RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Persistence

Resource Development

0 items

Initial Access

0 items

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

62 items

Account Manipulation

13

Create Account

Create Computer Accounts

Create Domain Account

Create Local Account

DCShadow

Domain Computer Account Creation via Join Rights

DSRM Account Persistence

Enterprise Identity Dominance

Exchange Mailbox Delegate Permissions

LAPS Persistence

SSH Persistence

User & Computer Persistence

UserAccountControl Manipulation

AWS Cloud

1

AWS IAM Access Key Addition

Backdoor

13

Application Shimming

Create Auto-Start Windows Service

Create or Modify Kubernetes Resources

Create Windows Service for Persistence

Exploit/Abuse Apache Tomcat Manager

Hosts File Manipulation / Name Resolution Hijacking

In-Memory Webshell

LAPS Backdoor

Stable Host Backdoor Deployment

VIM Configuration Backdoor

Web Shells

Windows Management Instrumentation Event Subscription

WMI Persistence

Cloud Persistence

5

Create Cloud Accounts for Persistence

Device Registration

GCP OS Login SSH Key Addition

Kubernetes ClusterRoleBinding Permission Addition

Persistence via MDM

Credential Abuse

1

DSRM Password Access

Database Client Abuse

2

MS SQL Servers

SQL Stored Procedures

Hardware Implant

1

Component Firmware Modification

Macro Execution

1

Office Application Startup

Office Add-In Abuse

3

Malicious Office Add-in (Excel XLL)

Malicious Office Add-in (Word)

Office Add-ins

Remote Access

3

Modify Remote Registry

Network Implant

Remote Access Software

Remote Execution

9

Create or Modify Services on Remote Machines

Create or Modify Windows Service

Deploy malicious Tomcat application

Malicious File Deployment

Replace executable on shared file

Run-Key Persistence via Remote UNC Executable

Service Manipulation

Windows Service Creation and ImagePath Modification

Windows Service ImagePath Replacement

Scheduled Task Abuse

6

Abuse Scheduled Task / Periodic Script Execution

Create Scheduled Task

Registry Run Key Persistence

Service Registration Persistence

Startup Folder

Startup Folder Auto-Start Persistence (benign validation)

UAC Bypass

1

Component Object Model Hijacking

User Execution

1

Shortcut Modification

Web Exploitation

2

Hosting malicious payload on trusted web application

Tomcat Manager Web Shell Deployment

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

0 items

AD Misconfigurations

0 items

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items