RFC - Offensive Security Notes
Ctrlk
  • Active Directory
    • Enumeration
    • Privilege Escalation
    • Persistence
  • Initial Access
    • VBA Macros
  • Discovery
    • Juicy files
    • Network Enumeration
  • Execution
    • WMI
    • PowerShell
    • C# .Net Assembly
    • ReverseShells
    • Metasploit
  • Exploitation
    • Win32 APIs
  • Credential Access
    • Microsoft Windows
      • Windows credential audit and logon types
      • Local credentials (SAM and LSA)
      • Lsass from forensics dump
      • Access Tokens
      • ntds.dit
      • Mimikatz
      • LAPS
  • Lateral Movement
    • Windows Lateral Movement
    • Linux Lateral Movement
  • Persistence
  • Defence Evasion
    • Antimalware Scan Interface (AMSI)
    • PowerShell
    • Microsoft Defender
    • Anti-virus evasion
    • AppLocker
  • Network Pivoting
    • Proxies and port fowarding
    • Network discovery and scanning
  • Exfiltration
    • Windows
  • Services
    • MS SQL Server
  • Misc
    • CrackMapExec
    • Cheat sheets
  • Cloud
    • Azure
Powered by GitBook
On this page
  1. Credential Access

Microsoft Windows

Windows credential audit and logon typesLocal credentials (SAM and LSA)Lsass from forensics dumpAccess Tokensntds.ditMimikatzLAPS
PreviousCreateRemoteThreadNextWindows credential audit and logon types

Last updated 1 year ago