RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Initial Access

Resource Development

0 items

Initial Access

103 items

Build-System Compromise

4

Compromise of CI/CD

Compromise Software Supply Chain

Modify Artifact Repository

Visual Studio Code tasks.json

Credential Abuse

8

Authenticate to an SMB Service with a Valid Domain Account

Authenticate with Default Appliance Credentials

Authenticate with Domain Credentials

Cross-Tenant Attacks

Trusted Relationship

Use of Blank-Password Local Accounts

Use Valid Accounts

Validate Cloud Account Access to Kubernetes API

Credential Dumping

1

Plant Rogue Device

Database Client Abuse

1

SQL Command Execution

Hardware Implant

4

Hardware Additions

Malicious removable media

Physical network connection

Rogue Network Device Deployment

HTML Smuggling

2

HTML Smuggling

WASM Smuggling

LOLBin Abuse

4

Excel Macro / Add-in Execution

Execute JScript Dropper Payload

Malicious Scripting

Visual Basic

Macro Execution

9

Exploitation of insecure Microsoft Excel configuration

Malicious Macro

Malicious Macro Execution

Malicious Macros

Office VBA Macro Execution

Using PowerShell for malicious execution (via Office/VBA context)

VBA Shellcode Runner

VBA Win32 API Interop

Visual Basic macros

NAC Bypass

1

Network Access Control Bypass

Obfuscation

1

Access Card Cloning

Payload Delivery

5

Benign File Transfer Validation

Dropper Deployment

Ingress Tool Transfer

MSI Transform Weaponization

Shellcode Download via HTTP/S

Payload Loading

3

Malware execution / multi-malware infections

Payload Execution

Windows Download and Execute

Phishing

7

Device Code Phishing

Gophish Phishing Campaign Setup and Results Review

Phishing

Spearphishing Attachment

Spearphishing via Collaboration Infrastructure

Spearphishing via Collaboration Platform

Use of Compromised Cloud/Sharing Account for Malware Distribution

Remote Access

2

External Remote Services

Unmanaged Device VPN Access

Social Engineering

24

Deliver Payload via Malicious Phishing Link

Domain Impersonation / Typosquatting

Email Phishing

GoPhish Click-Tracking Phishing Simulation

Initial Access via Malicious Document (VBA Macros)

Malicious Windows Shortcut downloader

Onboarding as External Staff

Open Redirect Abuse in Spearphishing Links

Open Redirect Used in Phishing

Phishing for Credentials

Phishing with Microsoft Office

Phone-based social engineering / Caller ID manipulation

Physical USB drop / Baiting

Pretexting

Pretexting / Supplier Impersonation

SMS Phishing (Smishing)

Spear phishing Link

Spearphishing Link

Spearphishing Link to Internal Share

Spearphishing via Service

User Execution / Download and Execute

Vishing

Voice Phishing (Vishing)

Windows Remote Session Messaging (MSG.exe)

UAC Bypass

1

Tailgating

User Execution

13

Excel Web Query (IQY) User Execution

Execute Polyglot LNK Payload

JavaScript

Malicious Copy and Paste (ClickFix)

Malicious File

Malicious File Execution

Malicious Payload Execution / Implant

Office Open XML Custom UI Abuse

USB HID Keystroke Injection

User Execution of Malicious Payload

User Execution via Malicious Link

User-Assisted Malware Execution

Windows Shortcut (LNK) User Execution

Web Exploitation

13

Drive-by Compromise

Drive-by Download / Watering Hole Attack

Exploit Public-Facing Application

Exploitation of Open Redirects / Unvalidated Redirects

External Server or Website Compromise

External System Penetration

Jenkins Script Console Exploitation

Manual Vulnerability Validation

Missing Authentication for Critical Functions

Office/PDF Client Exploitation

Open Service / Unpatched Service Exploitation

SQL Injection

Web Service exposed / abused

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

0 items

AD Misconfigurations

0 items

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items