Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

PowerSCCM

SCCM/WSUS Abuse

Domain Enumeration

Lateral Movement

PowerSCCM is an alpha PowerShell module for querying SCCM site databases and WMI interfaces, with both defensive and offensive functions. It supports client, application, software-file, collection, and membership inventory queries, as well as collection and application administration, deployments, and custom WMI payload operations. Its README describes the offensive application-deployment flow as WMI-session-only. The module manifest identifies version 1.0, requires PowerShell 2.0, and states that it has no external dependencies.

Source

https://github.com/PowerShellMafia/PowerSCCM

Language

PowerShell

References

github.com github.com github.com github.com attack.mitre.org

+7 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER