Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

PowerShell Web Access (PSWA)

Noise: RESTRICTED_ACCESS_BLUR_MARKER

Remote Execution

Lateral Movement

Windows Server feature that hosts an IIS-based HTTPS gateway for authenticated users to open a browser-based PowerShell console against an authorized remote Windows computer. An attacker with valid credentials and the required gateway authorization can abuse PSWA for remote PowerShell execution and lateral movement. CISA and partner agencies documented Iranian actors enabling PSWA on compromised servers. Access remains subject to the gateway authorization rule, target authentication, and target permissions.

Source

https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831611(v=ws.11)

Language

PowerShell

References

learn.microsoft.com learn.microsoft.com learn.microsoft.com learn.microsoft.com cisa.gov

+6 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER