems and services over the commandline with username and password in plaintext. This ranged from domain administrators using the net user command to create user accounts and updated passwords to database administrators managing their instances with commandline… Read more: Extracting Credentials From Windows Logs
- How to Leverage PowerShell Profiles for Lateral Movement
Overview PowerShell profiles are scripts that automatically run when you start a PowerShell session. These profiles allow you to customize your PowerShell environment, set preferences, and execute specific commands or functions each time you launch PowerShell. There are different profiles for different scopes, enabling you to have different configurations for various scenarios. As an adversary,… Read more: How to Leverage PowerShell Profiles for Lateral Movement - How to Emulate a Ransomware Attack
Overview Ransomware is here to stay and cyber security professionals need to be trained to prevent, detect, respond, and recover from ransomeware attacks. So, how do we do that in an ethical and repeatable way? This post will walk through how SpecterInsight’s ransomware emulation capability works and give insight into the inner workings of a… Read more: How to Emulate a Ransomware Attack - How to Leverage Internal Proxies for Lateral Movement, Firewall Evasion, and Trust Exploitation
Overview The primary tactic we will be exploring in this post is the use of proxies inside of a target network. There are a lot of different types of proxies for both offense and defense. This post will focus on Internal Proxies (MITRE 1090.001) which are a sub-technique of Proxy (MITRE 1090). We will cover… Read more: How to Leverage Internal Proxies for Lateral Movement, Firewall Evasion, and Trust Exploitation - Credential Harvesting with PowerShell and SpecterInsight
Overview Credential harvesting, also known as credential theft or credential stealing, refers to the collection sensitive authentication information from individuals or systems. The goal of credential harvesting is to obtain usernames, passwords, or other authentication tokens that allow access to protected resources. This post will cover a variety of different credential harvesting techniques, how to… Read more: Credential Harvesting with PowerShell and SpecterInsight - Automating a Local PortscanOverview In this post, I am going to demonstrate a script for automating a local TCP port scan in PowerShell. This was a seemingly simple task that I end up doing in almost all of my engagements, and I get tired of having to manually identify connected networks and built a command to port scan… Read more: Automating a Local Portscan
- Persistence with WMI Event Subscription and PowerShell Cradles
Overview In this post, we are going to demonstrate how to build a script to automate persistence lay down via WMI Event Subscription and dynamically generated PowerShell payloads. By the end, we will have a single parameterized script that can be leveraged to establish signature resistant persistence, thus alleviating much of the tedious manual work… Read more: Persistence with WMI Event Subscription and PowerShell Cradles - New AMSI Bypass Using CLR Hooking
Introduction In this article, I will present a new technique to bypass Microsoft’s Anti-Malware Scan Interface (AMSI) using API Call Hooking of CLR methods. When executed on a Windows system, this AMSI bypass will prevent the current process from passing any more data to the installed AV, thus allowing for malicious code to be loaded… Read more: New AMSI Bypass Using CLR Hooking