Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are impacting your business
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration | 
|---|---|---|---|---|---|---|---|
| AdFind Advanced IP Scanner SharpShares SoftPerfect NetScan | AnyDesk Atera LogMeIn MobaXterm Syncro | Eraser GMER NSudo PowerTool | Mimikatz NirSoft Dialupass NirSoft IEPassView (iepv) NirSoft MailPassView NirSoft Netpass NirSoft RouterPassView | Brute Ratel C4 Cobalt Strike | Chisel Cloudflared OpenSSH | PsExec | RClone | 
No vulnerabilities exploited available.
| Initial Access | Execution | Persistence | Privilege Escalation | Defense Evasion | Discovery | Lateral Movement | Command and Control | Exfiltration | Impact | 
|---|---|---|---|---|---|---|---|---|---|
| Phishing: Spearphishing Attachment | Command and Scripting Interpreter: Windows Command Shell | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder | Domain Accounts | Obfuscated Files or Information: HTML Smuggling | Account Discovery: Local Account | Remote Services: SMB/Windows Admin Shares | Application Layer Protocol | Exfiltration Over Web Service: Exfiltration to Cloud Storage | Data Encrypted for Impact | 
| Command and Scripting Interpreter: PowerShell | Create or Modify System Process: Windows Service | Abuse Elevation Control Mechanism: Bypass User Account Control | Domain Accounts | Account Discovery: Domain Account | Use Alternate Authentication Material: Pass the Hash | Application Layer Protocol: Web Protocols | |||
| Process Injection | Domain Trust Discovery | Valid Accounts: Domain Accounts | |||||||
| Network Share Discovery | 
No negotiation chats available.
No IoCs available for this group.