SpecterInsight v7.0.0 ships built-in end-to-end threat emulation workflows including a PRISMEX/Pawn Storm campaign scenario, a managed cross-platform WinRM client, COM Cross-Session Activation lateral movement, SSH and Tor SOCKS5 tunnel management, a WebDAV file server, two new LevelUp privilege escalation CVEs (CVE-2026-24291 and CVE-2026-50656), a pre-authentication Domain Controller RCE via CLDAP Netlogon overflow (CVE-2026-41089), three new persistence techniques (ClickOnce COM hijack, COM DLL hijack, hidden null-byte Run key), VSS-based SAM dump via NT native APIs, two new AMSI bypasses (AmsiWriteRaid and PatchAmsiProvider), four new document payload generators (OneNote, XLM macro, VBA injector, PowerPoint), a 32-bit staged Zig DLL pipeline, Linux implant compatibility fixes, a database-backed wordlist system with SpecterScript parameter integration, email and username OSINT across 197 platforms, and a parallel async subdomain finder. Fifteen new SpecterScripts and five new UI panels round out the release.
Workflows: End-to-End Threat Emulation
SpecterInsight ships with built-in end-to-end threat emulation workflows. Each workflow encodes a complete adversary attack chain as an interactive, phase-by-phase playbook: markdown cells document the technique being emulated and its MITRE ATT&CK mapping, parameter cells collect target-specific values once and share them across all phases, and script cells drive execution step by step against live sessions.
Workflows are designed for authorized red team engagements and adversary simulation training – giving operators a structured, repeatable means to validate detection and response coverage against realistic attack chains without building custom playbooks from scratch. SpecterInsight ships several out-of-the-box attack scenarios covering distinct threat actor behaviors, delivery mechanisms, and post-exploitation objectives.
PRISMEX – Pawn Storm Destructive Campaign
An end-to-end emulation of the Pawn Storm (APT28) PRISMEX destructive campaign. The workflow walks through spear-phishing initial access via a macro-enabled lure document, implant foothold, post-exploitation host and domain reconnaissance, credential harvesting, file staging, and destructive payload execution via Invoke-UserProfileWipe – emulating the PRISMEX wiper behavior against user profile data (Desktop, Documents, Downloads, Pictures, Videos, Music, AppData\Temp). Anti-forensic cleanup including artifact removal and timestomping concludes the chain.
MITRE ATT&CK coverage: T1566.001, T1204.002, T1059.001, T1082, T1518.001, T1033, T1003.002, T1552.002, T1560.001, T1005, T1485, T1070.004, T1070.006.
WinRM Remote Administration
A new managed cross-platform WinRM client enables remote PowerShell command execution, module delivery, and file operations against Windows targets without requiring Windows SSPI or platform-specific dependencies. A SpecterInsight server running on Linux can authenticate to and administer Windows WinRM targets using password, Kerberos, or certificate credentials.
Tor Routing
The WinRM PtH client accepts an optional torConnect callback that replaces the underlying TCP connection with a Tor-proxied socket. This enables WinRM Pass-the-Hash sessions routed through the Tor network.
WinRM Sessions UI
A new WinRM Sessions panel appears in the operator workspace. Each session shows an auth-type badge (Password, Kerberos, Certificate), SSL and Tunneled indicators, and a color-coded streaming task output pane (white = output, orange-red = error, gold = warning, blue = information).
The action toolbar provides:
- AMSI Bypass – applies one of five techniques: PatchInMemory, PatchScanContent, PatchAddType, RpcGhosting, RpcGhostingPowerShell.
- ETW Bypass – applies the
etw_patchpipeline. - Run Script – uploads a
.ps1file and executes it over WinRM. - Import Module – base64-encodes a DLL, writes it to a temp path on the remote, and calls
Import-Module. - Upload – uploads arbitrary files to a specified remote path.
Commands stream back line-by-line via HTTP SSE. The Create Session dialog supports target auto-complete from known hosts, per-session Tor routing, and routing through an active Specter implant session for network pivoting.
Lateral Movement: COM Cross-Session Activation
Invoke-CrossSessionActivation executes an arbitrary command in a different Windows logon session on the local or a remote machine. The technique uses two undocumented COM interfaces:
ISpecialSystemProperties({6C736DC1-…}): ExposesSetSessionId(), which routes the subsequent COM server activation to a specific logon session instead of the caller’s own session. This is the interfacerpcssuses internally for session routing.IHxHelpPaneServer({8cec592c-…}): Exposed byHelpPane.exe. ItsExecute()method runs a file path within the server’s session context.
