Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

RTT· red team

RTT · red team

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Search techniques, tools, commands…⌘K

No scenario

No scenario · all techniques in scope

IdleStatus

0Scenarios

Advanced Search Keywords:

opsec:low - Show techniques with low noise level (stealthy)
phase:"initial access" - Filter by phase (use quotes for spaces)
category:lateral - Filter by category
platform:windows - Filter by platform
tag:credential - Find items with specific tag in results
external:true - Show only external techniques

Combining Keywords:

tag:stealth phase:"initial access" password

Searches for "password" within low-noise techniques in the initial access phase

Back to Tools

SCShell

Noise: RESTRICTED_ACCESS_BLUR_MARKER

Remote Execution

Lateral Movement

SCShell is a Windows remote service execution tool. It opens an existing service, temporarily changes its binary path with ChangeServiceConfigA, starts it, then restores the original path. The project README says this flow uses DCERPC and does not authenticate to SMB; it does not create a new service. The payload runs according to the selected service context and service permissions, so elevated execution is not guaranteed.

Source

https://github.com/Mr-Un1k0d3r/SCShell/blob/master/README.md

Language

C; repository also includes a Python implementation

References

github.com attack.mitre.org learn.microsoft.com learn.microsoft.com attack.mitre.org

+2 more

Extended Details

RESTRICTED_ACCESS_BLUR_MARKER