Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

Inline-Execute-PE

In-Memory Execution

Defense Evasion

Cobalt Strike extension comprising Beacon Object Files and an Aggressor Script for mapping supported unmanaged Windows PE executables into an x64 Beacon and returning their output. The inspected upstream snapshot supports x64 Windows C or C++ executables built with MinGW or Visual Studio; it does not describe a generic PowerShell or .NET loader. The extension uses peload, perun, and peunload, with separate table, configuration, and client-sync commands. Incorrect arguments or incompatible executables can crash a Beacon; a timeout can leave the extension unusable in that Beacon.

Source

https://github.com/Octoberfest7/Inline-Execute-PE/blob/bec579ed201a3ed05254f0bc06776b78e4a0940e/README.md

Language

C, Aggressor Script

References

github.com github.com hstechdocs.helpsystems.com hstechdocs.helpsystems.com attack.mitre.org

+3 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER