@prac_sec

Lead developer of SpecterInsight and owner of Practical Security Analytics LLC.

practicalsecurityanalytics.com
Joined October 2019
  • Tweets50
  • Following6
  • Followers256
See SpecterInsight turn one prompt into an AI-assisted red team engagement with live oversight. practicalsecurityanalytics.c…

AI-Powered Red Teaming with SpecterInsight

T1059.001 PowerShell  ·  T1027 Obfuscation  ·  T1547.001 Run Keys  ·  T1053.005 Scheduled Tasks  ·  T1003.002 SAM Dump  ·  T1562.001 Disable Securi…

practicalsecurityanalytics.com
3
54
Step-by-step guide: Build and run end-to-end threat emulation workflows in SpecterInsight. practicalsecurityanalytics.c…

How to Build Threat Emulation Workflows

Operator Guide  ·  SpecterInsight v7.0.0  ·  Threat Emulation THREAT EMULATION WORKFLOWS SpecterInsight workflows let you encode an entire attack chain and run it repeatedly aga…

practicalsecurityanalytics.com
1
49
Threat emulation should test the whole attack chain, not isolated TTPs. See SpecterInsight run APT28 PRISMEX end to end: practicalsecurityanalytics.c…

Emulating APT28 PRISMEX with SpecterInsight

TLP:AMBER · For authorized operational and training use only SpecterInsight v7.0.0 Adversary Emulation  ·  APT28 / Pawn Storm  ·  2022–2025 PRISMEX Full kill chain emulation of …

practicalsecurityanalytics.com
1
1
95
Threat emulation just got a major upgrade. SpecterInsight 7.0.0 adds end-to-end threat emulation workflows, Evil WinRM, COM lateral movement, Tor tunnels, new payloads, and much more. practicalsecurityanalytics.c…

Version 7.0.0: Threat Emulation Workflows, Lateral Operations, and Cross-Platform Payloads

SpecterInsight v7.0.0 ships built-in end-to-end threat emulation workflows including a PRISMEX/Pawn Storm campaign scenario, a managed cross-platform WinRM client, COM Cross-Session Activation late…

practicalsecurityanalytics.com
53
For red teams and training orgs building realistic labs: payloads need repeatability, target coverage, and validation. This Feature Spotlight covers SpecterInsight’s Zig Payload Pipelines: sRDI, reflective loading, shellcode, and obfuscation. practicalsecurityanalytics.c…

Feature Spotlight: The Zig Payload Pipelines

SpecterInsight’s Zig payload pipelines give you full cross-platform, native payload generation from a single server. Zig 0.16.0 is bundled as the compiler. It runs identically on Windows and …

practicalsecurityanalytics.com
1
114
An AMSI bypass that breaks HTTPS is a painful bug. This post covers the selective RpcGhosting hook that fixes it: practicalsecurityanalytics.c…

Improved RpcGhosting

This is a story about when your AMSI Bypass breaks your own downloader A while back, I was integrating the RpcGhosting AMSI bypass into SpecterInsight and noticed that it broke several of my PowerS…

practicalsecurityanalytics.com
5
26
3,041
New blog post: Dumping LSASS Without Touching Disk Improved LSASS dumping in SpecterInsight’s dumper module, focusing on stealthy, in-memory techniques. Read it here: practicalsecurityanalytics.c… #RedTeam #CyberSecurity #WindowsInternals #ThreatEmulation

Dumping LSASS Without Touching Disk: Improvements to ShadowDumper

While integrating LSASS dumping techniques into SpecterInsight’s dumper module, I used Offensive-Panda’s ShadowDumper as a reference point. That tool is great collection of LSASS dump techniques, b…

practicalsecurityanalytics.com
32
158
7,289
SpecterInsight v6.0.0 is live! Inveigh workflows, local and remote exploit integration, native Zig payloads with source code obfuscation, network intelligence, and SSL C2 to enhance your threat emulation activities. practicalsecurityanalytics.c…

Version 6.0.0: Network Poisoning, Remote Exploitation, and Native Payloads

SpecterInsight v6.0.0 ships the Inveigh network credential capture module, a new Reach remote exploitation module, browser credential extraction with Chrome App-Bound Encryption bypass, a server-si…

practicalsecurityanalytics.com
4
12
1,386
SpecterInsight 5.1.0 is out!!! AI agent ops, full Kerberos attack library, 8-technique LSASS dumping, Early Cascade Injection, WFP EDR blocking, Ghost Task persistence & more. practicalsecurityanalytics.c…

Version 5.1.0: Agentic Operations

Overview This release represents about a year of development and is the largest feature update to SpecterInsight to date. The headline addition is a fully integrated AI agent system that can plan a…

practicalsecurityanalytics.com
1
2
113
Just released SpecterInsight v5.0.0! This version delivers a detailed operational event log, user experience improvements, and stability/bug fixes. Check out the full details here! practicalsecurityanalytics.c…
1
3
116
Checkout this post on lateral movement with WinRM. practicalsecurityanalytics.c…

Stealthy Lateral Movement Techniques with WinRM

Overview In this post, I am going to go over how to use WinRM to laterally move within an Active Directory network and to try and blend in with the noise. While WinRM does give you the ability to r…

practicalsecurityanalytics.com
1
110
SpecterInsight 4.4.0 just released! This version provides a new module for lateral movement and EDR silencer techniques via Group Policy, a Firewall module, and 7 new SpecterScripts. practicalsecurityanalytics.c…

Version 4.4.0: GPO Module and More SpecterScripts

Overview The purpose of this release was to deliver two new modules for post-exploitation activity and to provide options for impairing defenses such as AV, EDR, and monitoring tools. These are imp…

practicalsecurityanalytics.com
10
472
SpecterInsight version 4.3.0 is chocked full of bug fixes, new payload pipelines, and a new hardware breakpoint AMSI bypass. Check it out! practicalsecurityanalytics.c…

Version 4.3.0: SpecterScripts, Payload Pipelines, and new AMSI Bypass

Summary The purpose of this release was to continue improving the payload pipeline obfuscation features, add a new AMSI bypass technique to the kit, and publish a few new SpecterScripts. Features S…

practicalsecurityanalytics.com
3
17
1,008
Check out this post on selecting bypasses and applying tailored obfuscation to evade AV. Please let me know if you find this post helpful. Let me know if there’s anything I can do to improve SpecterInsight! practicalsecurityanalytics.c…
4
158
SpecterInsight v4.2.0 has been released! We’ve packed a bunch of improvements to our PowerShell obfuscation and payload pipeline features. Check out the release notes here: practicalsecurityanalytics.c…

Version 4.2.0: Payload Pipeline Improvements

Overview This release primarily focuses on improving the SpecterInsight payload pipelines. We rolled out a bunch of new features to improve both our PowerShell and .NET payload pipelines with a foc…

practicalsecurityanalytics.com
2
7
151
In this post, I demonstrate how to use SpecterInsight to create a payload pipeline to evade AV detection and application controls. practicalsecurityanalytics.c…

Building a RuntimeInstaller Payload Pipeline to Evade AV Detection

Overview In this post, we will build an automated pipeline for generating a .NET loader payload that can evade both AV detection and application controls. The tools used in this post are: SpecterIn…

practicalsecurityanalytics.com
5
10
589
Check out the new release of SpecterInsight v4.1.0! There are now payload pipelines for LNK files, MSBuild XML files, and InstalUtil.exe compatible exe. practicalsecurityanalytics.c…

Version 4.1.0: UI Improvements and More Payloads

Overview The purpose if this release is to deliver a much requested UI feature and significant improvements to our payload pipeline capabilities that enabled the creation of four new Payload Pipeli…

practicalsecurityanalytics.com
1
134
I’m moving over to Bluesky! Head over there today to check out my new AMSI bypass technique and details on the release of SpecterInsight 4.0.0: Direct System Call Module, Process Injection, and New AMSI Bypass. bsky.app/profile/pracsec.bsk…
197
We just released SpecterInsight 3.1.0 along with the first release of SpecterInsight VM, a pre-configured Kali Linux system with SpecterInsight C2 fully installed along with Elastic and Kibana for tracking your red team engagements! Check it out! practicalsecurityanalytics.c…

Version 3.1.0: SpecterInsight-VM and Windows Event Log Module

Summary The purpose of this version is to provide a pre-configured virtual machine to make it easier to get up and running with SpecterInsight. Just download the OVF, import, and run! Additionally,…

practicalsecurityanalytics.com
1
204
Checkout my new post on extracting plaintext credentials from Windows Event Logs! This technique ships with and is fully integrated with SpecterInsight C2. practicalsecurityanalytics.c…

Extracting Credentials From Windows Logs

Overview During a recent engagement, I observed a lot of members of a particular organization authenticating with remote systems and services over the commandline with username and password in plai…

practicalsecurityanalytics.com
2
136
Load more