RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Techniques Tools Commands APTs

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Credentials / shell | RTT

Back to Techniques

Techniques›Privilege Escalation›Credentials / shell

Privilege Escalation

Credentials / shell

LNK / SCF / URL File Drop → Hash Capture: step 3 -> 4

CategoryPrivilege Escalation

StatusRESTRICTED_ACCESS_BLUR_MARKER

Discuss in Advisor

Related techniques

Related Entities (4)

Related

NTLMv2 to Responder (Lateral Movement)

NTLMv2 to Responder (Lateral Movement)

NTLMv2 hash leaked (Privilege Escalation)

NTLMv2 hash leaked (Privilege Escalation)

References

https://kypvas.github.io/ad_attack_architecture/

Extended details

RESTRICTED_ACCESS_BLUR_MARKER