| CTO @specterops | Host @dcpthepodcast | Ex PowerShell MVP | USAF Vet | FC Bayern Supporter | Language Learner 🇳🇴 🇮🇹 🇧🇷 |
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Jared Atkinson
Identity and attack paths - can you stop hackers getting from A to B?
A hand about to touch a phone. Superimposed on top of it is a pink triangle with exclamation mark inside it. Behind it is a computer display with code on it. IT security has traditionally been about keeping threat actors out and preventing breaches. However, while the volume of software vulnerabilities has gone up and up over the past few years, the biggest risk that many companies face is not about a hacker getting in.
Identity and attack paths - can you stop hackers getting from A to B?
IT security has traditionally been about keeping threat actors out and preventing breaches. However, while the volume of software vulnerabilities has gone up and up over the past few years, the biggest risk that many companies face is not about a hacker getting in. Instead, it is how long they can stay inside and how far they can move within that network. Chief Technology Officer at SpecterOps. The reason why threat actors can move laterally is how difficult it is to manage identities effectively.
The Clean Source Principle and the Future of Identity Security
TL;DR Modern identity systems are deeply interconnected, and every weak dependency creates an attack path — no matter how strong any single platform appears. The Clean Source Principle and BloodHound OpenGraph make these hidden relationships visible, empowering defenders to treat Attack Path Management as an ongoing discipline rather than a one-time project.
The Salesloft–Drift Breach: An Attack Path Case Study - SpecterOps
TL;DR This post analyzes the Salesloft–Drift incident through an attack path lens, showing how violations of the clean source principle, identities in transit, and hidden hybrid paths combined to turn a single compromise into a multi-organization breach. The recent Salesloft–Drift breach highlights the fragility of modern SaaS ecosystems.
Part 16: Tool Description
On Detection: Tactical to Functional Why it is Difficult to Say What a Tool Does Over the years, I’ve noticed that we have a difficult time describing a specific tool’s functionality. I participated in conversations or listened to lectures where someone inevitably attempts to describe the techniques or behavior that they associate with a given tool.
Part 16: Tool Description
Why it is Difficult to Say What a Tool Does Over the years, I’ve noticed that we have a difficult time describing a specific tool’s functionality. I participated in conversations or listened to lectures where someone inevitably attempts to describe the techniques or behavior that they associate with a given tool. Someone might say “mimikatz is used for Credential Dumping” which is technically true, but does not provide a comprehensive description of mimikatz’s capabilities.
Part 15: Function Type Categories
On Detection: Tactical to Functional Seven Ways to View API Functions Welcome back to Part 15 of the On Detection: Tactical to Functional blog series. I wrote this article to serve as a resource for those attempting to create tool graphs to describe the capabilities of the attacker tools or malware samples they encounter. Throughout this series, I’ve analyzed many API functions and summarized my analysis through function call stacks.
Part 15: Function Type Categories
On Detection: Tactical to Functional Seven Ways to View API Functions Welcome back to Part 15 of the On Detection: Tactical to Functional blog series. I wrote this article to serve as a resource for those attempting to create tool graphs to describe the capabilities of the attacker tools or malware samples they encounter. Throughout this series, I’ve analyzed many API functions and summarized my analysis through function call stacks.
Purple Teaming: Evaluate the Efficacy of Security Controls
25 minutes ago bankinfosecurity Jared Atkinson of SpecterOps on Why 'Detection Is Not the End of the Line' Steve King • July 1, 2024 25 Minutes The concept of red teaming has been around since the 1960s. Red teams use tactics, techniques and procedures to emulate a real-world threat and measure the effectiveness of your defenses. "Red teaming is narrative-driven," said Jared Atkinson of SpectorOps.
Mapping Snowflake's Access Landscape
Attack Path Management Because Every Snowflake (Graph) is Unique On June 2nd, 2024, Snowflake released a joint statement with Crowdstrike and Mandiant addressing reports of "[an] ongoing investigation involving a targeted threat campaign against some Snowflake customer accounts." A SpecterOps customer contacted me about their organization's response to this campaign and mentioned that there seems to be very little security-based information related to Snowflake.
Part 14: Sub-Operations
On Detection: Tactical to Functional When the Operation is not Enough A while back, I was working on deconstructing a standard variation of Token Theft and stumbled into a couple of interesting edge cases that my model still needed to account for. Below is the operation chain for one of the most common Token Impersonation procedures. You'll notice that the attacker must open a handle to the target process (Process Open).
Part 14: Sub-Operations
On Detection: Tactical to Functional When the Operation is not Enough A while back, I was working on deconstructing a standard variation of Token Theft and stumbled into a couple of interesting edge cases that my model still needed to account for. Below is the operation chain for one of the most common Token Impersonation procedures. You’ll notice that the attacker must open a handle to the target process (Process Open).
MITRE ATTACK Archives
By Jared Atkinson,Nathan D.,Yarom Talmi,Alok Patidar,Daniella Balaban,John P. Gormally, SR Your Guide to MITRE ATT&CK Framework Cybersecurity has become a routine activity for the majority of companies. Cyberattacks no longer generate the shock and horror they once did. They're now just par ...
Part 13
On Detection: Tactical to Functional Why a Single Test Case is Insufficient In my previous post, I explored the idea that different tools can implement the same operation chain (behavior) in various ways. I referred to these various ways as execution modalities.
Behavior vs. Execution Modality
On Detection: Tactical to Functional Part 12 At Shmoocon 2015, Will Schroeder (Harmj0y) gave a talk titled " I Hunt Sys Admins," describing how attackers can hunt (or find the location of) system administrators throughout the network.
Behavior vs. Execution Modality
On Detection: Tactical to Functional Part 12 At Shmoocon 2015, Will Schroeder (Harmj0y) gave a talk titled “I Hunt Sys Admins,” describing how attackers can hunt (or find the location of) system administrators throughout the network.
Why Red Teams Can't Answer Defenders' Most Important Questions
COMMENTARY In 1931, scientist and philosopher Alfred Korzybski wrote, "The map is not the territory." He meant that all models, like maps, leave out some information compared to reality. The models used to detect threats in cybersecurity are similarly limited, so defenders should always be asking themselves, "Does my threat detection detect everything it's supposed to detect?" Penetration testing and red- and blue-team exercises are attempts to answer this question.
On Detection: Tactical to Functional
Part 11: Functional Composition Welcome back to part 11 of the On Detection blog series. This next article serves as a conceptual foundation upon which we will build over the next few posts. It may not be immediately obvious why this is important, but understanding this concept will make many subsequent ideas much easier to parse. A colleague of mine, Max Harley, introduced me to the idea of composition in functional programming.
On Detection: Tactical to Functional
Part 10: Implicit Process Create Welcome back to another installment of the On Detection: Tactical to Functional series. In the previous article, I argued that we perceive actions within our environment at the Operational level (especially when it comes to endpoint events), which means that we should “conceive” of attacker tradecraft at the Operational level as well. In this article, I want to demonstrate WHY this convergence between conception and perception is so important.
Tactical to Functional
The concepts discussed in this post are related to those discussed in the 9th session of the DCP Live podcast. If you find this information interesting, I highly recommend checking the session out! At this point in the series, we understand that attack techniques are abstract concepts that must be instantiated in the form of a tool or software application.
On Detection: Tactical to Functional
Part 9: Perception vs. Conception The concepts discussed in this post are related to those discussed in the 9th session of the DCP Live podcast. If you find this information interesting, I highly recommend checking the session out! At this point in the series, we understand that attack techniques are abstract concepts that must be instantiated in the form of a tool or software application.
detection-engineering Archives
On Detection: From Tactical to Functional
Over the past few months, I’ve been working with some colleagues at SpecterOps to develop our Purple Team service offering. One of the tasks that we’ve been focusing on is creating a model that allows us to represent the possible variations of an attack technique. The plan is to use this model for use case selection during our Purple Team assessment.
Jared Atkinson
Analytics & Intelligence API Security Cloud Security Cyberlaw Cybersecurity Editorial Calendar Endpoint Featured Governance, Risk & Compliance Humor Identity & Access Identity and Access Management Incident Response IOT IoT & ICS Security Malware Most Read This Week Network Security News Popular Post Security Boulevard (Original) Security Operations Spotlight Threat Intelligence Threats & Breaches Vulnerabilities
From Tactical to Functional
Over the past few months, I've been working with some colleagues at SpecterOps to develop our Purple Team service offering. One of the tasks that we've been focusing on is creating a model that allows us to represent the possible variations of an attack technique. The plan is to use this model for use case selection during our Purple Team assessment.
Tactical to Functional
Part 7: Synonyms Introduction Welcome back to the On Detection: Tactical to Functional series. In this article, I hope to continue my investigation into whether I believe that detection engineering efforts should be focused on the procedural level.
On Detection: Tactical to Function
Part 6: What is a Procedure? Welcome back to the On Detection: Tactical to Functional blog series. I want to take a slightly different approach to things in this post. Most of the previous articles in the series have been purely technical in focus. I hope that this post maintains this technical feel, but I feel it is time to do semantical house cleaning. The goal is to leverage the technical foundation we’ve established throughout the series to help answer this question.
On Detection: Tactical to Functional
Part 4: Compound Functions This post is a slight detour, but it is essential nonetheless. This blog series is working to connect the Tactical to the Functional through a coherent taxonomy. Still, sometimes we make observations and build assumptions based on them only to find that our perspective was too low resolution to apply coherently to the range of implementations we should consider. This post discusses one such example. As I alluded to earlier, the second post introduced the idea of functions.
On Detection: Tactical to Functional
Part 5: Expanding the Operation Graph The second article in this series introduced the concept of Operations. Operations work as a container for teleologically equivalent functions. In other words, if two functions provide the same output (say, generating a handle to a process), they accomplish the same operation (Process Access in this case). The article compared two tools, Mimikatz and Dumpert, to demonstrate how operations are useful.
Tactical to Functional
Part 5: Expanding the Operation Graph Introduction The second article in this series introduced the concept of Operations. Operations work as a container for teleologically equivalent functions. In other words, if two functions provide the same output (say, generating a handle to a process), they accomplish the same operation (Process Access in this case). The article compared two tools, Mimikatz and Dumpert, to demonstrate how operations are useful.
On Detection: Tactical to Functional
Part 3: Expanding the Function Call Graph In the previous post in this series, I introduced the concept of operations and demonstrated how each operation has a function call graph that undergirds it. In that post, I purposely presented incomplete, relative to my knowledge, function call graphs because I wanted only to show the extent that was obviously based on what we’ve observed via mimikatz (in the first post in this series).
On Detection: Tactical to Functional
Part 2: Operations Welcome back to my On Detection: Tactical to Functional series. In the first post in this series, we explored the source code for Mimikatz’s sekurlsa::logonPasswords command. We discovered that Mimikatz relies on three Windows APIs to read credentials from the memory of the LSASS process. First, it calls NtQuerySystemInformation to enumerate processes to find the Process Identifier (PID) of LSASS. Next, it calls OpenProcess to open a read handle to LSASS.
On Detection: Tactical to Functional
Part 1: Discovering API Function Usage through Source Code Review In my Understanding the Function Call Stack post, I introduced the nesting nature of Windows API functions. There is almost always a superficial/documented version of the API that then goes through a series of calls to deeper, more fundamental functions that are less likely to be documented but still able to be called directly by applications.
Tactical to Functional
Part 1: Discovering API Function Usage through Source Code Review Introduction In my Understanding the Function Call Stack post, I introduced the nesting nature of Windows API functions. There is almost always a superficial/documented version of the API that then goes through a series of calls to deeper, more fundamental functions that are less likely to be documented but still able to be called directly by applications.
Understanding the Function Call Stack
There’s more than meets the eye under the function call hood This post is based on a September 2021 Twitter thread that I wrote to describe the same concept regarding function calls and their hidden hierarchy. That thread was inspired by a series of tweets by inversecos who shared how malware authors will often use Native APIs instead of Win32 APIs as a mechanism to evade naive detections that assume every application will use the Win32 API function.
Playing Detection with a Full Deck
The importance of Identification in Detection Engineering As a consultant I have the opportunity to work with clients to help mature their Detection and Response (D&R) process. Sometimes this includes helping with the creation, improvement, or evaluation of detection rules.
Detection Spectrum
The Funnel of Fidelity is a model that SpecterOps uses to describe the phases involved in the detection and response process. We like to associate each blog post with the phase(s) that the post’s topics relate to. This specific post is focused on a strategy that can be applied to the Detection phase of the funnel.
Detection Spectrum
The Funnel of Fidelity is a model that SpecterOps uses to describe the phases involved in the detection and response process. We like to associate each blog post with the phase(s) that the post's topics relate to. This specific post is focused on a strategy that can be applied to the Detection phase of the funnel. Detection Engineering with Kerberoasting Blog Series: This is the second of a multipart detection engineering blog series by the SpecterOps detection team.
Introducing the Funnel of Fidelity
At SpecterOps we work with companies to build robust detection and response programs. One of the stark realities is that human capital is limited, which is why we work with customers to find efficient ways to leverage their scarce resources. For instance, it is not feasible for an organization to review every single security event that is collected to determine if it is malicious.
PowerShell Digital Forensics and Incident Response
[This article is a continuation of my Forensic Friday series. Every Friday I will provide a short post on a forensic topic of interest or PowerForensics functionality (such as cmdlet descriptions, use cases, and details about lesser known features).
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Jared
Contact Jared, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack