RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Resource Development

32 items

Command and Control

4

Fallback Channels

Implant

Malware Development

Tool Acquisition

Domain Infrastructure

6

Aged Domains

Domain and Tenant Registration

Domain Renown/Categorization

Lookalike Domain Registration / Domain Impersonation

Subdomain Takeover

Web Services

Infrastructure Acquisition

1

EDR Evasion / Security Research Environment Setup

Network Evasion

1

HTTP Tunneling

Network Scanning

3

Malleable C2 Profile Customization

Non-Standard Port

Sliver mTLS C2 Session Setup

NTLM/Kerberos Relaying

1

Scoped SOCKS5 Relay (authorized test)

Obfuscation

1

Custom Shellcode Injection & Anti-Static Analysis (Artifact Kit)

Payload Delivery

6

Drive-by Compromise Staging

Dropper Development

Exploit Development

Payload Hosting

Payload Staging

Stageless Payload Generation

Port Redirection & Proxy

8

Bidirectional Web Service Communication

PowerShell Proxy-Aware Communication

Proxy Use for Command and Control

Redirector

Reverse Port Forward

SOCKS Proxy

SYSTEM Proxy

Traffic Redirection

Remote Access

1

Ingress Tool Transfer via Archive Download

Initial Access

103 items

Build-System Compromise

4

Compromise of CI/CD

Compromise Software Supply Chain

Modify Artifact Repository

Visual Studio Code tasks.json

Credential Abuse

8

Authenticate to an SMB Service with a Valid Domain Account

Authenticate with Default Appliance Credentials

Authenticate with Domain Credentials

Cross-Tenant Attacks

Trusted Relationship

Use of Blank-Password Local Accounts

Use Valid Accounts

Validate Cloud Account Access to Kubernetes API

Credential Dumping

1

Plant Rogue Device

Database Client Abuse

1

SQL Command Execution

Hardware Implant

4

Hardware Additions

Malicious removable media

Physical network connection

Rogue Network Device Deployment

HTML Smuggling

2

HTML Smuggling

WASM Smuggling

LOLBin Abuse

4

Excel Macro / Add-in Execution

Execute JScript Dropper Payload

Malicious Scripting

Visual Basic

Macro Execution

9

Exploitation of insecure Microsoft Excel configuration

Malicious Macro

Malicious Macro Execution

Malicious Macros

Office VBA Macro Execution

Using PowerShell for malicious execution (via Office/VBA context)

VBA Shellcode Runner

VBA Win32 API Interop

Visual Basic macros

NAC Bypass

1

Network Access Control Bypass

Obfuscation

1

Access Card Cloning

Payload Delivery

5

Benign File Transfer Validation

Dropper Deployment

Ingress Tool Transfer

MSI Transform Weaponization

Shellcode Download via HTTP/S

Payload Loading

3

Malware execution / multi-malware infections

Payload Execution

Windows Download and Execute

Phishing

7

Device Code Phishing

Gophish Phishing Campaign Setup and Results Review

Phishing

Spearphishing Attachment

Spearphishing via Collaboration Infrastructure

Spearphishing via Collaboration Platform

Use of Compromised Cloud/Sharing Account for Malware Distribution

Remote Access

2

External Remote Services

Unmanaged Device VPN Access

Social Engineering

24

Deliver Payload via Malicious Phishing Link

Domain Impersonation / Typosquatting

Email Phishing

GoPhish Click-Tracking Phishing Simulation

Initial Access via Malicious Document (VBA Macros)

Malicious Windows Shortcut downloader

Onboarding as External Staff

Open Redirect Abuse in Spearphishing Links

Open Redirect Used in Phishing

Phishing for Credentials

Phishing with Microsoft Office

Phone-based social engineering / Caller ID manipulation

Physical USB drop / Baiting

Pretexting

Pretexting / Supplier Impersonation

SMS Phishing (Smishing)

Spear phishing Link

Spearphishing Link

Spearphishing Link to Internal Share

Spearphishing via Service

User Execution / Download and Execute

Vishing

Voice Phishing (Vishing)

Windows Remote Session Messaging (MSG.exe)

UAC Bypass

1

Tailgating

User Execution

13

Excel Web Query (IQY) User Execution

Execute Polyglot LNK Payload

JavaScript

Malicious Copy and Paste (ClickFix)

Malicious File

Malicious File Execution

Malicious Payload Execution / Implant

Office Open XML Custom UI Abuse

USB HID Keystroke Injection

User Execution of Malicious Payload

User Execution via Malicious Link

User-Assisted Malware Execution

Windows Shortcut (LNK) User Execution

Web Exploitation

13

Drive-by Compromise

Drive-by Download / Watering Hole Attack

Exploit Public-Facing Application

Exploitation of Open Redirects / Unvalidated Redirects

External Server or Website Compromise

External System Penetration

Jenkins Script Console Exploitation

Manual Vulnerability Validation

Missing Authentication for Critical Functions

Office/PDF Client Exploitation

Open Service / Unpatched Service Exploitation

SQL Injection

Web Service exposed / abused

Reconnaissance

32 items

AWS Cloud

2

AWS Cloud Infrastructure Discovery

AWS IAM Identity and Key Metadata Discovery

Azure Cloud

1

Microsoft Entra Application and Service Principal Discovery

Network Scanning

13

Active Network Scanning

DNS

External Attack Surface Discovery

External Footprint Analysis

External Infrastructure Reconnaissance

Externally Accessible PaaS Resources

HTTP Service Availability Probe

Network Security Appliances

Nmap Safe Vulnerability Scanning

Remote SMB Share Enumeration

Scanning IP Blocks

Web Server Vulnerability Scanning with Nikto

Web Service Scanning and Screenshotting

OSINT

14

Breach-Exposed Organizational Email Discovery

Client Configuration Discovery

Digital Certificates

Email Addresses

Gather Victim Host Information

Gather Victim Identity Information

Gather Victim Network Information

Internet-Facing Asset and Service Fingerprinting

OSINT — Search for Leaked Credentials

Publicly exposed version control / repository discovery

Search Closed Sources

Search Engines

Social Media

Subdomain Enumeration

Phishing

1

External Reconnaissance

Social Engineering

1

Social Engineering via Support Ticket

Host Enumeration

52 items

Database Enumeration

2

Enumerate Database Instances

SQL Server Linked Server Inventory and Validation

File Share Enumeration

3

Network Share Discovery

Sensitive File Discovery

SMB Share Enumeration and Spidering

Local Host Enumeration

32

Account Discovery (Windows Local and Google Cloud Service Accounts)

Attack Surface Reduction Rule Discovery

Browser Information Discovery

Credential Guard Status Discovery

Device Guard

Enumerate AppLocker Policies

Enumerate Connections to Other Systems

Enumerate Local Accounts

Enumerate Security Products

Environment Variable Enumeration

Host Enumeration with LinPEAS

Identify Endpoint Defenses

Installed Software Discovery

Internet Connection Discovery

Local Groups Discovery

Local System Reconnaissance

Log Enumeration

Microsoft Defender Status Discovery

Processes and Services Discovery

Query Logged On Users

Query Registry

SCCM / Software Discovery

Search Internal Documentation

Security Software and Controls Discovery

Session Enumeration

Session Hunting

System Information Discovery

System Language Discovery

System Network Configuration Discovery

System Owner/User Discovery

System Service Discovery

WSUS Client Configuration Enumeration

Local Privilege Escalation

1

Automated Privilege Escalation Enumeration with PEASS-ng

Network Scanning

13

AppLocker Policy Discovery

Host Discovery for Lateral Movement

Internal network port and service scanning via hardware implant

Internal Reconnaissance

Internal Web and Share Reconnaissance

Network Discovery — DHCP Discovery

Network Enumeration

Network Scanning

Network Service Discovery with Bettercap

Remote Service / RPC Information Enumeration

Remote System Discovery

Sniff Network Traffic

SNMP enumeration

Obfuscation

1

Reverse Engineering Application

Persistence

62 items

Account Manipulation

13

Create Account

Create Computer Accounts

Create Domain Account

Create Local Account

DCShadow

Domain Computer Account Creation via Join Rights

DSRM Account Persistence

Enterprise Identity Dominance

Exchange Mailbox Delegate Permissions

LAPS Persistence

SSH Persistence

User & Computer Persistence

UserAccountControl Manipulation

AWS Cloud

1

AWS IAM Access Key Addition

Backdoor

13

Application Shimming

Create Auto-Start Windows Service

Create or Modify Kubernetes Resources

Create Windows Service for Persistence

Exploit/Abuse Apache Tomcat Manager

Hosts File Manipulation / Name Resolution Hijacking

In-Memory Webshell

LAPS Backdoor

Stable Host Backdoor Deployment

VIM Configuration Backdoor

Web Shells

Windows Management Instrumentation Event Subscription

WMI Persistence

Cloud Persistence

5

Create Cloud Accounts for Persistence

Device Registration

GCP OS Login SSH Key Addition

Kubernetes ClusterRoleBinding Permission Addition

Persistence via MDM

Credential Abuse

1

DSRM Password Access

Database Client Abuse

2

MS SQL Servers

SQL Stored Procedures

Hardware Implant

1

Component Firmware Modification

Macro Execution

1

Office Application Startup

Office Add-In Abuse

3

Malicious Office Add-in (Excel XLL)

Malicious Office Add-in (Word)

Office Add-ins

Remote Access

3

Modify Remote Registry

Network Implant

Remote Access Software

Remote Execution

9

Create or Modify Services on Remote Machines

Create or Modify Windows Service

Deploy malicious Tomcat application

Malicious File Deployment

Replace executable on shared file

Run-Key Persistence via Remote UNC Executable

Service Manipulation

Windows Service Creation and ImagePath Modification

Windows Service ImagePath Replacement

Scheduled Task Abuse

6

Abuse Scheduled Task / Periodic Script Execution

Create Scheduled Task

Registry Run Key Persistence

Service Registration Persistence

Startup Folder

Startup Folder Auto-Start Persistence (benign validation)

UAC Bypass

1

Component Object Model Hijacking

User Execution

1

Shortcut Modification

Web Exploitation

2

Hosting malicious payload on trusted web application

Tomcat Manager Web Shell Deployment

Privilege Escalation

108 items

Account Manipulation

2

Add Entra ID Application Password Credential

Device Registration Abuse

Azure Cloud

2

Additional Cloud Role and Permission Assignment

Project reparenting

Credential Abuse

4

Excessive Privileges

Server Administrator Privilege Acquisition

Use of over-privileged or shared privileged accounts / abuse of privileged accounts

Use of Valid/Generic Administrator Accounts to tamper application files

Database Client Abuse

1

MSSQL Impersonation

DLL Hijacking

1

Hijack Shared Module DLL Search Order

Environment Variable Manipulation

1

PATH Environment Variable Hijacking

Local Privilege Escalation

17

Abuse Windows Service

Dirty Cow (CVE-2016-5195)

Enumerate Linux Privilege Escalation Vectors

Exploit AlwaysInstallElevated MSI Execution

Exploit unsupported operating systems

Exploitation of Vulnerable Signed Driver

Hijack Environment Variables

Kubernetes Privilege Escalation

Kubernetes Privileged Container Escape to Host

MS16-032 Secondary Logon Elevation of Privilege

Path Interception

PrintNightmare (CVE-2021-1675)

Server Administrator Privilege Escalation

Services File Permissions Weakness

SetUID and SetGID Exploitation

Sudo Misconfiguration

Windows Privilege Escalation

Payload Loading

1

Kernel Driver Loading

Privilege Escalation

67

Abusing ACEs

Account alive + privs

ACE abuse

adidnsdump

Admin access

Admin on target

All domain hashes

Auth with machine name pwd

channel binding

Crack offline

Create machine acct

Credentials / shell

DA / NT hash

DA NT hash

DC password → empty

DCOM trigger on target

dNSHostName = DC FQDN

Domain Admin

Domain owned

donpapi

Explorer resolves UNC

forced authentication attack

forcing a victim to authenticate

Forest owned

from a coercion

gMSA NT hash

Groups with RID > 1000

john

Kerberos auth redirected

ldeep

Local Admin

manspider

masky

MATCH

Member of DnsAdmins

MIC

MIC protection

mimikatz

Need victim auth to svc

Netlogon zero challenge

NT hash / shell

NTLMv2 hash captured

NTLMv2 hash leaked

nuclei

nxc

Object + group memberships

Own child domain

Own trusted forest

Parent + Child SID

Pcredz

Privilege Escalation

proxychains

PushSubscription abuse (a.k.a. PrivExchange)

RAR / ZIP with payload

Register CNAME record

rusthound

Service access / DA

Service acct access

signing

Site takeover

sprayhound

SYSTEM on DC → DA

SYSTEM on SQL host

User browses share

Victims auth via NTLM

Write access to share

ysoserial.jar

Process Injection

1

Runtime Data Manipulation

Remote Execution

2

Escape to Host

SQL Privilege Escalation

SCCM/WSUS Abuse

2

SCCM Site Takeover via MSSQL Database or AdminService API

WSUS abuse for privilege escalation

Scheduled Task Abuse

1

Accessibility Features

Token Impersonation

1

Token Privilege Escalation via SeImpersonate

UAC Bypass

5

Bypass User Account Control

Elevated Execution with Prompt (macOS)

Fodhelper

UAC Bypass via Auto-Elevating Windows Binaries

Workstation Administrator Privilege Acquisition

Domain Enumeration

63 items

AD Enumeration

54

Account Discovery

Active Directory Account Discovery from Description Attributes

Active Directory Attack Path Collection

Active Directory Domain Group Discovery

Active Directory Domain Password Policy Discovery

Active Directory Trust Enumeration

AD Computer Discovery for LAPS Password-Attribute Gaps

AD CS Template Permission Discovery

Anonymous LDAP Binding Enumeration

Crawl link chain

Cross-Domain BloodHound Collection

Cross-Domain Group Enumeration

Domain Account Discovery

Domain Account Enumeration via PowerShell and SMB

Domain Controller Discovery

Domain Groups Discovery

Domain Trust Discovery

Email Account Discovery

Enum deleted objects

Enum disabled accounts

Enum linked servers

Enum pre2k accounts

Enumerate Active Directory Certificate Services (AD CS)

Enumerate Active Directory Domain Objects and Trusts

Enumerate Active Directory Object ACLs

Enumerate Active Directory via LDAPS

Enumerate Domain Accounts

Enumerate Domain Users

Enumerate Local or Domain Groups

Enumerate SPNs

Extract Secrets from Backups

Find gMSA readers

Find MSSQL (SPN enum)

Find Schema v1 tmpl

Find unconstrained host

Find WebClient enabled

Find writable deleted obj

Foreign Group Membership

Group Policy Discovery

Inactive Domain Account Discovery

Internal Name Resolution

Kerberos Delegation Enumeration

LAPS Configuration Discovery

LDAP Enumeration

LDAP Object Enumeration via bloodyAD

LDAP Signing and Channel Binding Check

Missing Protected Users Group Membership

Organizational Structure Enumeration

Password Policy Discovery

Protected Users Membership Coverage Audit

SCCM Distribution Point Discovery

sccmhunter find

Unauthenticated Enumeration

Writable Object Enumeration

AWS Cloud

1

Cloud Account Discovery

Azure Cloud

2

Azure Resource / Subscription Enumeration

Entra ID / Azure AD Object Extraction

Database Enumeration

1

Database Permission Discovery

Local Host Enumeration

1

Citrix Broker Session Enumeration

Network Scanning

2

Network Service Discovery

Network Service Discovery with Nmap

Phishing

1

Host and Domain Enumeration

Ticket Manipulation

1

AS-REP Roasting Preauthentication Audit

Lateral Movement

117 items

AD Misconfigurations

4

Coerce DC (PetitPotam)

Coerce DC → target

Coerce local SYSTEM

PetitPotam @80

Credential Abuse

16

Authenticate with Web Session Cookie

Cloud Lateral Movement

Credential Reuse for Lateral Access

Kerberos Ticket Theft and Pass-the-Ticket

Pass the Hash to Windows Hosts over SMB

Poor Crown Jewel Segregation

SSH Hijacking

Use a Web Session Cookie against a Test Application

Use an Application Access Token for OpenShift API Access

Use of Active Privileged Session

Use of Domain Admin Credentials on Workstations

Use of Local Administrative Credentials

Use of Stolen API Keys/Tokens

Use of Stolen Token to Access Secrets

Use of Valid Accounts / Assume Breached

Valid Domain Account SMB Service Execution

Database Client Abuse

2

MSSQL Authentication

MSSQL Linked Server Abuse

Kerberos Delegation Abuse

6

Kerberos Bronze Bit (CVE-2020-17049)

Kerberos Constrained Delegation (S4U2Proxy)

Kerberos constrained delegation abuse with S4U

Kerberos Delegation Abuse

S4U2Self Abuse

Unconstrained Delegation

NAC Bypass

1

Endpoint Impersonation Limited by 802.1X

NTLM/Kerberos Relaying

16

Crack / Relay hash

Cross-trust coercion and relay

DHCPv6 + DNS poisoning

mitm6 DHCPv6 poison

name poisoning

NTLM relay → LDAP

NTLM Relay to SMB

NTLM Relay via Adversary-in-the-Middle

NTLM Relay with SOCKS Proxy

ntlmrelayx → LDAP

NTLMv2 to Responder

RBCD via NTLM Relay

Relay → LDAP(S)

Relay to LDAP / service

responder

Responder poisoning

Pass-the-Hash

6

Credential Reuse Exploitation

Credential-Based Lateral Movement

eKeys

Flat Network Pivoting

Pass-the-Hash

RDP Authentication with Kerberos, Restricted Admin, and Pass-the-Hash

Port Redirection & Proxy

6

Internal Proxy

Jump Host Use / Bastion Host Requirement

Network Pivoting

Pivoting

Port forwarding with netsh interface portproxy

Reverse RDP Proxying

Remote Access

7

RDP

RDP Enablement via Registry and Firewall Disable

RDP Hijacking

RDP misconfiguration / insufficient hardening

Session Hijacking

VNC

Windows Remote Management

Remote Execution

46

Abuse of Container Management Platform

Admin Rights Remote System Connection

Code exec as SYSTEM

Compromise of Jump Host to Reach Servers

Crown Jewel Access via Poor Segmentation / Lack of Jump Hosts

Database Service Lateral Movement

Distribute/trojanize documents on shared network drives

Execute a Command over SMB with Impacket PsExec

Exploitation for Client Execution

Exploitation of Remote Services

Fileless Lateral Movement

Impacket exec family (psexec/smbexec/wmiexec/atexec)

Ingress File Transfer via SMB

Insecure remote administration

Insufficient Network Segregation

Lack of network segregation enabling lateral movement

Lateral Movement / DA

Lateral Mvmt / DA

Lateral Tool Transfer

MSSQL Linked Server Pivoting

MSSQL RCE without xp_cmdshell (OLE/CLR)

Network Propagation

Network Propagation (Lateral Movement)

PrintNightmare

Ransomware Propagation via SMB Admin Shares

RCE via Cloud VM Agent

Remote Command Execution

Remote Service Execution via SCM

Remote Services Execution

Remote Shell Execution via DCOM

Remote System Interaction — Wake-on-LAN

Replace Executable on Shared Volume to Achieve Remote Code Execution

Replication through Removable Media

Service Control Manager lateral movement

SMB Exec

SMB PsExec Remote Execution Canary

SMB/Windows Admin Shares

SMB/Windows Admin Shares Lateral Movement

Software Deployment Tools

SSH

Taint Shared Content via Writable Share

VPN Exposed Service Lateral Movement

Windows Management Instrumentation

WinRM

WMI / DCOM Execution

ZeroLogon

SCCM/WSUS Abuse

3

SCCM Exploitation

Use of Enterprise Management/Orchestration Tools

WSUS Update Deployment

Social Engineering

1

Internal Phishing

Ticket Manipulation

3

Forest to Forest Compromise - Trust Ticket

Pass The Key

Pass-the-Ticket (PtT)

Credentials & User Impersonation

196 items

Account Manipulation

2

Pre-Created Computer Account

Shadow Credential Extraction

Authentication Coercion

5

Coerce Authentication via MS-EFSRPC (PetitPotam)

Coerce Authentication via MS-RPRN (PrinterBug)

DFSNM NTLM Coercion

Forced Authentication via RPC Coercion

Spearphishing via remote template to force authentication

Credential Abuse

35

Authenticate to CyberArk PVWA with a Valid Account

Authenticate with Local Credentials

Configuration Manager Distribution Content Credential Exposure Assessment

Craft Golden Ticket

Credential Harvesting from Network Access Accounts

Credential Relay DNS

Credential Validation

DC TGT + NT hash

Entra ID Connect MSOL/ADSync account abuse

Extract DC TGT

Forced authentication using shortcut files

Forced authentication via SMB LNK

Forge PRT Cookie

Forwardable TGS

Forwardable TGS obtained

Golden + EA SID

Golden GMSA

Kerberos Authentication

LAPS Read

Machine account TGT

Missing Two-Factor Authentication

NT hash / TGT

Okta Session Cookie Theft and Replay

Password Guessing

Password Managers

Privilege Escalation via Abusable Attack Paths

Request TGS (RC4)

Request TGS → DC$

Retrieve a Secret through the Container API

Seamless SSO Abuse

TGS as admin

TGS for allowed SPN

TGT as DC name

Valid Accounts — Use of Mail Relay

Validate Credentials

Credential Dumping

59

Active Directory NTDS.dit Collection via VSS

Cached Domain Credentials

Credential Extraction via Debugger

Credential/hash capture and offline cracking

Credentials from Password Stores

DCSync

DCSync / DA

DCSync across a trust

DCSync all hashes

Domain Admin Access

Domain Administrator Account Takeover

Domain Administrator Compromise

DPAPI Credential Dumping

DPAPI Credential Extraction

DPAPI Credential Harvesting

Dump and Analyze LSASS Memory with ProcDump and Mimikatz

Dump child krbtgt

Dump krbtgt hash

Dump LSASS Memory from a Privileged Account Outside the Protected Users Group

Dump LSASS Process Memory

dump of the SAM & LSA secrets

Dump SAM and LSA Secrets

dump the SAM and the LSA secrets

Enable WDigest credential caching

Excessive Privileges / Misconfigured Service Accounts

Exfiltrate Credentials

Extract Credentials from Password Manager by Dumping Process Memory

Extract DPAPI

Extraction of Local Administrator Passwords from AD Snapshot

gMSA and LAPS Password Extraction

Grant DCSync rights

Group Policy Preferences (GPP) Password Extraction

Harvest secrets

Intercept BitLocker Keys via Intel DCI

Keytab Extraction

LAPS Password Extraction

Linux Credential Cache

LSA registry hive extraction

LSA Secrets

LSASS Credential Dumping and Kerberos Ticket Extraction

LSASS dumping

LSASS Memory

lsassy

NTDS Dumping

NTLM hash harvesting and cracking

Offline ntds.dit / SAM extraction

OS Credential Dumping Overview

Password Policy Weakness

RODC Key List Attack

SAM and LSA secrets

SAM Credential Dumping

SAMAccountName = DC

SCOM RunAs Credential Decryption

SeBackupPrivilege

Session Stealing / Credential Replay

Skeleton Key

Stealing Clear Text Credentials from RDP

TPM Bus Sniffing for BitLocker VMK

Windows Registry Credential Looting

Credential Harvesting

39

Access Chrome Passwords

AS-REP Roasting

Capture Keystrokes

Credential Access via MDT Shares

Credential API Hooking

Credential Harvesting via Fake Password Prompt

Credential Harvesting via Web Form

Credential Prompt

Credentials from Web Browsers

Credentials in clear-text on network shares

Decrypting Application-stored Credentials

Extract Group Policy Preference Passwords (cpassword)

Extract SSH Private Keys

Forced Authentication via EFSRPC and UNC File Symbolic Link

Forced authentication via external resources in Outlook

GUI Input Capture

Harvest Private Keys

Inveigh LLMNR/NBNS Poisoning and NetNTLMv2 Capture

Kerberoasting

Keylogging

Linux Credential Hunting

Net-NTLMv2 Hash Capture

Plant Hardware Keylogger

Planting malicious shortcut files for credential harvesting

Primary Refresh Token Cookie

PXE Boot Image Exploitation

Search Credentials in Files

Search Hardcoded Credentials in Source Code and Scripts

SMB Share Poisoning

SQL NetNTLM Capture

SSH Key Harvesting

Steal Web Session Cookie

Targeted Kerberoasting

Unsecured Credentials

User Deception with Decoy Website

VIM Configuration Keylogger

Web Credential Harvesting via Phishing Proxy

Web Portal Capture

Web Session Cookie Exposure Test via XSS

Federation Abuse

2

Forge SAML Token via AD FS Key

Golden SAML Forgery

Hardware Key Extraction

1

Extraction of BitLocker Volume Master Keys from TPM

MFA Bypass

2

MFA Bypass

Multi-Factor Authentication Request Generation

NTLM/Kerberos Relaying

18

ConfigMgr Client-Push Forced Authentication

Forced Authentication

Kerberos Relay

Kerberos relaying

LDAP Relay Attack

LDAP Signing Not Enforced

LDAPS channel binding not enabled

LLMNR/NBT-NS Poisoning

Man-in-the-Middle

Man-in-the-Middle via rogue network bridge and Net-NTLMv2 capture

mitm6 IPv6 DNS takeover and NTLM relay

Name Resolution Poisoning and SMB Relay

NetNTLMv1 Relay / Hash Cracking

NTLM Relay

NTLM Relay via Forced Authentication

Printer Bug

SMB Hardening Weakness

SMB to LDAPS Relay

OAuth Abuse

5

Family Refresh Token Abuse

Microsoft Graph

OAuth

OAuth 2.0 Device Authorization Grant

Steal Application Access Token

Password Cracking

6

Offline cracking of captured Net-NTLMv2 hashes

Offline Password Hash Cracking

Password Cracking

Timeroasting

WPA/WPA2 Handshake Capture

WPA/WPA2-PSK Offline Password Cracking

Password Spraying

5

Kerbrute User Enumeration and Password Spraying

Online Brute Force against Web Application

Password Reuse Exploitation

Password Spray

Password Spraying

SCCM/WSUS Abuse

1

SCCM Policy and Distribution Point Credential Discovery

Ticket Manipulation

12

Cross-domain Kerberoasting

Diamond Ticket

Extract Kerberos Tickets

Golden Ticket

Golden Ticket, Silver Ticket, Pass-the-Ticket

Kerberos Clock Skew Manipulation

Kerberos Delegation

Kerberos Ticket Inspection and Renewal

MS14-068 Checksum Validation

Silver Ticket

Ticket Granting Ticket

Trust Ticket

Token Impersonation

4

Create Process with Alternate Credentials (Netonly)

Impersonate Token via Named Pipe / SCM

SpawnAs

Token Impersonation/Theft

AD Misconfigurations

88 items

Account Manipulation

9

Active Directory Deleted Account Restoration

Machine Account Name Mapping to Local Admin (Dollar Ticket)

Machine Account Quota

NoPAC / sAMAccountName Spoofing

PAM Trust Abuse

ResetNightmare (CVE-2026-27912)

Shadow Credentials

Shadow Credentials Bypass

SID History Injection

AD ACL Abuse

27

Active Directory Group ACL Abuse

Active Directory Object Ownership Takeover

Active Directory Password Reset via Delegated ACE

AD Group Membership Abuse via Writable ACL

AddMember

AdminSDHolder DACL Modification

BadSuccessor

Computer Account Restriction Modification

Cross-Domain ACL Abuse via Trusted Domain Credentials

DC GenericAll

Domain Trust Modification

Exchange Push Notification Privilege Escalation

Find ACL (GenericAll)

