Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business
Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
---|---|---|---|---|---|---|---|
AdFind
Bloodhound
PowerView
PSNmap
SoftPerfect NetScan
|
AnyDesk
Atera
NetSupport
ScreenConnect
Splashtop
Supremo
|
Backstab (Process Explorer driver)
|
Mimikatz
|
Brute Ratel C4
Cobalt Strike
Metasploit
PowerSploit
|
|
BITSAdmin
PsExec
Quick Assist
|
Qaz[.]im
RClone
|
Vendor | Product | CVE | Source |
---|---|---|---|
ConnectWise | ScreenConnect | CVE-2024-1709, CVE-2024-1709 | cisa.gov |
VMware | ESXi | CVE-2024-37085 | microsoft.com |
Windows | Windows Error Reporting Service | CVE-2024-26169 | www.security.com |
Windows | MSDT | CVE-2022-30190 | sentinelone.com / trendmicro.com |
Windows | Active Directory | CVE-2021-42278, CVE-2021-42287 | cisa.gov |
Windows | Print Spooler | CVE-2021-1675, CVE-2021-34527 | cisa.gov |
Windows | NetLogon | CVE-2020-1472 | cisa.gov |
Initial Access | Execution | Persistence | Privilege Escalation |
---|---|---|---|
Phishing: Spear phishing Attachment | System Services: Service Execution | Create Account | Domain Policy Modification: Group Policy Modification |
Windows Management Instrumentation | Account Manipulation | Hijack Execution Flow: DLL Search Order Hijacking | |
Command and Scripting Interpreter: PowerShell | Create or Modify System Process: Windows Service | Create or Modify System Process: Windows Service | |
Hijack Execution Flow: DLL Search Order Hijacking |
No IoCs available for this group.