RTT· red team
RTT · red team
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase
TechniquesToolsCommandsAPTs
Search techniques, tools, commands…⌘K
No scenario
No scenario · all techniques in scope
IdleStatus
0Scenarios
Advanced Search Keywords:
  • opsec:low - Show techniques with low noise level (stealthy)
  • phase:"initial access" - Filter by phase (use quotes for spaces)
  • category:lateral - Filter by category
  • platform:windows - Filter by platform
  • tag:credential - Find items with specific tag in results
  • external:true - Show only external techniques
Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Active filters:

phase: Reconnaissance

Resource Development

0 items

Initial Access

0 items

Reconnaissance

32 items

AWS Cloud

2

AWS Cloud Infrastructure Discovery

AWS IAM Identity and Key Metadata Discovery

Azure Cloud

1

Microsoft Entra Application and Service Principal Discovery

Network Scanning

13

Active Network Scanning

DNS

External Attack Surface Discovery

External Footprint Analysis

External Infrastructure Reconnaissance

Externally Accessible PaaS Resources

HTTP Service Availability Probe

Network Security Appliances

Nmap Safe Vulnerability Scanning

Remote SMB Share Enumeration

Scanning IP Blocks

Web Server Vulnerability Scanning with Nikto

Web Service Scanning and Screenshotting

OSINT

14

Breach-Exposed Organizational Email Discovery

Client Configuration Discovery

Digital Certificates

Email Addresses

Gather Victim Host Information

Gather Victim Identity Information

Gather Victim Network Information

Internet-Facing Asset and Service Fingerprinting

OSINT — Search for Leaked Credentials

Publicly exposed version control / repository discovery

Search Closed Sources

Search Engines

Social Media

Subdomain Enumeration

Phishing

1

External Reconnaissance

Social Engineering

1

Social Engineering via Support Ticket

Host Enumeration

0 items

Persistence

0 items

Privilege Escalation

0 items

Domain Enumeration

0 items

Lateral Movement

0 items

Credentials & User Impersonation

0 items

AD Misconfigurations

0 items

Defense Evasion

0 items

Collection

0 items

Exfiltration

0 items