Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

Invoke-DCOM

Noise: RESTRICTED_ACCESS_BLUR_MARKER

Remote Execution

Lateral Movement

PowerShell script by Steve Borosh that remotely activates COM objects through DCOM. Its methods include command execution through MMC20.Application, ShellWindows, ShellBrowserWindow, and ExcelDDE, as well as service and system-information operations. It runs in the caller's security context and defines no credential parameters; success depends on remote DCOM permissions and RPC connectivity. It is not a command-and-control implant and does not implement beaconing or persistence.

Source

https://github.com/rvrsh3ll/Misc-Powershell-Scripts/blob/master/Invoke-DCOM.ps1

Language

PowerShell

References

github.com attack.mitre.org attack.mitre.org learn.microsoft.com learn.microsoft.com

+11 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER