Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

LockBit

Destructive Impact

Collection

Impact

Defense Evasion

LockBit is a ransomware family historically operated as an affiliate RaaS. Public reporting documents Windows and Linux/VMware ESXi variants, LockBit 2.0/3.0/Green, and macOS encryptor samples; affiliates encrypt victim data and some incidents include data theft before encryption. Affiliate TTPs and payload capabilities vary, so this record does not imply one version-independent LockBit command-line interface.

Source

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-165a

References

cisa.gov ic3.gov attack.mitre.org learn.microsoft.com attack.mitre.org

+1 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER