mantvydasb/RedTeaming-Tactics-and-Techniques

Features

• Active Directory Exploitation - Offers detailed instructions for exploiting Kerberos, escalating domain privileges, and enumerating identity within Active Directory.
• Red Teaming Frameworks - Implements a comprehensive collection of red teaming primitives and adversary simulation techniques.
• Offensive Security Cheatsheets - Serves as a comprehensive reference of practical techniques for simulating adversary behavior and executing offensive operations.
• Windows Internals Research - Explains Windows kernel and system-level structures to help understand how attackers interact with the OS.
• Security Exploit Documentation - Provides technical documentation on manipulating kernel objects and bypassing antivirus for exploit development.
• Red Team and Offensive Security - Serves as a comprehensive knowledge base of offensive security tactics and technical guides for simulating adversary behavior.
• Data Exfiltration - Details methods and tools for moving sensitive data out of a compromised network.
• Domain Privilege Escalation - Leverages misconfigured ACLs and certificate templates to escalate privileges to Enterprise Admin.
• Exploitation and Malware - Provides detailed analysis of how malware utilizes Windows internals and APIs for execution and evasion.
• Lateral Movement - Moves across networks using administrative protocols and session hijacking to access remote systems.
• Penetration Testing - Implements comprehensive tactics for reconnaissance, lateral movement, and data exfiltration within networked environments.
• Red Teaming Tools - Provides guidance on deploying and managing the infrastructure required for red team operations.
• Kernel Internals Tutorials - Provides technical tutorials and research on kernel internals, memory management, and system call handling.
• Network Pivoting Tools - Ships techniques for using compromised systems as relays to access internal network resources.
• Credential Memory Dumping - Provides methods for extracting plaintext passwords and hashes directly from active process memory.
• Direct System Call Invocations - Implements direct system call invocations to bypass user-mode API hooks and security monitoring software.
• Offensive Kernel Drivers - Provides technical guides for developing kernel drivers to manipulate system internals and execute exploits.
• Kernel Object Manipulations - Provides techniques for modifying kernel objects to hide malicious processes and elevate system privileges.
• Process Space Injection - Implements mechanisms for loading DLLs into remote process address spaces via thread hijacking or hollowing.
• Service Boot Persistence - Implements persistence mechanisms by creating malicious services that automatically start during system boot.
• System-Call Interception - Implements IAT hooking to monitor and redirect system function calls for behavioral alteration.
• Persistence Mechanisms - Provides techniques for ensuring continued system access after reboots via backdoors and scheduled tasks.
• Active Directory Enumeration - Maps users, groups, and permissions within Active Directory to identify attack paths and misconfigurations.
• Antivirus Detection Bypasses - Uses API unhooking and direct syscalls to avoid detection by antivirus and security software.
• Cached Credential Extractions - Provides methods to extract and decrypt cached domain credentials to facilitate lateral movement.
• Command and Control Frameworks - Guides the use of platforms for managing remote agents and orchestrating adversary simulation tasks.
• Shellcode - Details the use of custom encoders and AES-CBC encryption to hide shellcode signatures from security software.
• Defense Evasion - Details methods for bypassing antivirus and system monitoring through API unhooking and payload obfuscation.
• Domain Persistence Techniques - Establishes long-term domain access by backdooring sensitive Active Directory objects like AdminSDHolder.
• Active Directory Credential Extraction - Implements Kerberoasting and AS-REP Roasting techniques to recover service account password hashes.
• Kerberos Ticket Forgers - Ships tools and guides for creating forged Golden and Silver Kerberos tickets for domain impersonation.
• Malware Analysis - Provides detailed guides for studying malware behavior and developing custom shellcode to interact with operating system internals.
• Capability Analyzers - Provides tools to analyze malware binaries and catalog capabilities such as data exfiltration and anti-analysis techniques.
• Memory Injection Techniques - Provides techniques for executing code directly in memory to bypass disk-based security controls.
• Domain Hash Exfiltration - Provides instructions for performing DCSync attacks to dump password hashes from Domain Controllers.
• Payload Obfuscators - Provides techniques to mask payloads and obfuscate command-line execution to evade antivirus and EDR detection.
• Kernel Privilege Escalations - Exploits kernel vulnerabilities to elevate permissions from a low-privileged user to root access.
• Windows Privilege Escalations - Executes DLL hijacking and token manipulation to elevate process privileges on Windows systems.
• Remote Code Execution Tools - Provides tools and methods for achieving and managing arbitrary code execution on remote target systems.
• Offensive Security Playbooks - Ships a practical playbook of techniques for lateral movement and persistence across enterprise networks.
• Kerberos Delegation Exploitation Techniques - Provides detailed techniques for exploiting Kerberos constrained and unconstrained delegation to impersonate privileged users.
• Shellcode Execution via Fibers - Implements fiber-based execution to run shellcode within local processes and evade API monitoring.
• Monitoring Evasion - Disables event logging and spoofs process identities to conceal activity from security defenders.
• Detection Evasion - Includes tactics for identifying security monitoring tools to maintain operational stealth on target hosts.
• PE File Utilities - Describes how to modify Portable Executable structures to inject binaries and backdoor executable files.
• System Object Enumeration - Identifies COM objects and scheduled tasks using stealthy methods to avoid command-line logging.
• Credential Cracking - Details the use of brute-force and dictionary attacks to recover plaintext passwords from hashes.
• Password Spraying Tools - Automates the testing of common passwords across multiple accounts to gain unauthorized access.
• Reconnaissance and OSINT - Provides methods for gathering open-source intelligence to map an organization's external attack surface.
• Service Enumeration Tools - Uses scanning tools to identify active hosts and open ports to discover running network services.
• Reverse Proxy Interceptors - Uses reverse proxy interceptors to capture authentication tokens by intercepting real-time HTTP traffic.
• Phishing Proxies - Ships techniques for using reverse proxies to intercept real-time traffic for credential harvesting.
• Executable Header Injections - Implements code injection by modifying the structural metadata of the executable file format.
• Adversary Artifact Analyses - Identifies forensic traces and footprints left on endpoints by specific attacking tools and malware techniques.
• Anti-Forensic Metadata Manipulations - Implements techniques to hide data and mislead forensics by manipulating file timestamps and alternate streams.
• SMB Hash Captures - Describes how to force target systems to send NetNTLMv2 hashes via rogue SMB servers.
• Directory Reconnaissance - Dumps the Global Address List from Outlook Web Access to map organizational structures.
• Living Off The Land Binaries - Uses signed system binaries to execute arbitrary code and bypass execution restrictions.
• Network Identity Discovery - Implements methods to discover hostnames and domain information using COM objects and RPC clients.
• Password Routine Analyses - Identifies password verification logic by observing register changes and execution flow during runtime debugging.
• DNS Payload Delivery - Implements methods for transferring and executing malicious code using DNS records.
• PowerShell Language Mode Bypasses - Provides techniques for bypassing PowerShell language mode constraints to execute restricted scripts.
• File-Based Execution Bypasses - Implements file-based execution bypasses to run unauthorized code by leveraging legitimate system tools.
• Infrastructure Provisioning - Provides instructions for automating the deployment of offensive security servers and proxy infrastructure.
• Phishing Attack Tools - Includes tools and guides for simulating phishing campaigns to trick users into executing payloads.
• Credential Interception - Provides methods for capturing plaintext passwords during authentication by hooking system functions.
• PE Header Parsing - Analyzes PE headers and memory execution flows to identify injected threads and payloads.
• PE Header Injections - Provides methods for inserting malicious code into legitimate binaries by modifying the Portable Executable header.
• Import Address Table Overwrites - Implements Import Address Table overwrites to redirect function calls to custom detour routines.
• Raw Registry Hive Parsing - Details the process of parsing raw registry hives to extract SAM hashes and LSA secrets.

Star history