SpecterOps Resource Center

Resources

WHITE PAPERS

Pass-the-Passkey Family of Attacks

Our research on passkey security uncovered three practically exploitable zero-day vulnerabilities in Windows 11 and Microsoft Entra ID. Two of…

DATASHEETS

BloodHound Enterprise Datasheet

Identity security is one of the greatest challenges defenders face in modern enterprises. Every user, workload, service account, AI agent,…

DATASHEETS

Defend AWS Environments with BloodHound Enterprise

Adversaries reach AWS through identities that already have a way in. A directory account synced into the cloud, an over-trusted…

DATASHEETS

BloodHound Enterprise Attack Path Management for the Public Sector

BloodHound Enterprise gives lean security teams continuous visibility into those attack paths, so they can focus on what puts critical…

DATASHEETS

BloodHound Enterprise FedRAMP

Protecting Mission-Critical Assets from Identity Threats.

REPORTS

Trends in Identity Attack Path Management 2026

Agentic AI raises the stakes for identity security.

REPORTS

Trends in Identity Attack Path Management 2026

Agentic AI raises the stakes for identity security.

DATASHEETS

Cyber Ranges for AI

As AI models grow more sophisticated, governments and technology companies need rigorous environments to test model capabilities.

DATASHEETS

Services & Tradecraft

Adversaries use advanced tactics to exploit vulnerabilities and misconfigurations across your environment, from identity systems to applications to infrastructure, that…

Page 1 / 10

Learn from others and share your story on the BloodHoundGang Slack Community

Join the conversation

Open-source Tools

BloodHound Community Edition

Manage Identity Attack Paths across your hybrid environment and remove the adversary’s favorite target.

Nemesis

Nemesis functions as an "offensive VirusTotal," automatically processing files collected during security assessments through an extensive pipeline of specialized analyzers.

Ghostwriter

Ghostwriter is a Django web app for red teams to track projects, clients, assets, reports, and evidence.

Mythic

Mythic is an open-source Command and Control (C2) framework designed around a microservice architecture.

Crucible

Crucible is an extensible, multi-user, cross-platform framework designed for post-exploitation, command and control operations, penetration testing, and red teaming.

SharpSCCM

SharpSCCM is an open-source C# post-exploitation tool designed to leverage Microsoft Configuration Manager.

LudusHound

LudusHound brings BloodHound data to life by creating a fully functional Ludus Range for controlled testing.

SCCMHunter

SCCMHunter is a post-exploitation tool built to streamline identifying, profiling, and attacking SCCM-related assets in an Active Directory domain.

Merlin

Merlin is a cross-platform post-exploitation Command & Control server and agent written in Go.

Page 1 / 3

SpecterOps Resource Center

Filters

Resources

Pass-the-Passkey Family of Attacks

BloodHound Enterprise Datasheet

Defend AWS Environments with BloodHound Enterprise

BloodHound Enterprise Attack Path Management for the Public Sector

BloodHound Enterprise FedRAMP

Trends in Identity Attack Path Management 2026

Trends in Identity Attack Path Management 2026

Cyber Ranges for AI

Services & Tradecraft

Learn from others and share your story on the BloodHoundGang Slack Community

Open-source Tools

BloodHound Community Edition

Nemesis

Ghostwriter

Mythic

Crucible

SharpSCCM

LudusHound

SCCMHunter

Merlin

Sign up for the latest updates