RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: AD Misconfigurations

Resource Development

0 items

Initial Access

0 items

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

0 items

AD Misconfigurations

88 items

Account Manipulation

9

Active Directory Deleted Account Restoration

Machine Account Name Mapping to Local Admin (Dollar Ticket)

Machine Account Quota

NoPAC / sAMAccountName Spoofing

PAM Trust Abuse

ResetNightmare (CVE-2026-27912)

Shadow Credentials

Shadow Credentials Bypass

SID History Injection

AD ACL Abuse

27

Active Directory Group ACL Abuse

Active Directory Object Ownership Takeover

Active Directory Password Reset via Delegated ACE

AD Group Membership Abuse via Writable ACL

AddMember

AdminSDHolder DACL Modification

BadSuccessor

Computer Account Restriction Modification

Cross-Domain ACL Abuse via Trusted Domain Credentials

DC GenericAll

Domain Trust Modification

Exchange Push Notification Privilege Escalation

Find ACL (GenericAll)

ForceChangePwd

GenericAll

GenericWrite

GenericWrite on target$

GenericWrite on user

GPO Abuse

Group Membership Modification via GenericAll

Local Administrator Password Solution not configured

Modify GPOs

SID Hijacking

User Account GenericAll Takeover

WriteDACL

WriteDACL on domain

WriteOwner

AD Certificate Abuse

34

Abuse of Active Directory Certificate Mapping

Abuse of Active Directory Certificate Services

AD CS Authentication Certificate Risk Review

AD CS ESC1: Enrollee-Supplied Subject

AD CS ESC10: Weak Schannel UPN Certificate Mapping

AD CS ESC11: NTLM Relay to RPC Enrollment

AD CS ESC12: YubiHSM KSP unauthorized CA-key use

AD CS ESC13

AD CS ESC14

AD CS ESC15

AD CS ESC16

AD CS ESC2: Any Purpose Certificate Template

AD CS ESC3

AD CS ESC4

AD CS ESC5: Vulnerable PKI Object Access Control

AD CS ESC6: CA Allows SAN Request Attributes

AD CS ESC7: Dangerous Permissions on a Certificate Authority

AD CS ESC8: NTLM Relay to Web Enrollment

AD CS ESC9: Certificate Template Without SID Security Extension

ADCS

ADCS ESC17

Cert issued as DC$

Certifried

certipy

certsync

DC certificate

ESC8

Get certificate

Golden Certificate Forgery

Misconfigured Certificate Templates

ntlmrelayx → ADCS HTTP

Pass-the-Certificate

PKINIT

Rogue cert issued

DLL Hijacking

1

DNSAdmins ServerLevelPluginDll Abuse

Kerberos Delegation Abuse

13

abuse Resource Based Kerberos Constrained Delegations (RBCD)

Abuse Resource-Based Constrained Delegation (RBCD)

Constrained Delegation Abuse (S4U2Proxy)

DA / RBCD / Shadow Creds

ntlmrelayx → set RBCD

RBCD on target

Resource-Based Constrained Delegation (RBCD) - Add Computer

S4U2self

S4U2Self/S4U2Proxy delegation

Set RBCD on local host

SPN hijack — redirect constrained delegation to the DC

Unconstrained Delegation via EFSRPC Coercion

Unconstrained Kerberos Delegation

NTLM/Kerberos Relaying

3

DavRelayUp

Kerberos Relay to LDAP for RBCD/Shadow Credentials

PrivExchange

Ticket Manipulation

1

Parent-Child

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items