✍️
Red Teaming Experiments
Ctrlk
  • What is this iRed.team?
  • Pinned
    • Pentesting Cheatsheets
    • Active Directory & Kerberos Abuse
  • offensive security
    • Red Team Infrastructure
    • Initial Access
    • Code Execution
    • Code & Process Injection
    • Defense Evasion
    • Enumeration and Discovery
    • Privilege Escalation
    • Credential Access & Dumping
    • Lateral Movement
    • Persistence
      • DLL Proxying for Persistence
      • T1053: Schtask
      • T1035: Service Execution
      • T1015: Sticky Keys
      • T1136: Create Account
      • T1013: AddMonitor()
      • T1128: NetSh Helper DLL
      • T1084: Abusing Windows Managent Instrumentation
      • Windows Logon Helper
      • Hijacking Default File Extension
      • Persisting in svchost.exe with a Service DLL
      • Modifying .lnk Shortcuts
      • T1180: Screensaver Hijack
      • T1138: Application Shimming
      • T1197: BITS Jobs
      • T1122: COM Hijacking
      • T1198: SIP & Trust Provider Hijacking
      • T1209: Hijacking Time Providers
      • T1130: Installing Root Certificate
      • Powershell Profile Persistence
      • RID Hijacking
      • Word Library Add-Ins
      • Office Templates
    • Exfiltration
  • reversing, forensics & misc
    • Windows Internals
    • Cloud
    • Neo4j
    • Dump Virtual Box Memory
    • AES Encryption Using Crypto++ .lib in Visual Studio C++
    • Reversing Password Checking Routine
Powered by GitBook
On this page

Was this helpful?

  1. offensive security

Persistence

DLL Proxying for PersistenceT1053: SchtaskT1035: Service ExecutionT1015: Sticky KeysT1136: Create AccountT1013: AddMonitor()T1128: NetSh Helper DLLT1084: Abusing Windows Managent InstrumentationWindows Logon HelperHijacking Default File ExtensionPersisting in svchost.exe with a Service DLLModifying .lnk ShortcutsT1180: Screensaver HijackT1138: Application ShimmingT1197: BITS JobsT1122: COM HijackingT1198: SIP & Trust Provider HijackingT1209: Hijacking Time ProvidersT1130: Installing Root CertificatePowershell Profile PersistenceRID HijackingWord Library Add-InsOffice Templates
PreviousShadowMove: Lateral Movement by Duplicating Existing SocketsNextDLL Proxying for Persistence

Last updated 4 years ago

Was this helpful?