The caller activates the HelpPane CLSID, queries ISpecialSystemProperties to redirect to the target session, then queries IHxHelpPaneServer and calls Execute(command). The command runs as the user owning that session. No service is created, no WMI process is spawned, no SMB share is touched – detection signatures for standard lateral movement techniques do not apply.
Optional credential impersonation via LogonUser with LOGON32_LOGON_NEW_CREDENTIALS enables authenticated activation against remote DCOM endpoints using different credentials.
Cmdlets
Get-CsaTargets scans the target’s HKLM registry for COM AppIDs where RunAs = "Interactive User" and LaunchPermission grants COM_RIGHTS_EXECUTE_REMOTE | COM_RIGHTS_ACTIVATE_REMOTE to Everyone or BUILTIN\Administrators. The binary SECURITY_DESCRIPTOR in LaunchPermission is parsed directly – no Win32 ACL API is called.
Parameters: -ComputerName, -Username, -Password.
Invoke-CrossSessionActivation delivers the command. Parameters: -ComputerName, -SessionId (from qwinsta), -Command, -Method (HelpPane), -Username, -Password. Returns CsaResult objects with Success and Error fields.
SSH and Tor Tunnels
Two new tunnel types are available from the operator workspace, adding SOCKS5 proxy infrastructure that can be routed through the C2 channel, the Tor network, or directly.
SSH Tunnels
SSH Tunnels creates persistent SOCKS5 dynamic proxy tunnels over SSH connections managed by the server. Three routing modes:
- Direct – the server connects to the SSH target directly.
- Tor – the SSH handshake is proxied through the Tor daemon before the tunnel is established.
- C2 Tunnel – the SSH connection is routed through a Specter implant session, reaching SSH servers on isolated internal networks. This creates a two-hop pivot: implant C2 channel → SSH tunnel → SOCKS5 proxy.
Authentication supports password and private key. The tunnel list shows label, SOCKS5 port, SSH target, routing mode, live status, and connection count.
Tor Tunnels
Tor Tunnels creates SOCKS5 listeners that route traffic through the Tor network. Exit node selection offers three modes:
- Random – Tor selects the circuit.
- Country – the exit node list is loaded from the server, grouped by country code, and filtered. Nodes are sorted descending by relay bandwidth. The operator picks a specific relay; the exit IP column updates live as Tor assigns the circuit.
- Fingerprint – a specific 40-character relay fingerprint is provided directly.
The tunnel list polls every two seconds to display the current exit IP, active connections, and Tor bootstrapping status.
WebDAV File Server
A new WebDAV Files panel exposes the server-side WebDAV host as a tree-view file manager. Files can be added from disk, directories created, and entries removed. As implants push exfiltrated files to the WebDAV store, SignalR push notifications update the tree in real time without manual refresh. The tree preserves per-folder expansion state across each update cycle.
Port Proxy Manager
Add-PortProxy, Get-PortProxy, and Remove-PortProxy manage Windows TCP port forwarding rules by writing directly to the iphlpsvc registry path (HKLM\SYSTEM\CurrentControlSet\Services\PortProxy) and signaling iphlpsvc with SERVICE_CONTROL_PARAMCHANGE. Rules activate within milliseconds – no reboot or service restart required. All four address families are supported: v4tov4, v4tov6, v6tov4, v6tov6. This approach avoids invoking netsh interface portproxy, a common detection point.
Requires administrator elevation. Invalid IP addresses are rejected before any registry write.
Privilege Escalation: New LevelUp Techniques
Two new CVE implementations have been added to the LevelUp module.
CVE-2026-24291 – RegPwn: OSK ATConfig Symlink LPE
An LPE targeting Windows 10 21H2 (build 19044+), Windows 11, and Windows Server 2016/2019/2022. No elevation is required. The technique exploits the On-Screen Keyboard’s accessibility configuration sync mechanism to achieve SYSTEM command execution without user interaction.
