RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Defense Evasion

Resource Development

0 items

Initial Access

0 items

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

0 items

AD Misconfigurations

0 items

Defense Evasion

152 items

Cloud Persistence

1

Modify Cloud Compute Configurations

Code Signing Abuse

2

Abuse Code Signing

Code-Signing Certificate Abuse via AD CS

Command and Control

1

C2 via DNS

Defense Impairment

16

Block EDR via Custom WDAC Policy

Disable or Modify Local Security Tools

Disable or Modify System Firewall

Disable or Modify Tools

Disable or Modify Windows Defender

Disable or Modify Windows Event Log

Downgrade Attack

Downgrade Kerberos Encryption

ETW

Impair Defenses

Mark-of-the-Web Bypass

Microsoft Defender Exclusion Tampering

Modify Hosts File

Modify Windows Firewall Rules

WDAC Policy Deployment / EDR Kill

Windows File and Directory Permissions Modification

DLL Hijacking

11

Deploy DLL to user directory

DLL loaded as SYSTEM

DLL Search Order Hijacking

DLL Side-Loading

DLL Sideloading

Host SMB share + DLL

Inject App Policy EKU

OneDrive DLL Search-Order Loading (Reported Case)

Set ServerLevelPlugin DLL

Target loads malicious DLL

Teams DLL Loading (Classic Client Historical Case)

Hide Artifacts

10

Alternate Data Streams

File Deletion

File/Path Exclusions

NTFS File Attributes

Parent PID Spoofing

Prepare a Dot-Prefixed Workspace and Bash History Controls

Relocate Malware

Remove Tool Indicators and Signatures

Run Virtual Instance

Timestomp

In-Memory Execution

16

Beacon Object File (BOF) Execution

DelegateType Reflection for In-Memory Execution

Executing Shellcode in Word Memory

Host-based CLR hosting to avoid dropping executables

In-memory Execution of .NET Assembly

Leveraging UnsafeNativeMethods for In-Memory Execution

Memory Execution

Native API

PowerShell Add-Type Reflective Code Loading

PowerShell Native API Interop

Reflection

Reflection Shellcode Runner in PowerShell

Reflective .NET Assembly Loading (CLR Hosting)

Reflective Load

Shellcode Runner (C#)

Shellcode Runner (Jscript)

Logging Gap Exploitation

6

Clear Windows Event Logs

Disable Windows Event Logging

Event Forwarding Subscription Tampering

Impair Command History Logging / Timestomp / Masquerading

Logging and Monitoring Gap Assessment

PowerShell Command History Removal

LOLBin Abuse

26

AppLocker Writable Allow-Path Validation

AutoHotkey Execution

Command and Scripting Interpreter

Dynamic Data Exchange (DDE) Execution

Execution via User-installed Applications (Visual Studio Code)

Hidden Window

HTML Help (CHM) Proxy Execution

Indicator Removal on Host

InstallUtil Proxy Execution

LOLBIN abuse

Masquerading

MSBuild Proxy Execution

Mshta Proxy Execution

Operational Security via Minimal Privilege Use

PowerShell

PowerShell CLM Bypass

PowerShell Constrained Language Mode

PowerShell v2 abuse

Proxy Bypass

Regsvr32 Proxy Execution

Rundll32 Proxy Execution

Targeting and Accessing Crown Jewels

Windows Command Shell

Windows Command Shell Canary Execution

WSL Indirect Command Execution

XSL Script Processing

Network Evasion

8

DHCP Lease Renewal for IP-Based Control Testing

Domain Fronting

Host Network Identity Changes

MAC Address Spoofing

Network Boundary Bridging

Proxying with ProxyChains-NG

Reverse Shell

Web Service

Obfuscation

41

Binary Padding

Command Obfuscation

Compile After Delivery

Conditional Access Bypass via Resource Exclusion

Custom Payload Generation

Deobfuscate/Decode Files or Information

Detect User Activity for Sandbox Evasion

Discretionary Access Control Lists

Dynamic API Invocation (D/Invoke)

Dynamic API Resolution

EDR Bypass

Enumerate Antivirus Configuration

Environmental Keying

Evade Analysis via Environmental Guardrails

Fiddling With The User-Agent (User-Agent Spoofing)

IOC-Driven Payload Modification

Locating Antivirus Signatures

Masquerade PE Header Metadata

Masquerade Task or Service

Match Legitimate Resource Name or Location

Network/Host Identifier Modification

Obfuscate VBA Macro Payloads

Obfuscated Files or Information

Obfuscation

Process Environment Block walking

Renaming of binaries and artifacts

Run Virtual Instance with Bridged Networking

Sandbox Evasion

Signature Evasion

Sleep Delays and Time Checks for Sandbox Evasion

Software Packing

Software Packing of Executable Payloads

Software Packing with Nimcrypt2

String Encryption

Symbol Stripping

System Checks for Virtualization/Sandbox Evasion

Template Injection

Timing-based evasion of automated share monitoring

Use of CAPTCHA and Trusted Hosting to Evade Automated Analysis

VBA Stomping

Win32 API Calls (C#)

Payload Delivery

1

Office Remote Template Injection

Port Redirection & Proxy

2

DNS Filtering Bypass

Plink, Chisel, and iodine (authorized test)

Process Injection

11

DLL Injection

Dynamic-link Library Injection

Process Hollowing

Process Injection

Process Injection via APC Queue

Reflective DLL Injection

Reflective PE Injection

Shellcode Injection

Thread Execution Hijacking

Threadless Injection

Windows Process Injection via Remote Thread

Collection

0 items

Exfiltration

0 items