Red Team Notes
Ctrlk
  • What is ired.team notes?
  • Pinned
    • Pentesting Cheatsheets
    • Active Directory & Kerberos Abuse
  • offensive security
    • Red Team Infrastructure
    • Initial Access
    • Code Execution
    • Code & Process Injection
    • Defense Evasion
    • Enumeration and Discovery
    • Privilege Escalation
    • Credential Access & Dumping
    • Lateral Movement
    • Persistence
      • DLL Proxying for Persistence
      • Schtask
      • Service Execution
      • Sticky Keys
      • Create Account
      • AddMonitor()
      • NetSh Helper DLL
      • Abusing Windows Managent Instrumentation
      • Windows Logon Helper
      • Hijacking Default File Extension
      • Persisting in svchost.exe with a Service DLL
      • Modifying .lnk Shortcuts
      • Screensaver Hijack
      • Application Shimming
      • BITS Jobs
      • COM Hijacking
      • SIP & Trust Provider Hijacking
      • Hijacking Time Providers
      • Installing Root Certificate
      • Powershell Profile Persistence
      • RID Hijacking
      • Word Library Add-Ins
      • Office Templates
    • Exfiltration
  • reversing, forensics & misc
    • Internals
    • Cloud
    • Neo4j
    • Dump Virtual Box Memory
    • AES Encryption Using Crypto++ .lib in Visual Studio C++
    • Reversing Password Checking Routine
Powered by GitBook
On this page
  1. offensive security

Persistence

DLL Proxying for PersistenceSchtaskService ExecutionSticky KeysCreate AccountAddMonitor()NetSh Helper DLLAbusing Windows Managent InstrumentationWindows Logon HelperHijacking Default File ExtensionPersisting in svchost.exe with a Service DLLModifying .lnk ShortcutsScreensaver HijackApplication ShimmingBITS JobsCOM HijackingSIP & Trust Provider HijackingHijacking Time ProvidersInstalling Root CertificatePowershell Profile PersistenceRID HijackingWord Library Add-InsOffice Templates
PreviousShadowMove: Lateral Movement by Duplicating Existing SocketsNextDLL Proxying for Persistence