Red Team Notes
search
⌘Ctrlk
Red Team Notes
  • What is ired.team notes?
  • Pinned
    • Pentesting Cheatsheets
    • Active Directory & Kerberos Abuse
  • offensive security
    • Red Team Infrastructure
    • Initial Access
    • Code Execution
    • Code & Process Injection
    • Defense Evasion
    • Enumeration and Discovery
    • Privilege Escalation
    • Credential Access & Dumping
    • Lateral Movement
    • Persistence
      • DLL Proxying for Persistence
      • Schtask
      • Service Execution
      • Sticky Keys
      • Create Account
      • AddMonitor()
      • NetSh Helper DLL
      • Abusing Windows Managent Instrumentation
      • Windows Logon Helper
      • Hijacking Default File Extension
      • Persisting in svchost.exe with a Service DLL
      • Modifying .lnk Shortcuts
      • Screensaver Hijack
      • Application Shimming
      • BITS Jobs
      • COM Hijacking
      • SIP & Trust Provider Hijacking
      • Hijacking Time Providers
      • Installing Root Certificate
      • Powershell Profile Persistence
      • RID Hijacking
      • Word Library Add-Ins
      • Office Templates
    • Exfiltration
  • reversing, forensics & misc
    • Internals
    • Cloud
    • Neo4j
    • Dump Virtual Box Memory
    • AES Encryption Using Crypto++ .lib in Visual Studio C++
    • Reversing Password Checking Routine
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. offensive security

Persistence

DLL Proxying for Persistencechevron-rightSchtaskchevron-rightService Executionchevron-rightSticky Keyschevron-rightCreate Accountchevron-rightAddMonitor()chevron-rightNetSh Helper DLLchevron-rightAbusing Windows Managent Instrumentationchevron-rightWindows Logon Helperchevron-rightHijacking Default File Extensionchevron-rightPersisting in svchost.exe with a Service DLLchevron-rightModifying .lnk Shortcutschevron-rightScreensaver Hijackchevron-rightApplication Shimmingchevron-rightBITS Jobschevron-rightCOM Hijackingchevron-rightSIP & Trust Provider Hijackingchevron-rightHijacking Time Providerschevron-rightInstalling Root Certificatechevron-rightPowershell Profile Persistencechevron-rightRID Hijackingchevron-rightWord Library Add-Inschevron-rightOffice Templateschevron-right
PreviousShadowMove: Lateral Movement by Duplicating Existing Socketschevron-leftNextDLL Proxying for Persistencechevron-right