RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Lateral Movement

Resource Development

0 items

Initial Access

0 items

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

117 items

AD Misconfigurations

4

Coerce DC (PetitPotam)

Coerce DC → target

Coerce local SYSTEM

PetitPotam @80

Credential Abuse

16

Authenticate with Web Session Cookie

Cloud Lateral Movement

Credential Reuse for Lateral Access

Kerberos Ticket Theft and Pass-the-Ticket

Pass the Hash to Windows Hosts over SMB

Poor Crown Jewel Segregation

SSH Hijacking

Use a Web Session Cookie against a Test Application

Use an Application Access Token for OpenShift API Access

Use of Active Privileged Session

Use of Domain Admin Credentials on Workstations

Use of Local Administrative Credentials

Use of Stolen API Keys/Tokens

Use of Stolen Token to Access Secrets

Use of Valid Accounts / Assume Breached

Valid Domain Account SMB Service Execution

Database Client Abuse

2

MSSQL Authentication

MSSQL Linked Server Abuse

Kerberos Delegation Abuse

6

Kerberos Bronze Bit (CVE-2020-17049)

Kerberos Constrained Delegation (S4U2Proxy)

Kerberos constrained delegation abuse with S4U

Kerberos Delegation Abuse

S4U2Self Abuse

Unconstrained Delegation

NAC Bypass

1

Endpoint Impersonation Limited by 802.1X

NTLM/Kerberos Relaying

16

Crack / Relay hash

Cross-trust coercion and relay

DHCPv6 + DNS poisoning

mitm6 DHCPv6 poison

name poisoning

NTLM relay → LDAP

NTLM Relay to SMB

NTLM Relay via Adversary-in-the-Middle

NTLM Relay with SOCKS Proxy

ntlmrelayx → LDAP

NTLMv2 to Responder

RBCD via NTLM Relay

Relay → LDAP(S)

Relay to LDAP / service

responder

Responder poisoning

Pass-the-Hash

6

Credential Reuse Exploitation

Credential-Based Lateral Movement

eKeys

Flat Network Pivoting

Pass-the-Hash

RDP Authentication with Kerberos, Restricted Admin, and Pass-the-Hash

Port Redirection & Proxy

6

Internal Proxy

Jump Host Use / Bastion Host Requirement

Network Pivoting

Pivoting

Port forwarding with netsh interface portproxy

Reverse RDP Proxying

Remote Access

7

RDP

RDP Enablement via Registry and Firewall Disable

RDP Hijacking

RDP misconfiguration / insufficient hardening

Session Hijacking

VNC

Windows Remote Management

Remote Execution

46

Abuse of Container Management Platform

Admin Rights Remote System Connection

Code exec as SYSTEM

Compromise of Jump Host to Reach Servers

Crown Jewel Access via Poor Segmentation / Lack of Jump Hosts

Database Service Lateral Movement

Distribute/trojanize documents on shared network drives

Execute a Command over SMB with Impacket PsExec

Exploitation for Client Execution

Exploitation of Remote Services

Fileless Lateral Movement

Impacket exec family (psexec/smbexec/wmiexec/atexec)

Ingress File Transfer via SMB

Insecure remote administration

Insufficient Network Segregation

Lack of network segregation enabling lateral movement

Lateral Movement / DA

Lateral Mvmt / DA

Lateral Tool Transfer

MSSQL Linked Server Pivoting

MSSQL RCE without xp_cmdshell (OLE/CLR)

Network Propagation

Network Propagation (Lateral Movement)

PrintNightmare

Ransomware Propagation via SMB Admin Shares

RCE via Cloud VM Agent

Remote Command Execution

Remote Service Execution via SCM

Remote Services Execution

Remote Shell Execution via DCOM

Remote System Interaction — Wake-on-LAN

Replace Executable on Shared Volume to Achieve Remote Code Execution

Replication through Removable Media

Service Control Manager lateral movement

SMB Exec

SMB PsExec Remote Execution Canary

SMB/Windows Admin Shares

SMB/Windows Admin Shares Lateral Movement

Software Deployment Tools

SSH

Taint Shared Content via Writable Share

VPN Exposed Service Lateral Movement

Windows Management Instrumentation

WinRM

WMI / DCOM Execution

ZeroLogon

SCCM/WSUS Abuse

3

SCCM Exploitation

Use of Enterprise Management/Orchestration Tools

WSUS Update Deployment

Social Engineering

1

Internal Phishing

Ticket Manipulation

3

Forest to Forest Compromise - Trust Ticket

Pass The Key

Pass-the-Ticket (PtT)

Credentials & User Impersonation

0 items

AD Misconfigurations

0 items

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items