Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration | 
|---|---|---|---|---|---|---|---|
| 
                
                  
                     AdFind 
                  
                  
                    Bloodhound 
                  
                  
                    PowerView 
                  
                  
                    PSNmap 
                  
                  
                    SoftPerfect NetScan 
                  
                  
                     | 
            
              
              
                
                  
                     AnyDesk 
                  
                  
                    Atera 
                  
                  
                    NetSupport 
                  
                  
                    ScreenConnect 
                  
                  
                    Splashtop 
                  
                  
                    Supremo 
                  
                  
                
               | 
            
              
              
                
                  
                     Backstab (Process Explorer driver) 
                  
                  
                     | 
            
              
              
                
                  
                     Mimikatz 
                  
                  
                     | 
            
              
              
                
                  
                     Brute Ratel C4 
                  
                  
                    Cobalt Strike 
                  
                  
                    Metasploit 
                  
                  
                    PowerSploit 
                  
                  
                     | 
            
              
              
                
                  
                    
                  
                  
                     | 
            
              
              
                
                  
                     BITSAdmin 
                  
                  
                    PsExec 
                  
                  
                    Quick Assist 
                  
                  
                     | 
            
              
              
                
                  
                     Qaz[.]im 
                  
                  
                    RClone 
                  
                  
                     | 
            
          
| Vendor | Product | CVE | Source | 
|---|---|---|---|
| ConnectWise | ScreenConnect | CVE-2024-1709, CVE-2024-1709 | cisa.gov | 
| VMware | ESXi | CVE-2024-37085 | microsoft.com | 
| Windows | Windows Error Reporting Service | CVE-2024-26169 | www.security.com | 
| Windows | MSDT | CVE-2022-30190 | sentinelone.com / trendmicro.com | 
| Windows | Active Directory | CVE-2021-42278, CVE-2021-42287 | cisa.gov | 
| Windows | Print Spooler | CVE-2021-1675, CVE-2021-34527 | cisa.gov | 
| Windows | NetLogon | CVE-2020-1472 | cisa.gov | 
| Initial Access | Execution | Persistence | Privilege Escalation | 
|---|---|---|---|
| Phishing: Spear phishing Attachment | System Services: Service Execution | Create Account | Domain Policy Modification: Group Policy Modification | 
| Windows Management Instrumentation | Account Manipulation | Hijack Execution Flow: DLL Search Order Hijacking | |
| Command and Scripting Interpreter: PowerShell | Create or Modify System Process: Windows Service | Create or Modify System Process: Windows Service | |
| Hijack Execution Flow: DLL Search Order Hijacking | 
No IoCs available for this group.