The On-Screen Keyboard binary (osk.exe) syncs settings from HKCU\...\ATConfig\osk to a session-specific HKLM path on startup. The exploit chains two primitives:
- An NT-level exclusive oplock (
FSCTL_REQUEST_OPLOCK_LEVEL_1viaNtFsControlFile) onoskmenu.xmlis armed before osk.exe is launched. When osk.exe opens the file at startup, the oplock fires and the exploit thread gains a controlled execution window. - Inside the window, the real HKLM ATConfig\osk key is deleted and replaced with a volatile
REG_OPTION_CREATE_LINKregistry symlink (written viaRegCreateKeyExWwithKEY_CREATE_LINK) pointing tomsiserver‘s registry path. - The oplock is acknowledged. osk.exe resumes, reads the HKCU payload, and writes it through the symlink – landing the attacker-controlled command in
msiserver\ImagePath. msiserveris started and runs the payload as SYSTEM.
Cleanup removes the HKCU staging key and clears the HKCU\...\Accessibility\Configuration side-effect value that osk.exe writes, which would otherwise cause OSK to auto-launch on every subsequent UAC secure desktop prompt.
Volatile registry symlinks disappear on reboot, minimizing forensic residue. All registry access uses raw NT P/Invoke – no Microsoft.Win32.Registry wrappers.
CVE-2026-50656 – RoguePlanet: Defender TOCTOU Elevation of Privilege
An EoP targeting Windows 10 21H2+ and Windows 11. Windows Server variants are excluded. No elevation is required. The technique exploits a Time-of-Check/Time-of-Use race in the Windows Defender Malware Protection Engine (MsMpEng.exe): the engine follows reparse points (junctions) during quarantine operations without re-validating the target path between check and use.
Two compressed payloads are embedded as deflated byte arrays compiled into the assembly – a prepared ISO image and a bootstrapping DLL. No files are written to disk until runtime.
The exploitation chain runs in two oplock-choreographed stages:
- A crafted ISO containing a legitimate
wermgr.execopy is mounted as a virtual disk. An ADS is planted on a working-directory file to trigger a Defender scan. Once Defender creates a VSS shadow copy, an oplock-1 fires on the ADS path inside the shadow copy. When Defender opens the ADS for remediation, the working subdirectory is atomically swapped to a junction pointing to the mounted ISO viaSetReparsePoint. Defender follows the junction into the ISO and creates a quarantine temp file underC:\Windows\Temp. - An oplock-2 fires on the junction directory handle. When Defender opens it to finalize, the embedded payload is written into the quarantine-staged file through the open handle. The file is renamed via POSIX rename (
NtSetInformationFile FileRenameInformation, bypassing Win32 path locking). The workdir junction is redirected to\??\C:\Windowsso Defender executes the payload with SYSTEM privileges.
A named pipe delivers the target command to the SYSTEM payload after launch. HIGH_PRIORITY_CLASS and THREAD_PRIORITY_TIME_CRITICAL improve race timing reliability.
CVE-2026-41089: CLDAP Domain Controller RCE
A new technique in the Reach module targeting Domain Controllers over UDP/389 (CLDAP). The vulnerability is a pre-authentication stack overflow in LSASS: NetpLogonPutUnicodeString receives the maximum write length in bytes but internally treats it as a WCHAR count, permitting an attacker to write 1,056 bytes into a 528-byte stack buffer (NlGetLocalPingResponse). Both bytes of every WCHAR are fully attacker-controlled via the User field in the CLDAP ping packet, which is delivered as raw UTF-16LE inside an LDAP OCTET STRING.
Three operational modes are exposed via Invoke-Reach -Technique CVE-2026-41089:
- Check – sends a benign CLDAP ping with a short username; returns true if the DC responds.
- Execute – sends 265 WCHARs (530 bytes) of
0x41overwriting saved RIP; controlled crash for exploit validation. DCs auto-recover in approximately 90 seconds. - RunCommand – delivers shell command execution via a write-what-where ROP chain. The chain writes the ASCII command string 8 bytes at a time into the last 256 bytes of ntdll’s BSS section (uninitialised padding in a COW-faulted private page, never overlapping live ntdll globals), then calls
WinExec(cmd_ptr)followed byRtlExitUserThreadto keep LSASS alive.
The required gadgets – pop rcx; ret, pop rax; ret, mov [rcx],rax; ret, RtlExitUserThread, and WinExec – are present in every observed ntdll/kernel32 version. LoadGadgetsFromFiles(ntdllPath, k32Path) discovers gadget RVAs by parsing raw PE section tables and export directories from on-disk DLL files, enabling offline preparation against the target DC’s specific DLL version before the engagement begins. RSP alignment is corrected automatically per-chain.
