✍️
Red Teaming Experiments
search
⌘Ctrlk
✍️
Red Teaming Experiments
  • What is this iRed.team?
  • Pinned
    • Pentesting Cheatsheets
    • Active Directory & Kerberos Abuse
  • offensive security
    • Red Team Infrastructure
    • Initial Access
    • Code Execution
    • Code & Process Injection
    • Defense Evasion
    • Enumeration and Discovery
    • Privilege Escalation
    • Credential Access & Dumping
    • Lateral Movement
    • Persistence
      • DLL Proxying for Persistence
      • T1053: Schtask
      • T1035: Service Execution
      • T1015: Sticky Keys
      • T1136: Create Account
      • T1013: AddMonitor()
      • T1128: NetSh Helper DLL
      • T1084: Abusing Windows Managent Instrumentation
      • Windows Logon Helper
      • Hijacking Default File Extension
      • Persisting in svchost.exe with a Service DLL
      • Modifying .lnk Shortcuts
      • T1180: Screensaver Hijack
      • T1138: Application Shimming
      • T1197: BITS Jobs
      • T1122: COM Hijacking
      • T1198: SIP & Trust Provider Hijacking
      • T1209: Hijacking Time Providers
      • T1130: Installing Root Certificate
      • Powershell Profile Persistence
      • RID Hijacking
      • Word Library Add-Ins
      • Office Templates
    • Exfiltration
  • reversing, forensics & misc
    • Windows Internals
    • Cloud
    • Neo4j
    • Dump Virtual Box Memory
    • AES Encryption Using Crypto++ .lib in Visual Studio C++
    • Reversing Password Checking Routine
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. offensive security

Persistence

DLL Proxying for Persistencechevron-rightT1053: Schtaskchevron-rightT1035: Service Executionchevron-rightT1015: Sticky Keyschevron-rightT1136: Create Accountchevron-rightT1013: AddMonitor()chevron-rightT1128: NetSh Helper DLLchevron-rightT1084: Abusing Windows Managent Instrumentationchevron-rightWindows Logon Helperchevron-rightHijacking Default File Extensionchevron-rightPersisting in svchost.exe with a Service DLLchevron-rightModifying .lnk Shortcutschevron-rightT1180: Screensaver Hijackchevron-rightT1138: Application Shimmingchevron-rightT1197: BITS Jobschevron-rightT1122: COM Hijackingchevron-rightT1198: SIP & Trust Provider Hijackingchevron-rightT1209: Hijacking Time Providerschevron-rightT1130: Installing Root Certificatechevron-rightPowershell Profile Persistencechevron-rightRID Hijackingchevron-rightWord Library Add-Inschevron-rightOffice Templateschevron-right
PreviousShadowMove: Lateral Movement by Duplicating Existing Socketschevron-leftNextDLL Proxying for Persistencechevron-right

Last updated 4 years ago