Windows Unsigned DLL Side-Loading In Same Process Path
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Image File Execution Options Injection
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
DLL Side-Loading
Server Software Component, Exploit Public-Facing Application, External Remote Services
Server Software Component, Exploit Public-Facing Application, External Remote Services
Cloud Account
RDP Hijacking, Remote Service Session Hijacking, Windows Service
Unix Shell Configuration Modification, Event Triggered Execution
Unix Shell Configuration Modification, Event Triggered Execution
RC Scripts, Boot or Logon Initialization Scripts
RC Scripts, Boot or Logon Initialization Scripts
Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service
Exploit Public-Facing Application, External Remote Services
Services Registry Permissions Weakness
Create or Modify System Process, Windows Service
Create or Modify System Process, Windows Service
Port Monitors, Boot or Logon Autostart Execution
Port Monitors, Boot or Logon Autostart Execution
Cloud Account
Pre-OS Boot, Registry Run Keys / Startup Folder
Pre-OS Boot, Registry Run Keys / Startup Folder
Cloud Groups, Account Manipulation, Permission Groups Discovery
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Systemd Timers, Scheduled Task/Job
Systemd Timers, Scheduled Task/Job
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Multi-Factor Authentication Request Generation, Valid Accounts, Brute Force
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Additional Cloud Roles
Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Account Manipulation
Modify Authentication Process, Multi-Factor Authentication
Modify Authentication Process, Multi-Factor Authentication
Exploit Public-Facing Application, External Remote Services
Cloud Account, Create Account
Cloud Account, Create Account
Exploit Public-Facing Application, External Remote Services
Valid Accounts, Brute Force
Scheduled Task/Job
Exploit Public-Facing Application, External Remote Services
Scheduled Task/Job, Scheduled Task
Scheduled Task/Job, Scheduled Task
Account Manipulation
Container Orchestration Job
Security Support Provider, Boot or Logon Autostart Execution
Security Support Provider, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Scheduled Task/Job
Active Setup, Boot or Logon Autostart Execution
Active Setup, Boot or Logon Autostart Execution
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Account Manipulation
Exploit Public-Facing Application, External Remote Services
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Systemd Timers, Scheduled Task/Job
Systemd Timers, Scheduled Task/Job
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services
DLL Side-Loading, Boot or Logon Autostart Execution
DLL Side-Loading, Boot or Logon Autostart Execution
Cron, Scheduled Task/Job
Cron, Scheduled Task/Job
Server Software Component, IIS Components
Server Software Component, IIS Components
Cloud Account, Create Account
Cloud Account, Create Account
Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service
Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter, External Remote Services
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Cron, Scheduled Task/Job
Cron, Scheduled Task/Job
Valid Accounts
Web Shell, External Remote Services
Web Shell, External Remote Services
Exploit Public-Facing Application, External Remote Services
Account Manipulation
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Valid Accounts, Domain Accounts
Valid Accounts, Domain Accounts
Account Manipulation, Additional Email Delegate Permissions
Account Manipulation, Additional Email Delegate Permissions
Exploit Public-Facing Application, External Remote Services
Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication
Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication
Valid Accounts
Scheduled Task/Job, Scheduled Task
Scheduled Task/Job, Scheduled Task
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Server Software Component, IIS Components
Server Software Component, IIS Components
At, Scheduled Task/Job
At, Scheduled Task/Job
Compromise Host Software Binary
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Event Triggered Execution, Accessibility Features
Event Triggered Execution, Accessibility Features
Cron, Scheduled Task/Job
Cron, Scheduled Task/Job
Windows Management Instrumentation Event Subscription
Account Manipulation, Device Registration
Account Manipulation, Device Registration
Create Account, Cloud Account
Create Account, Cloud Account
SSH Authorized Keys, Account Manipulation
SSH Authorized Keys, Account Manipulation
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Scheduled Task/Job, At
Scheduled Task/Job, At
Account Manipulation
Account Manipulation
Valid Accounts, Cloud Accounts
Valid Accounts, Cloud Accounts
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts
Valid Accounts
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Exploit Public-Facing Application, External Remote Services
Local Account, Create Account
Local Account, Create Account
Account Manipulation, Additional Email Delegate Permissions
Account Manipulation, Additional Email Delegate Permissions
Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication
Compromise Accounts, Cloud Accounts, Modify Authentication Process, Multi-Factor Authentication
Valid Accounts
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Valid Accounts
Account Manipulation
Exploit Public-Facing Application, External Remote Services
Account Manipulation
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication
Server Software Component, IIS Components
Server Software Component, IIS Components
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Launch Agent, Create or Modify System Process
Launch Agent, Create or Modify System Process
Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration
Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration
Windows Service, Create or Modify System Process
Windows Service, Create or Modify System Process
Component Object Model Hijacking, Command and Scripting Interpreter, PowerShell
BITS Jobs
Create or Modify System Process, Windows Service
Create or Modify System Process, Windows Service
Change Default File Association, Event Triggered Execution
Change Default File Association, Event Triggered Execution
Exploit Public-Facing Application, External Remote Services
Cloud Account
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services
Server Software Component, Web Shell, Exploit Public-Facing Application, External Remote Services
Cloud Accounts
Account Manipulation, Valid Accounts
Account Manipulation, Valid Accounts
Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration
Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration
Exploit Public-Facing Application, External Remote Services
Valid Accounts
Ingress Tool Transfer, Exploit Public-Facing Application, Command and Scripting Interpreter, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Valid Accounts, Cloud Accounts
Valid Accounts, Cloud Accounts
Create or Modify System Process
Windows Service, Create or Modify System Process
Windows Service, Create or Modify System Process
TFTP Boot, Pre-OS Boot
TFTP Boot, Pre-OS Boot
Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...
Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
At, Scheduled Task/Job
At, Scheduled Task/Job
Create or Modify System Process, Windows Service
Create or Modify System Process, Windows Service
Scheduled Task
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Valid Accounts, Local Accounts
Valid Accounts, Local Accounts
Valid Accounts
BITS Jobs, Ingress Tool Transfer
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Kernel Modules and Extensions
Compromise Host Software Binary
Scheduled Task/Job, Scheduled Task
Scheduled Task/Job, Scheduled Task
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Valid Accounts, Cloud Accounts
Server Software Component, Web Shell
Server Software Component, Web Shell
Account Manipulation, Valid Accounts
Account Manipulation, Valid Accounts
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
Command and Scripting Interpreter, Windows Command Shell, Windows Service, Create or Modify System Process
Scheduled Task, PowerShell, Command and Scripting Interpreter
External Remote Services, Exploit Public-Facing Application, Exploitation of Remote Services, Exploitation for Privilege Escalation
Path Interception by Unquoted Path, Hijack Execution Flow
Path Interception by Unquoted Path, Hijack Execution Flow
Valid Accounts, Domain Accounts
Valid Accounts, Domain Accounts
Cron, Scheduled Task/Job
Cron, Scheduled Task/Job
Cloud Account, Create Account
Cloud Account, Create Account
Exploit Public-Facing Application, External Remote Services
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Registry Run Keys / Startup Folder, Boot or Logon Autostart Execution
Application Shimming, Event Triggered Execution
Application Shimming, Event Triggered Execution
Modify Authentication Process
Local Account, Create Account
Local Account, Create Account
Valid Accounts
System Information Discovery, External Remote Services
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Image File Execution Options Injection, Event Triggered Execution
Image File Execution Options Injection, Event Triggered Execution
Component Object Model Hijacking, Event Triggered Execution
Component Object Model Hijacking, Event Triggered Execution
Account Manipulation
Windows Service
Additional Cloud Roles
Exploit Public-Facing Application, External Remote Services
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Modify Authentication Process, Multi-Factor Authentication
Modify Authentication Process, Multi-Factor Authentication
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Process Injection, Create or Modify System Process, Parent PID Spoofing, Access Token Manipulation
Systemd Timers, Scheduled Task/Job
Systemd Timers, Scheduled Task/Job
Application Shimming, Event Triggered Execution
Application Shimming, Event Triggered Execution
DLL Search Order Hijacking, DLL Side-Loading, Hijack Execution Flow
DLL Search Order Hijacking, DLL Side-Loading, Hijack Execution Flow
DLL Search Order Hijacking, DLL Side-Loading, Hijack Execution Flow
Cron, Scheduled Task/Job
Cron, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Services Registry Permissions Weakness, Hijack Execution Flow
Services Registry Permissions Weakness, Hijack Execution Flow
Modify Authentication Process
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Scheduled Task
Valid Accounts
Change Default File Association, Event Triggered Execution
Change Default File Association, Event Triggered Execution
BITS Jobs
Domain Accounts, Permission Groups Discovery
Valid Accounts, Domain Accounts
Valid Accounts, Domain Accounts
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
DLL Side-Loading
Cloud Account, Create Account
Cloud Account, Create Account
Domain or Tenant Policy Modification, Group Policy Modification, Domain Accounts
Windows Service, Create or Modify System Process
Windows Service, Create or Modify System Process
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Valid Accounts
Exploit Public-Facing Application, External Remote Services
Launch Agent, Create or Modify System Process
Launch Agent, Create or Modify System Process
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Valid Accounts, Domain Accounts
Valid Accounts, Domain Accounts
Exploit Public-Facing Application, External Remote Services
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Unix Shell Configuration Modification, Event Triggered Execution
Unix Shell Configuration Modification, Event Triggered Execution
Cloud Account, Create Account
Cloud Account, Create Account
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Scheduled Task
Server Software Component, Web Shell
Server Software Component, Web Shell
Account Manipulation, Device Registration
Account Manipulation, Device Registration
Valid Accounts, Default Accounts, Modify Authentication Process
Valid Accounts, Default Accounts, Modify Authentication Process
Valid Accounts, Default Accounts, Modify Authentication Process
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
SSH Authorized Keys, Account Manipulation
SSH Authorized Keys, Account Manipulation
Local Account, Create Account
Local Account, Create Account
DLL Search Order Hijacking, Hijack Execution Flow
DLL Search Order Hijacking, Hijack Execution Flow
Scheduled Task/Job
Valid Accounts
Scheduled Task/Job
System Firmware, Pre-OS Boot
System Firmware, Pre-OS Boot
Account Manipulation, Device Registration
Account Manipulation, Device Registration
Server Software Component, IIS Components
Server Software Component, IIS Components
Create or Modify System Process, Windows Service
Create or Modify System Process, Windows Service
Kernel Modules and Extensions, Boot or Logon Autostart Execution
Kernel Modules and Extensions, Boot or Logon Autostart Execution
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication
Compromise Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation, Modify Authentication Process, Multi-Factor Authentication
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Web Shell, Server Software Component, Exploit Public-Facing Application, External Remote Services
Account Manipulation, Additional Email Delegate Permissions
Account Manipulation, Additional Email Delegate Permissions
Valid Accounts
Kernel Modules and Extensions, Boot or Logon Autostart Execution
Kernel Modules and Extensions, Boot or Logon Autostart Execution
Cron, Scheduled Task/Job
Cron, Scheduled Task/Job
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Windows Management Instrumentation Event Subscription, Event Triggered Execution
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Scheduled Task, Command and Scripting Interpreter
Dynamic Linker Hijacking, Hijack Execution Flow
Dynamic Linker Hijacking, Hijack Execution Flow
Local Account, Create Account
Local Account, Create Account
Valid Accounts
Server Software Component, IIS Components
Server Software Component, IIS Components
Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles
Remote Email Collection, Email Collection, Account Manipulation, Additional Cloud Roles
Print Processors, Boot or Logon Autostart Execution
Print Processors, Boot or Logon Autostart Execution
Account Manipulation, Additional Email Delegate Permissions
Account Manipulation, Additional Email Delegate Permissions
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Create or Modify System Process, Windows Service
Create or Modify System Process, Windows Service
Scheduled Task/Job, Scheduled Task
Scheduled Task/Job, Scheduled Task
Valid Accounts, Default Accounts
Valid Accounts, Default Accounts
Modify Authentication Process, Multi-Factor Authentication
Modify Authentication Process, Multi-Factor Authentication
Exploit Public-Facing Application, External Remote Services
Cloud Account
Kernel Modules and Extensions, Service Execution
Time Providers, Boot or Logon Autostart Execution
Time Providers, Boot or Logon Autostart Execution
Event Triggered Execution, Screensaver
Event Triggered Execution, Screensaver
Modify Authentication Process, Multi-Factor Authentication
Modify Authentication Process, Multi-Factor Authentication
Cloud Account
Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation
Windows Service, Create or Modify System Process, Exploitation for Privilege Escalation
Event Triggered Execution
Scheduled Task, Impair Defenses
SSH Authorized Keys
Account Manipulation, Additional Cloud Roles
Account Manipulation, Additional Cloud Roles
Account Manipulation
Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service
Additional Email Delegate Permissions, Additional Cloud Roles
Additional Email Delegate Permissions, Additional Cloud Roles
Exploit Public-Facing Application, External Remote Services
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts
Account Manipulation, Additional Cloud Credentials
Account Manipulation, Additional Cloud Credentials
Create or Modify System Process
Valid Accounts
Valid Accounts
Account Manipulation, Valid Accounts
Account Manipulation, Valid Accounts
Exploit Public-Facing Application, External Remote Services
Server Software Component, IIS Components
Server Software Component, IIS Components
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Cloud Account, Create Account
Cloud Account, Create Account
Disable Windows Event Logging, Impair Defenses, Server Software Component, IIS Components
Disable Windows Event Logging, Impair Defenses, Server Software Component, IIS Components
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
DLL Search Order Hijacking
Account Manipulation, Additional Cloud Credentials
Account Manipulation, Additional Cloud Credentials
Modify Authentication Process
Valid Accounts, Default Accounts
Valid Accounts, Default Accounts
Cloud Account
Exploit Public-Facing Application, External Remote Services
Account Manipulation
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Local Account, Create Account
Local Account, Create Account
Kernel Modules and Extensions, Boot or Logon Autostart Execution
Kernel Modules and Extensions, Boot or Logon Autostart Execution
Valid Accounts
Command and Scripting Interpreter, Exploit Public-Facing Application, External Remote Services
DLL Search Order Hijacking, Hijack Execution Flow
DLL Search Order Hijacking, Hijack Execution Flow
Account Manipulation
Local Accounts, Credentials In Files
Network Share Discovery, Valid Accounts
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Compromise Accounts, Cloud Accounts, Valid Accounts, Cloud Accounts, Multi-Factor Authentication Request Generation
Exploit Public-Facing Application, External Remote Services
Create Account, Cloud Account
Create Account, Cloud Account
Scheduled Task, Scheduled Task/Job
Scheduled Task, Scheduled Task/Job
Additional Email Delegate Permissions, Additional Cloud Roles
Additional Email Delegate Permissions, Additional Cloud Roles
DLL Side-Loading, Hijack Execution Flow
DLL Side-Loading, Hijack Execution Flow
Boot or Logon Initialization Scripts, Logon Script (Windows)
Boot or Logon Initialization Scripts, Logon Script (Windows)
Create or Modify System Process, Windows Service
Create or Modify System Process, Windows Service
Cloud Accounts, Valid Accounts
Cloud Accounts, Valid Accounts
Windows Service
Component Object Model Hijacking, Event Triggered Execution, PowerShell
Component Object Model Hijacking, Event Triggered Execution, PowerShell
Valid Accounts, Cloud Accounts
Valid Accounts, Cloud Accounts
Application Shimming, Event Triggered Execution
Application Shimming, Event Triggered Execution
Exploit Public-Facing Application, External Remote Services
Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration
Multi-Factor Authentication Request Generation, Multi-Factor Authentication, Device Registration
Windows Service, Create or Modify System Process
Windows Service, Create or Modify System Process
Impair Defenses, Disable Windows Event Logging, Server Software Component, IIS Components
Impair Defenses, Disable Windows Event Logging, Server Software Component, IIS Components
IIS Components, Server Software Component
IIS Components, Server Software Component
Password Spraying, Valid Accounts, Default Accounts
Password Spraying, Valid Accounts, Default Accounts
Account Manipulation
Cloud Groups, Account Manipulation, Permission Groups Discovery
Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service
Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...
Remote Services, Distributed Component Object Model, Windows Remote Management, Windows Management Instrumentation, Scheduled Task, Windows Service, PowerShe...
Remote Services, SMB/Windows Admin Shares, Distributed Component Object Model, Windows Management Instrumentation, Windows Service
Account Manipulation
DLL Search Order Hijacking, Hijack Execution Flow
DLL Search Order Hijacking, Hijack Execution Flow
Local Account, Create Account
Local Account, Create Account
Local Account, Create Account
Local Account, Create Account
Account Manipulation, Impair Defenses
Account Manipulation, Impair Defenses
Windows Service
Valid Accounts, Default Accounts, Credential Stuffing
Valid Accounts, Default Accounts, Credential Stuffing
Valid Accounts, Default Accounts, Password Spraying
Valid Accounts, Default Accounts, Password Spraying
Component Object Model Hijacking, Event Triggered Execution
Component Object Model Hijacking, Event Triggered Execution
Valid Accounts, Default Accounts
Valid Accounts, Default Accounts
Valid Accounts, Default Accounts
Valid Accounts, Default Accounts
Valid Accounts
BITS Jobs, Ingress Tool Transfer
BITS Jobs, Ingress Tool Transfer
BITS Jobs
Service Stop, Valid Accounts
Service Stop, Create or Modify System Process, Windows Service
Service Stop, Create or Modify System Process, Windows Service
Remote Email Collection, Email Collection, Additional Email Delegate Permissions, Account Manipulation
Remote Email Collection, Email Collection, Additional Email Delegate Permissions, Account Manipulation
Valid Accounts
Valid Accounts
Valid Accounts
Change Default File Association
Cloud Accounts
Cloud Accounts
Cloud Accounts
Cloud Accounts
Cloud Accounts
Cloud Accounts
Cloud Accounts
Cloud Accounts
Cloud Accounts
Scheduled Task
Create Account
Valid Accounts
Cloud Accounts
Cloud Accounts
Domain Accounts