Offensive Techniques Methodologies
Microsoft introduced Data Protection Application Programming Interface (DPAPI) in Windows environments as a method to encrypt and decrypt sensitive data such as credentials using the Continue reading Web Browser Stored Credentials
DLL Proxy Loading is a technique which an arbitrary DLL exports the same functions as the legitimate DLL and forwards the calls to the legitimate Continue reading Persistence DLL Proxy Loading
Windows File Explorer is the is the graphical file management utility for the Windows operating system and the default desktop environment. Windows explorer was introduced Continue reading Persistence Explorer
It is not uncommon developers or users responsible to write code (i.e. detection engineers using Sigma) to utilize Visual Studio Code as their code editor. Continue reading Persistence Visual Studio Code Extensions
Active Directory users that have the Kerberos pre-authentication enabled and require access to a resource initiate the Kerberos authentication process by sending an Authentication Server Continue reading AS-REP Roasting
When the Windows Operating system is installed via a clean installation or via an upgrade, the Windows Setup binary is executed. The Windows setup allows Continue reading Persistence Windows Setup Script
Disk Clean-up is a utility which is part of Windows operating systems and can free up hard drive disk space by deleting mainly cache and Continue reading Persistence Disk Clean-up
The Backup Operators is a Windows built-in group. Users which are part of this group have permissions to perform backup and restore operations. More specifically, Continue reading Domain Escalation Backup Operator
A lot of organizations have some sort of application development program and it is highly likely that developers will utilize Visual Studio for their development Continue reading Lateral Movement Visual Studio DTE
Windows Event logs are the main source of information for defensive security teams to identify threats and for administrators to troubleshoot errors. The logs are Continue reading Persistence Event Log