RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Privilege Escalation

Resource Development

0 items

Initial Access

0 items

Reconnaissance

0 items

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

108 items

Account Manipulation

2

Add Entra ID Application Password Credential

Device Registration Abuse

Azure Cloud

2

Additional Cloud Role and Permission Assignment

Project reparenting

Credential Abuse

4

Excessive Privileges

Server Administrator Privilege Acquisition

Use of over-privileged or shared privileged accounts / abuse of privileged accounts

Use of Valid/Generic Administrator Accounts to tamper application files

Database Client Abuse

1

MSSQL Impersonation

DLL Hijacking

1

Hijack Shared Module DLL Search Order

Environment Variable Manipulation

1

PATH Environment Variable Hijacking

Local Privilege Escalation

17

Abuse Windows Service

Dirty Cow (CVE-2016-5195)

Enumerate Linux Privilege Escalation Vectors

Exploit AlwaysInstallElevated MSI Execution

Exploit unsupported operating systems

Exploitation of Vulnerable Signed Driver

Hijack Environment Variables

Kubernetes Privilege Escalation

Kubernetes Privileged Container Escape to Host

MS16-032 Secondary Logon Elevation of Privilege

Path Interception

PrintNightmare (CVE-2021-1675)

Server Administrator Privilege Escalation

Services File Permissions Weakness

SetUID and SetGID Exploitation

Sudo Misconfiguration

Windows Privilege Escalation

Payload Loading

1

Kernel Driver Loading

Privilege Escalation

67

Abusing ACEs

Account alive + privs

ACE abuse

adidnsdump

Admin access

Admin on target

All domain hashes

Auth with machine name pwd

channel binding

Crack offline

Create machine acct

Credentials / shell

DA / NT hash

DA NT hash

DC password → empty

DCOM trigger on target

dNSHostName = DC FQDN

Domain Admin

Domain owned

donpapi

Explorer resolves UNC

forced authentication attack

forcing a victim to authenticate

Forest owned

from a coercion

gMSA NT hash

Groups with RID > 1000

john

Kerberos auth redirected

ldeep

Local Admin

manspider

masky

MATCH

Member of DnsAdmins

MIC

MIC protection

mimikatz

Need victim auth to svc

Netlogon zero challenge

NT hash / shell

NTLMv2 hash captured

NTLMv2 hash leaked

nuclei

nxc

Object + group memberships

Own child domain

Own trusted forest

Parent + Child SID

Pcredz

Privilege Escalation

proxychains

PushSubscription abuse (a.k.a. PrivExchange)

RAR / ZIP with payload

Register CNAME record

rusthound

Service access / DA

Service acct access

signing

Site takeover

sprayhound

SYSTEM on DC → DA

SYSTEM on SQL host

User browses share

Victims auth via NTLM

Write access to share

ysoserial.jar

Process Injection

1

Runtime Data Manipulation

Remote Execution

2

Escape to Host

SQL Privilege Escalation

SCCM/WSUS Abuse

2

SCCM Site Takeover via MSSQL Database or AdminService API

WSUS abuse for privilege escalation

Scheduled Task Abuse

1

Accessibility Features

Token Impersonation

1

Token Privilege Escalation via SeImpersonate

UAC Bypass

5

Bypass User Account Control

Elevated Execution with Prompt (macOS)

Fodhelper

UAC Bypass via Auto-Elevating Windows Binaries

Workstation Administrator Privilege Acquisition

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

0 items

AD Misconfigurations

0 items

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items