Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

MTPuTTY

Credential Dumping

Credentials & User Impersonation

Seatbelt's Windows MTPuTTY command reads the default mtputty.xml session file for local user profiles, reports saved session names, hosts, ports, and usernames, and decrypts stored Password values. It does not validate recovered credentials or connect to the remote systems. The parser only checks the default per-profile configuration path, so custom or portable locations may be missed.

Source

https://github.com/GhostPack/Seatbelt/blob/master/Seatbelt/Commands/Products/MTPuTTYCommand.cs

References

github.com github.com github.com

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER