Edit

Living Off the Land: Windows Post-Exploitation—With Tactical Context & Usage Guide

With Tactical Context & Usage Guide

📋 PHASE 1: INITIAL RECONNAISSANCE

System Information

🎯 What to Identify: OS version, architecture, domain membership, patch level 💡 How to Use: Determines available tools, privilege escalation vectors, and attack surface. Older systems may lack modern logging/protections.

# OS Information - Identify version for vulnerability research
Get-WmiObject -Class Win32_OperatingSystem | Select-Object Caption, Version, BuildNumber, OSArchitecture

# Domain Check - Determines if you can pivot to AD environment
(Get-WmiObject -Class Win32_ComputerSystem).PartOfDomain
(Get-WmiObject -Class Win32_ComputerSystem).Domain

# Current User Privileges - Shows what you can do without escalation
whoami /all
# Look for: Administrator group, SeDebugPrivilege, SeImpersonatePrivilege

Key Privileges to Note:

  • SeDebugPrivilege → Can dump LSASS memory for credentials

  • SeImpersonatePrivilege → Potential for privilege escalation (Potato attacks)

  • BUILTIN\Administrators → Full local system control

  • Domain Admins → Jackpot - domain-wide access

Local Enumeration

Local Users & Groups

🎯 What to Identify: Admin accounts, stale accounts, password age, enabled status 💡 How to Use: Target weak/old passwords, find privileged accounts, identify potential impersonation targets

What to Look For:

  • Default accounts still enabled (Administrator, Guest)

  • Service accounts in admin group (often have network access to other systems)

  • Users who haven't logged in recently but are enabled (abandoned accounts)

  • Passwords last set >365 days ago (likely weak or unchanged)

Running Processes & Services

🎯 What to Identify: Security products (EDR/AV), exploitable services, interesting applications 💡 How to Use: Understand what's monitoring you, find credential-rich processes, identify exploit targets

Unquoted Path Exploitation:

Service path: C:\Program Files\Vulnerable App\service.exe Windows tries: C:\Program.exe, then C:\Program Files\Vulnerable.exe, then the real path If you can write to C:\ → Place malicious Program.exe → Restart service → Code execution as SYSTEM

Security Products to Note:

  • CrowdStrike Falcon → Advanced EDR, monitors process injection, LSASS access

  • Carbon Black → Behavioural analysis, blocks known tools

  • Windows Defender → Basic protection, signature-based

  • SentinelOne → AI-based detection, monitors suspicious behaviour

Network Reconnaissance

🎯 What to Identify: Network topology, active connections, neighbouring systems, DNS servers 💡 How to Use: Map the network, identify lateral movement targets, understand network segmentation

Network Analysis Tips:

  • DNS servers = Domain Controllers in most environments → Primary targets

  • ARP cache entries = Recent communication = Safe lateral movement targets

  • Port 445 (SMB) connections = File shares (may contain sensitive data)

  • Port 1433 (SQL) connections = Database servers (credential goldmine)

  • Port 3389 (RDP) connections = Admin workstations or servers

Software Enumeration

🎯 What to Identify: Development tools, vulnerable software, credential-storing applications 💡 How to Use: Find applications that store credentials, identify outdated/vulnerable versions, understand user role

High-Value Applications:

  • Visual Studio / SQL Server Management Studio → Developer box = elevated access, database credentials

  • FileZilla / WinSCP → FTP credentials stored in config files

  • PuTTY / mRemoteNG → SSH/RDP credentials

  • VPN Clients → Network access credentials

  • Password Managers → Jackpot if you can crack the master password

  • Chrome / Firefox → Saved website credentials (can be extracted)

📋 PHASE 2: ACTIVE DIRECTORY ENUMERATION

PowerShell Method (Fast, Requires AD Module)

🎯 What to Identify: Domain structure, privileged users, domain controllers, trust relationships 💡 How to Use: Map AD environment, identify escalation paths, find high-value targets

AdminCount Explained:

  • When user is added to privileged group (Domain Admins, etc.), AdminCount is set to 1

  • Even if removed from group later, AdminCount stays 1

  • Useful: Find accounts that HAD privileges (may still have access)

ADSI Method (Works Everywhere, No Module Needed)

🎯 What to Identify: Same as above, but using built-in .NET classes 💡 How to Use: When ActiveDirectory PowerShell module isn't installed (common on workstations)

UserAccountControl Flags (Common Values):

  • 512 = Normal user account

  • 514 = Disabled account

  • 65536 = Password never expires

  • 32 = Password not required

  • 1.2.840.113556.1.4.803 = Bitwise AND operator for LDAP queries

Native Tools Method (Command Line, Zero PowerShell)

🎯 What to Identify: Same information using cmd.exe tools only 💡 How to Use: When PowerShell is restricted/monitored, use these ancient but effective tools

When to Use Native Tools:

  • PowerShell is disabled or heavily logged

  • PowerShell 2.0 environment (no script block logging)

  • Trying to avoid PowerShell-specific detection

  • Working from cmd.exe reverse shell

Remote System Enumeration (WMI)

🎯 What to Identify: Remote system info without logging in directly 💡 How to Use: Passive reconnaissance before lateral movement, identify vulnerable systems

WMI Reconnaissance Strategy:

  1. Query systems from ARP cache (low noise - already talking)

  2. Identify logged-in users (privileged accounts?)

  3. Check for security products (adjust tactics accordingly)

  4. Assess patch level (vulnerable to known exploits?)

  5. Plan lateral movement based on findings

📋 PHASE 3: CREDENTIAL HARVESTING

LSASS Memory Dump (High Value, High Risk)

🎯 What to Identify: Cached credentials in memory 💡 How to Use: Extract NTLM hashes, Kerberos tickets, cleartext passwords from memory

What You Get:

  • NTLM Hashes → Crack offline or use for pass-the-hash

  • Kerberos Tickets (TGT/TGS) → Pass-the-ticket attacks

  • Cleartext Passwords → If WDigest is enabled (rare on modern systems)

  • Service Account Passwords → Often reused across systems

OPSEC Warnings:

  • ⚠️ Many EDRs specifically monitor LSASS access

  • ⚠️ Event ID 10 (process access) will be logged

  • ⚠️ Sysmon logs LSASS access attempts

  • ✅ Time dumps during maintenance windows or high activity periods

Registry Credential Extraction (Persistent Credentials)

🎯 What to Identify: Local account hashes, cached domain credentials, LSA secrets 💡 How to Use: Extract credentials that persist even after users log off

What You Get:

  • SAM Hive → Local account NTLM hashes (Administrator, local users)

  • SECURITY Hive → Cached domain credentials (last 10 domain logons by default)

  • LSA Secrets → Service account passwords, auto-logon credentials, VPN passwords

Cached Domain Credentials (MS Cache v2):

  • Windows caches last 10 domain logins (configurable)

  • Allows login when DC is unreachable

  • Slower to crack than NTLM, but still crackable

  • hashcat -m 2100 for cracking

LSA Secrets Can Contain:

  • Service account passwords (stored in plaintext)

  • Auto-logon credentials

  • VPN connection passwords

  • Scheduled task credentials

File-Based Credential Search (Low Hanging Fruit)

🎯 What to Identify: Passwords stored in files, scripts, configs 💡 How to Use: Quick wins - admins often store passwords in plaintext

Common File Locations for Credentials:

PowerShell History (Goldmine)

🎯 What to Identify: Commands users have run (often includes passwords) 💡 How to Use: Admins frequently type credentials directly in PowerShell

What You Might Find:

Search Patterns:

  • ConvertTo-SecureString with -AsPlainText → Cleartext passwords

  • New-Object System.Management.Automation.PSCredential → Credential creation

  • net use commands → Network share credentials

  • Invoke-Command with -Credential → Remote execution creds

  • Database connection strings

Browser Credentials (Requires DPAPI Keys)

🎯 What to Identify: Saved website passwords 💡 How to Use: Extract and decrypt with user's DPAPI master key

Decryption Process:

  1. Extract Login Data database (SQLite)

  2. Obtain user's DPAPI master key (from LSASS dump or LSA secrets)

  3. Decrypt passwords using tools like SharpChrome or pypykatz

  4. Get cleartext credentials for saved websites

Common Saved Credentials:

  • Internal web applications

  • Cloud services (AWS, Azure, O365)

  • VPN portals

  • Network equipment web interfaces

Credential Manager (Windows Vault)

🎯 What to Identify: Saved Windows credentials 💡 How to Use: Network shares, RDP, scheduled tasks often save credentials here

Credential Manager Contents:

  • Saved RDP connections

  • Network share credentials (\\fileserver\share)

  • Windows Domain credentials

  • Generic credentials (applications can store here)

To Decrypt:

  • Requires user's DPAPI master key

  • Use mimikatz, pypykatz, or SharpDPAPI

  • Master key in LSASS dump or protected in user profile

Kerberoasting (Service Account Passwords)

🎯 What to Identify: Service accounts with weak passwords 💡 How to Use: Request service tickets, crack offline, no account lockout risk

Why Kerberoasting Works:

  1. Service tickets are encrypted with service account's password hash

  2. ANY domain user can request service tickets

  3. Crack the ticket offline → No account lockout

  4. Service accounts often have weak, old passwords

  5. Many have excessive privileges (Domain Admins)

Target Priority:

  • Old passwords (pwdlastset >1 year ago)

  • RC4 encryption (faster to crack than AES)

  • Accounts with "svc", "service", "sql" in the name

  • Accounts that are also in privileged groups

Common Service Accounts:

  • MSSQLSvc/* → SQL Server service accounts (often privileged)

  • HTTP/* → Web application pool accounts

  • FIMService → Forefront Identity Manager

  • Custom service accounts (svc_backup, svc_sharepoint)

📋 PHASE 4: LATERAL MOVEMENT

PowerShell Remoting (Modern, Stealthy)

🎯 What to Identify: Systems with WinRM enabled, valid credentials 💡 How to Use: Remote command execution that looks like legitimate IT administration

PowerShell Remoting Logs Created:

  • Source System: Event 4648 (explicit credential use)

  • Target System: Event 4624 (logon type 3 - network)

  • WinRM Logs: Microsoft-Windows-WinRM/Operational

  • PowerShell Logs: Event 4103/4104 if script block logging enabled

Double-Hop Problem:

You → System A (PSRemoting) → System B (Access Denied!)

Why? Credentials aren't passed to second hop by design

Solution: CredSSP (but requires configuration changes)

WMI Execution (Broad Compatibility)

🎯 What to Identify: Systems accessible via RPC/DCOM (port 135 + dynamic ports) 💡 How to Use: Command execution on systems without WinRM, works on older Windows

WMI Advantages:

  • Works on Windows 7, Server 2008, and older

  • No WinRM configuration required

  • Available by default in most environments

  • Uses standard DCOM (not often blocked)

WMI Disadvantages:

  • No direct command output (need file redirection)

  • Uses dynamic RPC ports (firewall challenges)

  • Event 4624 (logon type 3) logged

  • Less stealthy than PowerShell Remoting

Typical WMI Workflow:

  1. Execute command with output to file

  2. Wait a few seconds for completion

  3. Read file via C$ share

  4. Delete file to clean up

  5. Continue to next target

DCOM Execution (Less Common, Less Monitored)

🎯 What to Identify: Systems with DCOM enabled (default) 💡 How to Use: Stealthy execution through legitimate COM objects

Why DCOM is Stealthy:

  • Less commonly monitored than WMI/PSRemoting

  • Uses legitimate Windows components

  • Standard DCOM traffic (port 135)

  • Many security tools don't specifically watch for DCOM abuse

DCOM Challenges:

  • Requires admin credentials

  • No command output (like WMI)

  • COM objects may not be available on all systems

  • Some EDRs now monitor after public disclosure

When to Use DCOM:

  • WinRM is disabled/monitored

  • Want to avoid WMI detection

  • Target is Windows 10/Server 2016+

  • Need stealthy lateral movement

Scheduled Tasks (Persistence + Execution)

🎯 What to Identify: Remote task creation capabilities 💡 How to Use: Create tasks that execute commands immediately or on schedule

Scheduled Task Advantages:

  • Can run as SYSTEM (highest privileges)

  • Scheduled execution (run during off-hours)

  • Persistence mechanism

  • Works remotely

Detection Events:

  • Event ID 106: Task registered

  • Event ID 200: Task executed

  • Event ID 141: Task removed

OPSEC Tips:

  • Use names matching real Windows tasks

  • Schedule during legitimate maintenance windows

  • Clean up after execution

  • Avoid obviously malicious task names

Service-Based Movement

🎯 What to Identify: Service creation rights on remote systems 💡 How to Use: Execute code as SYSTEM through Windows services

Service Execution Challenges:

  • Problem: cmd.exe doesn't implement service interface

  • Result: Service starts, executes, but Windows reports failure

  • Impact: Command still executes, but error is logged

Better Service Execution:

Detection:

  • Event ID 7045: New service installed

  • Event ID 7036: Service state change

  • Service name/binary logged in Security event log

netsh Pivoting (Network Redirection)

🎯 What to Identify: Need to access internal services not directly reachable 💡 How to Use: Turn compromised host into network pivot point

Pivot Use Cases:

WiFi Credential Extraction:

Firewall Manipulation:

Why netsh is Powerful:

  • Native Windows tool (no uploads needed)

  • Port forwards persist across reboots

  • Legitimate administrative use (hard to detect abuse)

  • Works on all modern Windows versions

📋 PHASE 5: PERSISTENCE

Registry Run Keys (Classic, Well-Known)

🎯 What to Identify: Registry locations that execute on user logon 💡 How to Use: Simple persistence, but commonly monitored

Run Key Locations (Priority Order):

OPSEC Considerations:

  • ⚠️ Very well-known persistence method

  • ⚠️ Easily detected by autoruns tools

  • ⚠️ Commonly monitored by EDR

  • ✅ Use legitimate-looking names ("OneDriveUpdate", "GoogleUpdateCore")

  • ✅ Point to legitimate paths when possible

Startup Folder (Even More Obvious)

🎯 What to Identify: Folder where files execute on user logon 💡 How to Use: Simple to implement, but first place defenders check

Startup Folder Locations:

When to Use:

  • Quick and dirty persistence

  • Non-technical target (less likely to check)

  • Combined with other methods for redundancy

When NOT to Use:

  • Security-conscious environment

  • Any environment with competent defenders

  • When stealth is required

Scheduled Tasks (Flexible, Powerful)

🎯 What to Identify: Task Scheduler for timed/event-based execution 💡 How to Use: Most versatile persistence with fine-grained control

Real Windows Task Names to Mimic:

Task Trigger Options:

  • AtLogOn → User login (common, but monitored)

  • AtStartup → System boot (more privileged)

  • Daily/Weekly → Scheduled maintenance

  • OnIdle → When system is idle (stealthy)

  • OnEvent → Specific Windows events (advanced)

Hidden Task Setting:

WMI Event Subscriptions (Advanced, Stealthy)

🎯 What to Identify: WMI event triggers for code execution 💡 How to Use: Sophisticated persistence rarely checked by defenders

Alternative Triggers:

Enumerate Existing WMI Subscriptions:

Remove WMI Persistence:

Why WMI Persistence is Powerful:

  • Not visible in normal persistence locations

  • Most admins don't know how to check for it

  • Can trigger on complex system events

  • Persists across reboots

  • Requires admin to create, but very stealthy

📋 PHASE 6: DATA EXFILTRATION

PowerShell Web Upload (Fast, Encrypted)

🎯 What to Identify: Files to exfiltrate, C2 web server 💡 How to Use: HTTP/HTTPS upload using native PowerShell

OPSEC for Web Exfiltration:

  • ✅ Use HTTPS (encrypted, harder to inspect)

  • ✅ Throttle transfers (avoid bandwidth spikes)

  • ✅ Use during business hours (blend with normal traffic)

  • ✅ Chunk large files (avoid single large transfer)

  • ⚠️ Beware of SSL inspection (corporate proxies)

certutil (Microsoft-Signed Binary)

🎯 What to Identify: Need to transfer files using native tools 💡 How to Use: Abuse certificate utility for file operations

Certutil Exfiltration Technique:

Why Certutil:

  • Microsoft-signed binary (trusted)

  • Designed for certificate operations (legitimate)

  • Often whitelisted in application control

  • Less suspicious than PowerShell downloads

BITS (Background Intelligent Transfer)

🎯 What to Identify: Large files, need resumable transfers 💡 How to Use: Windows Update technology for stealthy file transfer

BITS Advantages:

  • Designed for large file transfers

  • Automatically resumes if interrupted

  • Throttles bandwidth (avoids network saturation)

  • Used by Windows Update (legitimate traffic)

  • Persistent across reboots

  • Low CPU/network priority by default

BITS Exfiltration Strategy:

  1. Create BITS job during business hours

  2. Set low priority (background transfer)

  3. Transfer large database dumps or file archives

  4. Monitor job status periodically

  5. Complete job when finished

  6. Clean up job artifacts

Detection:

  • BITS jobs logged in Windows Event Log

  • Unusual BITS destinations (external IPs)

  • Large transfers to non-Microsoft domains

SMB Exfiltration (Internal Networks)

🎯 What to Identify: SMB access to external/attacker-controlled server 💡 How to Use: File copy over SMB (looks like normal file sharing)

SMB Exfiltration Benefits:

  • Encrypted (SMBv3)

  • Normal corporate traffic

  • Fast transfers

  • Works across internal networks

  • Supports large files

Requirements:

  • Port 445 accessible to exfil server

  • SMB not blocked by firewall

  • Server with SMB share configured

DNS Exfiltration (Slow but Stealthy)

🎯 What to Identify: Need covert channel, DNS not inspected 💡 How to Use: Encode data in DNS queries (very hard to detect)

How DNS Exfiltration Works:

  1. Encode file as base64

  2. Split into small chunks (DNS label limit)

  3. Each chunk becomes a subdomain

  4. Query: chunk1.exfil.yourdomain.com

  5. Your DNS server logs the query

  6. Extract chunks from logs, reassemble file

DNS Exfiltration Characteristics:

  • Very Slow (DNS overhead is significant)

  • Very Stealthy (DNS queries are everywhere)

  • Rarely Blocked (can't block DNS)

  • Hard to Detect (need deep DNS inspection)

When to Use DNS:

  • High-security environment

  • Other protocols blocked/monitored

  • Small, high-value data (passwords, keys)

  • Time is not critical

Email Exfiltration (Hiding in Plain Sight)

🎯 What to Identify: Email access, legitimate reason to email externally 💡 How to Use: Send data as email attachments (very common activity)

Email Exfiltration Advantages:

  • Looks 100% legitimate

  • Uses user's actual email account

  • Normal business activity

  • Can send large attachments

  • Encrypted if using TLS

OPSEC for Email Exfil:

  • Use realistic subject lines

  • Send during business hours

  • Don't send to obvious attacker addresses

  • Spread across multiple emails if large

  • Use company nomenclature in subjects

Email Exfil Scenarios:

📋 BYPASSING APPLICATION WHITELISTING

MSBuild (Execute C# Code via XML)

🎯 What to Identify: MSBuild.exe location, need to execute arbitrary code 💡 How to Use: Compile and execute C# code inline without .exe files

Why MSBuild Bypasses Whitelisting:

  • Microsoft-signed binary (trusted)

  • Developers need it (can't block)

  • Designed to compile/execute code

  • Code compiles in memory (no .exe on disk)

  • Can execute any .NET code

What You Can Do with MSBuild:

  • Download and execute payloads

  • Full reverse shell implementation

  • Shellcode injection via P/Invoke

  • Registry/file manipulation

  • Credential harvesting

  • Anything C# can do

Regsvr32 (Remote Scriptlet Execution)

🎯 What to Identify: Regsvr32.exe (always present), web server for scriptlets 💡 How to Use: Execute JScript/VBScript from remote URLs

Regsvr32 Capabilities:

  • Execute JScript/VBScript

  • Download additional payloads

  • Create persistence mechanisms

  • File operations (read/write)

  • Registry manipulation

  • Network requests (HTTP/HTTPS)

  • Process execution

Detection Indicators:

  • Regsvr32 with /i:http:// parameter

  • Network connections from regsvr32.exe

  • Unusual parent process for regsvr32

  • Scrobj.dll parameter

Mshta (HTML Application Execution)

🎯 What to Identify: Mshta.exe (present on all Windows), HTA capabilities 💡 How to Use: Execute VBScript/JScript with full system access

Mshta Advantages:

  • Microsoft-signed binary

  • No sandbox (unlike browser)

  • Full ActiveX access

  • Can execute inline (no file needed)

  • Works on all Windows versions

Mshta Use Cases:

  • Initial access vector

  • Application whitelisting bypass

  • Fileless execution

  • Download and execute payloads

  • C2 client implementation

🛡️ OPERATIONAL SECURITY (OPSEC)

High-Risk Actions (Likely Alerts)

🎯 What to Avoid: Actions that trigger immediate detection 💡 Why They're Risky:

❌ Disabling Windows Defender/Firewall Completely

  • Event logs created immediately

  • Group Policy may revert changes

  • Obvious indicator of compromise

  • Better: Add specific exclusions or firewall rules

❌ Ping Sweeps of Entire Subnets

  • Every ping logged

  • Network monitoring sees scan pattern

  • Obvious reconnaissance activity

  • Better: Use ARP cache, passive enumeration

❌ Dumping LSASS in Monitored Environments

  • EDR specifically watches LSASS access

  • Event ID 10 (process access) logged

  • Sysmon alerts on LSASS access

  • Better: Time during maintenance windows, use alternative methods

❌ Creating Services with Suspicious Names

  • Event ID 7045 (new service) heavily monitored

  • Names like "backdoor" or "payload" obvious

  • Better: Mimic legitimate Windows service names

❌ Large Data Transfers in Single Bursts

  • DLP (Data Loss Prevention) alerts

  • Network anomaly detection

  • Bandwidth spikes visible

  • Better: Chunk data, throttle transfers, blend with normal traffic

❌ Executing from TEMP/Downloads Directories

  • Common malware behaviour

  • Application whitelisting often blocks these paths

  • EDR watches these directories closely

  • Better: Use legitimate Windows directories (C:\Windows\System32)