ForceChangePwd

GenericAll

GenericWrite

GenericWrite on target$

GenericWrite on user

GPO Abuse

Group Membership Modification via GenericAll

Local Administrator Password Solution not configured

Modify GPOs

SID Hijacking

User Account GenericAll Takeover

WriteDACL

WriteDACL on domain

WriteOwner

AD Certificate Abuse

34

Abuse of Active Directory Certificate Mapping

Abuse of Active Directory Certificate Services

AD CS Authentication Certificate Risk Review

AD CS ESC1: Enrollee-Supplied Subject

AD CS ESC10: Weak Schannel UPN Certificate Mapping

AD CS ESC11: NTLM Relay to RPC Enrollment

AD CS ESC12: YubiHSM KSP unauthorized CA-key use

AD CS ESC13

AD CS ESC14

AD CS ESC15

AD CS ESC16

AD CS ESC2: Any Purpose Certificate Template

AD CS ESC3

AD CS ESC4

AD CS ESC5: Vulnerable PKI Object Access Control

AD CS ESC6: CA Allows SAN Request Attributes

AD CS ESC7: Dangerous Permissions on a Certificate Authority

AD CS ESC8: NTLM Relay to Web Enrollment

AD CS ESC9: Certificate Template Without SID Security Extension

ADCS

ADCS ESC17

Cert issued as DC$

Certifried

certipy

certsync

DC certificate

ESC8

Get certificate

Golden Certificate Forgery

Misconfigured Certificate Templates

ntlmrelayx → ADCS HTTP

Pass-the-Certificate

PKINIT

Rogue cert issued

DLL Hijacking

1

DNSAdmins ServerLevelPluginDll Abuse

Kerberos Delegation Abuse

13

abuse Resource Based Kerberos Constrained Delegations (RBCD)

Abuse Resource-Based Constrained Delegation (RBCD)

Constrained Delegation Abuse (S4U2Proxy)

DA / RBCD / Shadow Creds

ntlmrelayx → set RBCD

RBCD on target

Resource-Based Constrained Delegation (RBCD) - Add Computer

S4U2self

S4U2Self/S4U2Proxy delegation

Set RBCD on local host

SPN hijack — redirect constrained delegation to the DC

Unconstrained Delegation via EFSRPC Coercion

Unconstrained Kerberos Delegation

NTLM/Kerberos Relaying

3

DavRelayUp

Kerberos Relay to LDAP for RBCD/Shadow Credentials

PrivExchange

Ticket Manipulation

1

Parent-Child

Defense Evasion

152 items

Cloud Persistence

1

Modify Cloud Compute Configurations

Code Signing Abuse

2

Abuse Code Signing

Code-Signing Certificate Abuse via AD CS

Command and Control

1

C2 via DNS

Defense Impairment

16

Block EDR via Custom WDAC Policy

Disable or Modify Local Security Tools

Disable or Modify System Firewall

Disable or Modify Tools

Disable or Modify Windows Defender

Disable or Modify Windows Event Log

Downgrade Attack

Downgrade Kerberos Encryption

ETW

Impair Defenses

Mark-of-the-Web Bypass

Microsoft Defender Exclusion Tampering

Modify Hosts File

Modify Windows Firewall Rules

WDAC Policy Deployment / EDR Kill

Windows File and Directory Permissions Modification

DLL Hijacking

11

Deploy DLL to user directory

DLL loaded as SYSTEM

DLL Search Order Hijacking

DLL Side-Loading

DLL Sideloading

Host SMB share + DLL

Inject App Policy EKU

OneDrive DLL Search-Order Loading (Reported Case)

Set ServerLevelPlugin DLL

Target loads malicious DLL

Teams DLL Loading (Classic Client Historical Case)

Hide Artifacts

10

Alternate Data Streams

File Deletion

File/Path Exclusions

NTFS File Attributes

Parent PID Spoofing

Prepare a Dot-Prefixed Workspace and Bash History Controls

Relocate Malware

Remove Tool Indicators and Signatures

Run Virtual Instance

Timestomp

In-Memory Execution

16

Beacon Object File (BOF) Execution

DelegateType Reflection for In-Memory Execution

Executing Shellcode in Word Memory

Host-based CLR hosting to avoid dropping executables

In-memory Execution of .NET Assembly

Leveraging UnsafeNativeMethods for In-Memory Execution

Memory Execution

Native API

PowerShell Add-Type Reflective Code Loading

PowerShell Native API Interop

Reflection

Reflection Shellcode Runner in PowerShell

Reflective .NET Assembly Loading (CLR Hosting)

Reflective Load

Shellcode Runner (C#)

Shellcode Runner (Jscript)

Logging Gap Exploitation

6

Clear Windows Event Logs

Disable Windows Event Logging

Event Forwarding Subscription Tampering

Impair Command History Logging / Timestomp / Masquerading

Logging and Monitoring Gap Assessment

PowerShell Command History Removal

LOLBin Abuse

26

AppLocker Writable Allow-Path Validation

AutoHotkey Execution

Command and Scripting Interpreter

Dynamic Data Exchange (DDE) Execution

Execution via User-installed Applications (Visual Studio Code)