The complete CLDAP/BER packet encoder is implemented from scratch with no LDAP library dependency. Maximum command length is 143 characters at the default RIP offset.
Persistence: New Techniques
Three new cmdlets have been added to the persistence module.
Set-ClickOnceComHijackPersistence
Writes a per-user COM server registration in HKCU\Software\Classes\CLSID\{20FD4E26-8E0F-4F73-A0E0-F27B8C57BE6F}\LocalServer32. This CLSID is loaded by dfdll!InvokeServer() during any ClickOnce cold-start. Because HKCU takes precedence over HKLM, any value written here wins without elevation. When the victim opens any .application file, svchost.exe (DcomLaunch) calls CoCreateInstance with this CLSID and launches the registered command in the user’s context.
Parameters: -Command (the LocalServer32 command to register), -Remove (removes the CLSID subtree).
Set-ComDllHijackPersistence
Registers an attacker-controlled DLL as an in-process (InProcServer32) COM server in HKCU\Software\Classes\CLSID\<clsid>, overriding the HKLM registration. Ships with six curated CLSIDs that are loaded by common Windows processes and have no default HKCU entry:
| Process | CLSID | Description |
|---|---|---|
| explorer.exe | {BCDE0395-…} | MRUAutoComplete |
| explorer.exe | {CE8D7EB9-…} | ShellBrowseForFolder |
| explorer.exe | {9BA05972-…} | ShellWindows |
| OneDrive.exe | {B31D4350-…} | OneDriveShellExt |
| OneDrive.exe | {CB3D0F55-…} | OneDriveSyncStatusExt |
| mmc.exe | {49BF5420-…} | MMCDocObjectFactory |
Parameters: -Enumerate (prints all known entries as process|clsid|description), -Clsid, -DllPath, -Remove. No elevation required.
Set-HiddenRunPersistence
Writes a Run key entry to HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run using NtSetValueKey directly with a null-byte-prefixed value name. Win32 registry APIs, regedit, and Autoruns treat the null byte as a string terminator and cannot enumerate the entry. The NT kernel processes the full UNICODE_STRING length including the prefix and fires the entry at every user logon.
Parameters: -Name (logical identifier, prefixed with null byte internally), -Command (command to persist). Requires administrator elevation for the HKLM write.
VSS SAM Dump
Invoke-VssSamDump extracts the live SAM and SYSTEM registry hives by reading them from a Volume Shadow Copy, bypassing the exclusive kernel lock that Windows holds on %SystemRoot%\system32\config\sam while the OS is running.
The cmdlet queries Win32_ShadowCopy via WMI. If no shadow copies exist and -CreateSnapshot $true (the default), a new shadow copy is created via Win32_ShadowCopy.Create(). The SAM and SYSTEM hive files are then read from the shadow copy device path using NtCreateFile/NtReadFile in the NT namespace (\??\Device\HarddiskVolumeShadowCopyN\...), bypassing the standard filesystem permission layer that applies to the live hive. Files are read in 4 KB chunks.
Both hives are returned as base64-encoded strings in a VssSamDumpResult object along with the device path. The encoded hive bytes can be decoded and fed directly to an offline hash extractor with no intermediate disk write.
Parameters: -Disk (default C:\), -CreateSnapshot (default $true).
New AMSI Bypass Techniques
Two new AMSI bypass techniques have been added to the obfuscation pipeline.
AmsiWriteRaid
Based on the OffSec “AMSI Write Raid” technique. Two layers are applied because different AMSI callers go through different dispatch paths:
Layer 1 – NDirectWriteableData dispatch cell: The P/Invoke IL stub for AmsiNativeMethods.AmsiScanBuffer resolves the native function through NDirectWriteableData.m_pNativeCallTarget. The technique walks the runtime method handle from offset 8 to 256, locates the native call target field, and overwrites it with a heap-allocated 12-byte stub that sets *pResult = AMSI_RESULT_CLEAN and returns S_OK. This redirects all PowerShell script-block AMSI calls without touching any amsi.dll bytes.
Layer 2 – AmsiScanBuffer byte patch: CLR Assembly.Load bypasses the SMA P/Invoke dispatch cell and calls amsi.dll!AmsiScanBuffer directly. The first 12 bytes of AmsiScanBuffer are overwritten with the same stub.
All patch bytes are XOR-encoded with a randomly generated per-build key for polymorphism. The PAGE_EXECUTE_READWRITE (0x40) protection value is also encoded.
PatchAmsiProvider
Patches the IAntimalwareProvider::Scan() virtual function pointer inside MpOav.dll – one level deeper than any existing technique, leaving amsi.dll completely untouched.
The patch walks the HAMSICONTEXT pointer chain: amsiContext field (from AmsiUtils reflection) → +0x10 (CAmsiAntimalware pointer) → +0x40+(i*8) (IAntimalwareProvider* array) → +0x00 (vtable pointer) → +0x18 (Scan() function pointer). The 6-byte patch (mov eax, 0; ret) is written at that address. Since MpOav.dll code is shared in-process, this single patch covers both PowerShell script-block scans (PS’s HAMSICONTEXT) and CLR Assembly.Load scans (CLR’s separate HAMSICONTEXT).
Patch bytes are XOR-encoded per build.
Document Payload Generation
Four new server-side document generators cover common phishing delivery formats.
GAP-04: New-OneNoteAttachment
Generates a OneNote section file (.one) with an embedded attachment that runs a command when the victim double-clicks the attachment icon. The implementation handles two compatibility problems with server-side OneNote COM automation: Click-to-Run Office installations register type libraries in a virtual registry invisible to .NET’s COM interop, and non-interactive process contexts cannot service OpenHierarchy calls. The workaround spawns a dedicated powershell.exe 5.1 subprocess with an STA thread. UIAutomation recovers from any crash-recovery dialogs before OneNote’s COM interface is acquired. The embedded file is written as a neutral .dat extension that OneNote accepts via pathSource, while the preferredName XML attribute presents the target extension to the victim.
Parameters: -Command (mandatory), -AttachmentName (default: document.vbs).
GAP-05: New-XlmWorkbook
Generates a macro-enabled Excel workbook (.xlsm) entirely in managed code – no Office installation required. Structure: one visible empty sheet, one veryHidden XLM macrosheet containing EXEC and HALT cells, and a workbook-level Auto_Open defined name pointing to the macro cell. An empty vbaProject.bin satisfies the .xlsm content-type contract. String literals use double-quote escaping; XML special characters are escaped with SecurityElement.Escape. Executes on any target where Excel 4.0 macro policy is not disabled.
Parameter: -Command.
GAP-06: New-TrojanizedDocument
Injects a VBA payload into an existing macro-enabled Office document without altering any visible content. Accepts a base64-encoded source document and piped VBA source. The document type is auto-detected by inspecting the ZIP structure: xl/vbaProject.bin selects the Excel path; word/vbaProject.bin selects the Word path. All other ZIP entries are copied verbatim; only the vbaProject.bin entry is replaced. Supports both .xlsm and .docm inputs. No Office or Windows installation required.
GAP-07: New-PowerPointPresentation
Generates a macro-enabled PowerPoint presentation (.pptm) with an embedded VBA payload. When PowerPoint.Application is registered on the server, a dedicated STA thread invokes COM automation to compile p-code and ensure Auto_Open fires immediately on opening. A Presentation_Open → Auto_Open bridge is injected into ThisPresentation – required because Auto_Open in a standard module does not fire when a presentation is opened via COM. When PowerPoint is absent, a managed fallback builder (PowerPointVbaProjectBinBuilder) produces the .pptm programmatically.
Zig Payload: x86 Staged DLL
A new zig_clr_staged_dll_x86 pipeline produces a 32-bit Zig DLL staged loader. The DLL downloads x86 sRDI shellcode from the C2 at runtime via WinHTTP and executes it from a background thread (not DllMain, to avoid loader-lock constraints). This fills the gap for 32-bit process contexts – macro-enabled Office documents typically run in a 32-bit Excel process, and the Zig x86 staged DLL can deliver an implant from that context before the WoW64 escape to 64-bit PowerShell is performed.
The existing zig_clr_staged_dll_x64 and zig_clr_staged_exe_x64 pipelines are unchanged.
Linux Payload Compatibility
Several fixes ensure reliable implant callbacks from Linux targets.
RSA.FromXmlString is not available on .NET running on Linux – the method throws PlatformNotSupportedException. The HttpConnection class now uses a hand-written XML parser to extract RSA key parameters from the C2-supplied XML key blob, making the implant’s registration path fully portable.
System.Net.Requests.dll was not included in the Linux flat bundle. The LoaderBundleService now includes it explicitly, resolving a TypeLoadException that prevented the implant from initializing its HTTP client on Linux.
The PS7 runspace initialization path on Linux was not deferring initialization to a background thread when required by the calling context. The Runspaces.cs initialization logic now detects the Linux PS7 environment and schedules initialization correctly, preventing the deadlock that blocked all module cmdlets from completing.
The Agent.Stop() return path was missing a return statement that caused the agent’s main loop to continue past the stop condition on Linux.
Wordlists System
A database-backed wordlist management system has been added. WordlistSeederService loads all bundled .txt files from the wordlists directory at server startup, using the filename as the wordlist name and the parent directory as the category tag. Files above 50 MB are skipped. Seeding is idempotent.
Bundled wordlists span six categories:
| Category | Files |
|---|---|
| api | api-endpoints.txt, api-seen-in-wild.txt |
| directories | big.txt, combined_words.txt, common.txt, directory-list-2.3-small.txt, raft-medium-directories.txt, raft-medium-files.txt |
| passwords | 100k-most-used-passwords-NCSC.txt, 10k-most-common.txt, 500-worst-passwords.txt, darkweb2017-top1000.txt, darkweb2017-top10000.txt, top-passwords-shortlist.txt |
| subdomains | subdomains-top1million-5000.txt, subdomains-top1million-20000.txt |
| usernames | cirt-default-usernames.txt, names.txt, top-usernames-shortlist.txt |
| vhosts | namelist.txt |
SpecterScript parameters can be decorated with [Wordlist("tag")]. When the parameter system encounters this attribute, it renders a wordlist picker in the UI (filtered by tags). At execution time, ResolveWordlistAsync() expands the selected wordlist into a string[] PowerShell variable declaration prepended to the session before the script runs.
Email and Username OSINT
Three new server-side cmdlets provide reconnaissance against email addresses, usernames, and breach databases.
Specter-EmailPlatformScan
Checks an email address across 63 platforms in parallel. Detection methods include HTTP status code matching, GET/POST body pattern matching, and custom handlers for platforms requiring multi-step flows (GitHub email validation, Spotify account check, Apple ID check). Results indicate whether the email has an account on each platform. Optional category filter, concurrency limit, and Tor/SSH tunnel routing.
Specter-UsernamePlatformScan
Checks a username across 134 platforms in parallel using the same detection infrastructure. Platforms span community, gaming, development, social, creator, music, and other categories. Same routing and filter options as email scanning.
Specter-BreachIntelligence
Queries the Hudson Rock Cavalier OSINT API for infostealer records associated with an email address or username. Returns the stealer family (Vidar, RedLine, Raccoon, etc.), compromise date, operating system, machine username, and computer name for each record found.
All three cmdlets support routing through Tor or SSH tunnels via SOCKS5 for operational security.
Subdomain Finder
Invoke-SubdomainFinder performs parallel async DNS resolution against a list of subdomain prefixes. Two parameter sets are supported:
- Wordlist – looks up a named wordlist from the database (e.g.,
"subdomains-top1million-5000") and resolves each prefix prepended to the base domain. - Explicit – takes a
string[]of prefixes directly.
Concurrency is controlled by a SemaphoreSlim (-MaxConcurrency, 1–200, default 50). Per-query timeout is configurable (-ResolveTimeout, 1–30 seconds, default 5). Only FQDNs that resolve to at least one IP address are returned. Results include all resolved addresses and are sorted alphabetically by FQDN.
Get-DomainGroups
A new Get-DomainGroups cmdlet (alias: dgroups) enumerates domain groups via LDAP. Parameters match the rest of the Recon module: -Domain, -Server, -Port (default 389), -Username, -Password, and -OU for scoping results to a specific organizational unit. Called with no arguments, it queries the current domain via integrated authentication.
New SpecterScripts
The SpecterScript library now contains 226 scripts. The following scripts have been added since v6.0.0:
Credential Collection
- Get Browser Credentials – extracts saved credentials from Chrome, Edge, Brave, and Firefox; handles Chrome 127+ App-Bound Encryption via
IElevatorCOM.