Lower-Risk Alternatives

🎯 What to Do Instead: Stealthier approaches 💡 How to Stay Under the Radar:

✅ Use Specific Firewall Rules Instead of Disabling netsh advfirewall firewall add rule name="Allow Port 4444" dir=in action=allow protocol=TCP localport=4444

  • Looks like legitimate firewall management

  • Less obvious than disabled firewall

  • Can be named like legitimate rules

✅ Use ARP Cache and Existing Connections for Recon Get-NetNeighbor Get-NetTCPConnection -State Established

  • Passive reconnaissance

  • No network scanning traffic

  • Systems already in communication = safe targets

✅ Time LSASS Dumps During Maintenance Windows

  • Blend with legitimate admin activity

  • During high system activity (masks in logs)

  • Off-hours when SOC staffing is lower

  • After system reboot (many processes access LSASS)

✅ Use Legitimate-Looking Service/Task Names Good: "WindowsUpdateService", "MicrosoftEdgeUpdateCore" Bad: "backdoor", "payload", "malware"

  • Mimic real Windows service names

  • Research actual services on target OS

✅ Chunk and Throttle Data Transfers for ($i = 0; $i -lt $data.Length; $i += 1MB) { # Send chunk Start-Sleep -Seconds 60 # Throttle }

  • Avoid bandwidth spikes

  • Blend with normal network traffic

  • Send during business hours

✅ Execute from Standard Windows Directories C:\Windows\System32 C:\Windows C:\Program Files\

  • Application whitelisting allows by default

  • Normal location for system processes

  • Less suspicious in logs

Cleanup Checklist

🎯 What to Remove: Artifacts left behind 💡 How to Cover Tracks:

Cleanup Priority:

  1. High Priority: Credential dumps, registry hives, sensitive files

  2. Medium Priority: Scheduled tasks, services, persistence mechanisms

  3. Low Priority: PowerShell history, temp files

  4. Avoid: Clearing event logs (very suspicious)

📚 DETECTION INDICATORS

Critical Event IDs

🎯 What Defenders Watch: Windows Event Log entries 💡 What They Mean:

Event ID 4688 - Process Creation Logged

Event ID 4624 - Successful Logon Logged

Event ID 4648 - Explicit Credential Use Logged

Event ID 4672 - Special Privileges Assigned Logged

Event ID 7045 - New Service Installed Logged

Event ID 106 - Scheduled Task Registered

Event ID 200 - Scheduled Task Executed Logged

Event ID 4103 - PowerShell Module Logging

Event ID 4104 - PowerShell Script Block Logging Logged

Suspicious Command-Line Patterns

🎯 What Triggers Alerts: Specific command patterns 💡 Why They're Suspicious:

🎯 QUICK WINS CHECKLIST

First 5 Minutes (Orient & Assess)

🎯 Goal: Understand where you are and what you have 💡 Actions:

Process Relationships to Monitor

🎯 What's Abnormal: Parent-child process patterns 💡 Suspicious Relationships:

✅ Normal Relationships (For Reference) explorer.exe → cmd.exe (user opened command prompt) svchost.exe → powershell.exe (legitimate system task) services.exe → service executable (normal service start)

First 15 Minutes (Low-Hanging Fruit)

🎯 Goal: Harvest easy credentials and understand environment 💡 Actions:

First Hour (Establish Foothold)

🎯 Goal: Secure access, escalate if possible, prepare for lateral movement 💡 Actions:

📖 ESSENTIAL REFERENCES

LOLBAS Project

  • URL: https://lolbas-project.github.io/

  • Use: Comprehensive database of Windows binaries that can be abused

  • When: Planning operations, finding alternative tools, bypassing controls

MITRE ATT&CK Framework

  • URL: https://attack.mitre.org/

  • Use: Understand tactics, techniques, and procedures (TTPs)

  • Sections: Execution, Persistence, Privilege Escalation, Defense Evasion, Credential Access, Discovery, Lateral Movement, Collection, Exfiltration

PowerShell Documentation

Windows Sysinternals

PreviousLiving Off the Land: Windows Post-ExploitationNextPost-Engagement

Last updated