Hidden Window

HTML Help (CHM) Proxy Execution

Indicator Removal on Host

InstallUtil Proxy Execution

LOLBIN abuse

Masquerading

MSBuild Proxy Execution

Mshta Proxy Execution

Operational Security via Minimal Privilege Use

PowerShell

PowerShell CLM Bypass

PowerShell Constrained Language Mode

PowerShell v2 abuse

Proxy Bypass

Regsvr32 Proxy Execution

Rundll32 Proxy Execution

Targeting and Accessing Crown Jewels

Windows Command Shell

Windows Command Shell Canary Execution

WSL Indirect Command Execution

XSL Script Processing

Network Evasion

8

DHCP Lease Renewal for IP-Based Control Testing

Domain Fronting

Host Network Identity Changes

MAC Address Spoofing

Network Boundary Bridging

Proxying with ProxyChains-NG

Reverse Shell

Web Service

Obfuscation

41

Binary Padding

Command Obfuscation

Compile After Delivery

Conditional Access Bypass via Resource Exclusion

Custom Payload Generation

Deobfuscate/Decode Files or Information

Detect User Activity for Sandbox Evasion

Discretionary Access Control Lists

Dynamic API Invocation (D/Invoke)

Dynamic API Resolution

EDR Bypass

Enumerate Antivirus Configuration

Environmental Keying

Evade Analysis via Environmental Guardrails

Fiddling With The User-Agent (User-Agent Spoofing)

IOC-Driven Payload Modification

Locating Antivirus Signatures

Masquerade PE Header Metadata

Masquerade Task or Service

Match Legitimate Resource Name or Location

Network/Host Identifier Modification

Obfuscate VBA Macro Payloads

Obfuscated Files or Information

Obfuscation

Process Environment Block walking

Renaming of binaries and artifacts

Run Virtual Instance with Bridged Networking

Sandbox Evasion

Signature Evasion

Sleep Delays and Time Checks for Sandbox Evasion

Software Packing

Software Packing of Executable Payloads

Software Packing with Nimcrypt2

String Encryption

Symbol Stripping

System Checks for Virtualization/Sandbox Evasion

Template Injection

Timing-based evasion of automated share monitoring

Use of CAPTCHA and Trusted Hosting to Evade Automated Analysis

VBA Stomping

Win32 API Calls (C#)

Payload Delivery

1

Office Remote Template Injection

Port Redirection & Proxy

2

DNS Filtering Bypass

Plink, Chisel, and iodine (authorized test)

Process Injection

11

DLL Injection

Dynamic-link Library Injection

Process Hollowing

Process Injection

Process Injection via APC Queue

Reflective DLL Injection

Reflective PE Injection

Shellcode Injection

Thread Execution Hijacking

Threadless Injection

Windows Process Injection via Remote Thread

Collection

30 items

Cloud Data Collection

9

Access S3 Buckets

AWS S3 Data Discovery and Collection

Code Repository Collection

Email Harvesting

GCP Cloud Storage Canary Collection

Search internal repositories

Search mailboxes, home folders and cloud storage

Search Repositories for Sensitive Information

Tampering with cloud storage policies to allow public access

Credential Harvesting

1

Sensitive File Collection

Data Staging

4

Archive Collected Data

Data Staging & Preparation

File Share Data Staging

Local Data Staging

Database Client Abuse

1

Use of Database Client to Access Database

File Share Enumeration

2

Data from Information Repositories

Data from Network Shared Drive

Local Host Enumeration

7

Access SQL Server with local tools

Automated Collection

Clipboard Data

Database Access via Deployed Application

Screen Capture

Search SharePoint and download files

Video Capture

Network Scanning

2

Data from Local System

SNMP

Obfuscation

1

Isolated Remote Debugging Validation

SCCM/WSUS Abuse

1

Unauthenticated SCCM Package Access

UAC Bypass

1

WinRE BitLocker Security Feature Bypass

Web Exploitation

1

Unauthenticated Internal Documentation Access

Exfiltration

0 items

Impact

33 items

Destructive Impact

10

ADIDNS Record Manipulation

Critical Service Disruption

Data Destruction

Data Encrypted for Impact

Destructive Data Manipulation

Fraudulent Transaction Simulation

Inhibit System Recovery

Internal Defacement

Manipulate Database Transactions

Stop Cloud Service

Exfiltration Channel

23

7-Zip Archive Upload via SFTP

BigQuery Canary Export to a Controlled Cloud Account

Controlled SCP Canary Transfer

Data Exfiltration via HTTPS Upload

Data Exfiltration via SFTP

Database Access from Application Server

DevOps Exploitation

DNS Exfiltration

Egress Filtering Weakness

Encode data into printable documents

Encrypted Archive Exfiltration via SFTP or HTTPS

Encrypted Large File Exfiltration

Exfiltrate to Cloud Storage

Exfiltration Over Web Service

GCP Cloud Storage Canary Upload

GCP Cross-Account Cloud Storage Canary Transfer

HTTPS C2 Exfiltration

HTTPS Proxy Exfiltration

Low-and-Slow Operations

Physical Data Exfiltration

Printer Redirection Exfiltration

Transfer Files

VDI Workspace Data Exfiltration