RFC - Offensive Security Notes
search
Ctrlk
RFC - Offensive Security Notes
  • Active Directory
    • Enumeration
    • Privilege Escalation
    • Persistence
  • Initial Access
    • VBA Macros
  • Discovery
    • Juicy files
    • Network Enumeration
  • Execution
    • WMI
    • PowerShell
    • C# .Net Assembly
    • ReverseShells
    • Metasploit
  • Exploitation
    • Win32 APIs
  • Credential Access
    • Microsoft Windows
      • Windows credential audit and logon types
      • Local credentials (SAM and LSA)
      • Lsass from forensics dump
      • Access Tokens
      • ntds.dit
      • Mimikatz
      • LAPS
  • Lateral Movement
    • Windows Lateral Movement
    • Linux Lateral Movement
  • Persistence
  • Defence Evasion
    • Antimalware Scan Interface (AMSI)
    • PowerShell
    • Microsoft Defender
    • Anti-virus evasion
    • AppLocker
  • Network Pivoting
    • Proxies and port fowarding
    • Network discovery and scanning
  • Exfiltration
    • Windows
  • Services
    • MS SQL Server
  • Misc
    • CrackMapExec
    • Cheat sheets
  • Cloud
    • Azure
gitbookPowered by GitBook
block-quoteOn this pagechevron-down
  1. Credential Access

Microsoft Windows

Windows credential audit and logon typeschevron-rightLocal credentials (SAM and LSA)chevron-rightLsass from forensics dumpchevron-rightAccess Tokenschevron-rightntds.ditchevron-rightMimikatzchevron-rightLAPSchevron-right
PreviousCreateRemoteThreadchevron-leftNextWindows credential audit and logon typeschevron-right

Last updated 1 year ago