Persistence
- Establish ClickOnce COM Hijack Persistence – registers the HKCU
LocalServer32hijack for CLSID{20FD4E26-...}with a PowerShell cradle payload. - Establish COM DLL Hijack Persistence – registers a DLL under one of six curated HKCU InProcServer32 CLSIDs (explorer.exe, OneDrive.exe, mmc.exe).
- Set Hidden Run Persistence – NtSetValueKey null-byte-prefixed HKLM Run value; invisible to Win32 APIs and Autoruns.
- Create OneDriveHealth Scheduled Task – installs a scheduled task masquerading as an OneDrive health check.
Threat Emulation – LOLBin Techniques
- Stage Files via Commandline –
makecab.execabinet archive (T1560.001) - Export Active Directory via Commandline –
csvde.exeAD user export (T1087.002) - Get Logged On Users via Commandline –
quser.exesession enumeration (T1033) - Get Domain Trusts via Commandline –
nltest.exe /domain_trusts(T1482) - Invoke Hidden Start via Commandline –
hstart64.exe /D /UACconcealed launch (T1564.001) - Remove Staging Directory via Commandline –
cmd /c rd /s /q(T1070.004) - Lateral Movement with Scheduled Tasks and PowerShell Cradle Commandline –
schtasks.exewith domain credentials (T1053.005)
Defense Evasion
- Throttle EDR Network Traffic via QoS (Survey) – enumerates all running processes that match known EDR product names and displays current QoS policy status for each.
- Throttle Process Network Traffic via QoS (Targeted) – applies a Windows QoS policy via
New-CimInstance MSFT_NetQosPolicySettingDatato bandwidth-limit a named process, degrading EDR telemetry upload rates.
Execution
- Run PowerShell Cradle with WOW64 64-bit Escape – runs a payload cradle via
%SystemRoot%\Sysnative\WindowsPowerShell\v1.0\powershell.exefrom a 32-bit process to obtain a 64-bit PowerShell context. - Run 64-bit PowerShell Payload – delivers a payload directly in a 64-bit PowerShell runspace.
Impact
- Invoke User Profile Wiper – enumerates and optionally deletes all files under Desktop, Documents, Downloads, Pictures, Videos, Music, and %LOCALAPPDATA%\Temp. Emulates the Pawn Storm PRISMEX campaign’s destructive capability (MITRE T1485).
DryRun=$true(default) lists files without deleting.
User Interface Updates
- WinRM Sessions – a new sessions panel supports Password, Kerberos, and Certificate authentication. Task output streams in real time with per-type color coding. AMSI bypass, ETW bypass, module import, file upload, and run-script actions are available from the toolbar. Sessions route through Specter implant channels for network pivoting.
- SSH Tunnels – tunnel creation, deletion, and live status display. C2-pivot routing enables reaching SSH servers on isolated internal segments.
- Tor Tunnels – full exit node selection by country and relay bandwidth. Live exit IP display updated as Tor assigns circuits.
- WebDAV Files – tree-view file manager with live SignalR updates. Supports add file, new folder, and remove operations.
- Wordlists – management panel for creating, viewing, and deleting wordlist entries; the same panel is used by the AI agent and SpecterScript parameter UI to resolve
[Wordlist]-attributed parameters.
Bug Fixes
Linux Payload: RSA.FromXmlString Not Available
RSA.FromXmlString throws PlatformNotSupportedException on .NET running on Linux. The implant’s C2 registration path uses this method to import the server’s RSA public key from XML. A manual XML parser now extracts the modulus and exponent directly, making registration work identically on Linux and Windows.
Linux Payload: System.Net.Requests.dll Not Bundled
The flat bundle for Linux targets was missing System.Net.Requests.dll, causing a TypeLoadException during HTTP client initialization. The assembly is now included explicitly in LoaderBundleService.
Linux PS7: Runspace Initialization Deadlock
On Linux PS7, the runspace initialization path was not deferring to a background thread when called from a context that already held the runspace lock. This blocked all module cmdlets from completing. The initialization logic now detects this condition and schedules initialization on a background thread.
Agent Stop() Return Path
A missing return statement in Agent.Stop() caused the main loop to continue past the stop condition on Linux targets, preventing clean shutdown.
Copyright 2026 Practical Security Analytics LLC