RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Credentials & User Impersonation

Resource Development

0 items

Initial Access

0 items

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

196 items

Account Manipulation

2

Pre-Created Computer Account

Shadow Credential Extraction

Authentication Coercion

5

Coerce Authentication via MS-EFSRPC (PetitPotam)

Coerce Authentication via MS-RPRN (PrinterBug)

DFSNM NTLM Coercion

Forced Authentication via RPC Coercion

Spearphishing via remote template to force authentication

Credential Abuse

35

Authenticate to CyberArk PVWA with a Valid Account

Authenticate with Local Credentials

Configuration Manager Distribution Content Credential Exposure Assessment

Craft Golden Ticket

Credential Harvesting from Network Access Accounts

Credential Relay DNS

Credential Validation

DC TGT + NT hash

Entra ID Connect MSOL/ADSync account abuse

Extract DC TGT

Forced authentication using shortcut files

Forced authentication via SMB LNK

Forge PRT Cookie

Forwardable TGS

Forwardable TGS obtained

Golden + EA SID

Golden GMSA

Kerberos Authentication

LAPS Read

Machine account TGT

Missing Two-Factor Authentication

NT hash / TGT

Okta Session Cookie Theft and Replay

Password Guessing

Password Managers

Privilege Escalation via Abusable Attack Paths

Request TGS (RC4)

Request TGS → DC$

Retrieve a Secret through the Container API

Seamless SSO Abuse

TGS as admin

TGS for allowed SPN

TGT as DC name

Valid Accounts — Use of Mail Relay

Validate Credentials

Credential Dumping

59

Active Directory NTDS.dit Collection via VSS

Cached Domain Credentials

Credential Extraction via Debugger

Credential/hash capture and offline cracking

Credentials from Password Stores

DCSync

DCSync / DA

DCSync across a trust

DCSync all hashes

Domain Admin Access

Domain Administrator Account Takeover

Domain Administrator Compromise

DPAPI Credential Dumping

DPAPI Credential Extraction

DPAPI Credential Harvesting

Dump and Analyze LSASS Memory with ProcDump and Mimikatz

Dump child krbtgt

Dump krbtgt hash

Dump LSASS Memory from a Privileged Account Outside the Protected Users Group

Dump LSASS Process Memory

dump of the SAM & LSA secrets

Dump SAM and LSA Secrets

dump the SAM and the LSA secrets

Enable WDigest credential caching

Excessive Privileges / Misconfigured Service Accounts

Exfiltrate Credentials

Extract Credentials from Password Manager by Dumping Process Memory

Extract DPAPI

Extraction of Local Administrator Passwords from AD Snapshot

gMSA and LAPS Password Extraction

Grant DCSync rights

Group Policy Preferences (GPP) Password Extraction

Harvest secrets

Intercept BitLocker Keys via Intel DCI

Keytab Extraction

LAPS Password Extraction

Linux Credential Cache

LSA registry hive extraction

LSA Secrets

LSASS Credential Dumping and Kerberos Ticket Extraction

LSASS dumping

LSASS Memory

lsassy

NTDS Dumping

NTLM hash harvesting and cracking

Offline ntds.dit / SAM extraction

OS Credential Dumping Overview

Password Policy Weakness

RODC Key List Attack

SAM and LSA secrets

SAM Credential Dumping

SAMAccountName = DC

SCOM RunAs Credential Decryption

SeBackupPrivilege

Session Stealing / Credential Replay

Skeleton Key

Stealing Clear Text Credentials from RDP

TPM Bus Sniffing for BitLocker VMK

Windows Registry Credential Looting

Credential Harvesting

39

Access Chrome Passwords

AS-REP Roasting

Capture Keystrokes

Credential Access via MDT Shares

Credential API Hooking

Credential Harvesting via Fake Password Prompt

Credential Harvesting via Web Form

Credential Prompt

Credentials from Web Browsers

Credentials in clear-text on network shares

Decrypting Application-stored Credentials

Extract Group Policy Preference Passwords (cpassword)

Extract SSH Private Keys

Forced Authentication via EFSRPC and UNC File Symbolic Link

Forced authentication via external resources in Outlook

GUI Input Capture

Harvest Private Keys

Inveigh LLMNR/NBNS Poisoning and NetNTLMv2 Capture

Kerberoasting

Keylogging

Linux Credential Hunting

Net-NTLMv2 Hash Capture

Plant Hardware Keylogger

Planting malicious shortcut files for credential harvesting

Primary Refresh Token Cookie

PXE Boot Image Exploitation

Search Credentials in Files

Search Hardcoded Credentials in Source Code and Scripts

SMB Share Poisoning

SQL NetNTLM Capture

SSH Key Harvesting

Steal Web Session Cookie

Targeted Kerberoasting

Unsecured Credentials

User Deception with Decoy Website

VIM Configuration Keylogger

Web Credential Harvesting via Phishing Proxy

Web Portal Capture

Web Session Cookie Exposure Test via XSS

Federation Abuse

2

Forge SAML Token via AD FS Key

Golden SAML Forgery

Hardware Key Extraction

1

Extraction of BitLocker Volume Master Keys from TPM

MFA Bypass

2

MFA Bypass

Multi-Factor Authentication Request Generation

NTLM/Kerberos Relaying

18

ConfigMgr Client-Push Forced Authentication

Forced Authentication

Kerberos Relay

Kerberos relaying

LDAP Relay Attack

LDAP Signing Not Enforced

LDAPS channel binding not enabled

LLMNR/NBT-NS Poisoning

Man-in-the-Middle

Man-in-the-Middle via rogue network bridge and Net-NTLMv2 capture

mitm6 IPv6 DNS takeover and NTLM relay

Name Resolution Poisoning and SMB Relay

NetNTLMv1 Relay / Hash Cracking

NTLM Relay

NTLM Relay via Forced Authentication

Printer Bug

SMB Hardening Weakness

SMB to LDAPS Relay

OAuth Abuse

5

Family Refresh Token Abuse

Microsoft Graph

OAuth

OAuth 2.0 Device Authorization Grant

Steal Application Access Token

Password Cracking

6

Offline cracking of captured Net-NTLMv2 hashes

Offline Password Hash Cracking

Password Cracking

Timeroasting

WPA/WPA2 Handshake Capture

WPA/WPA2-PSK Offline Password Cracking

Password Spraying

5

Kerbrute User Enumeration and Password Spraying

Online Brute Force against Web Application

Password Reuse Exploitation

Password Spray

Password Spraying

SCCM/WSUS Abuse

1

SCCM Policy and Distribution Point Credential Discovery

Ticket Manipulation

12

Cross-domain Kerberoasting

Diamond Ticket

Extract Kerberos Tickets

Golden Ticket

Golden Ticket, Silver Ticket, Pass-the-Ticket

Kerberos Clock Skew Manipulation

Kerberos Delegation

Kerberos Ticket Inspection and Renewal

MS14-068 Checksum Validation

Silver Ticket

Ticket Granting Ticket

Trust Ticket

Token Impersonation

4

Create Process with Alternate Credentials (Netonly)

Impersonate Token via Named Pipe / SCM

SpawnAs

Token Impersonation/Theft

AD Misconfigurations

0 items

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items