'psexec' 검색 결과

Execute commands and binaries on remote Windows systems utilizing PsExec and SMB/RPC mechanisms. This skill details the mechanics behind tools like Sysinternals PsExec, Impacket's psexec.py, and their role in lateral movement via hidden administrative shares.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Investigate attackers moving between internal systems by correlating login records with network traffic. Supports detection rules, suspicious SMB and RDP activity analysis, and reports showing attack timelines, affected hosts, and monitoring gaps.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating attacker movement across internal systems
• Creating rules for suspicious authentication patterns
• Tracing affected hosts after a PsExec alert

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Assess Active Directory security by mapping accounts, permissions, and paths to administrative access. The skill covers credential misuse, certificate service misconfigurations, movement between systems, and hybrid identity environments involving Entra ID.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Mapping paths to administrative access in Active Directory
• Reviewing ADCS certificate service configurations
• Assessing permissions, delegation, and group policies

Review lateral movement, the ways access spreads between systems, during authorized security tests. Covers credential reuse, remote execution, network tunnels, prerequisites, and the logs or defensive controls associated with each technique.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare lateral movement methods for an internal penetration test
• Plan tunnels across segmented networks
• Review detection logs and controls for lateral movement

Windows lateral movement playbook. Use when pivoting between Windows hosts via PsExec, WMI, WinRM, DCOM, RDP, pass-the-hash, overpass-the-hash, or pass-the-ticket techniques.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Exploit Active Directory environments using Pass-the-Hash (PtH). This skill details how to authenticate to remote systems using the NTLM hash of a user's password instead of the plaintext password, enabling lateral movement and privilege escalation without cracking hashes.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Execute a complete Active Directory penetration test from initial enumeration to domain dominance. Use this skill for AD security assessments including LDAP enumeration, Kerberos attacks (Kerberoasting, AS-REP roasting), BloodHound attack path analysis, credential dumping with Mimikatz, lateral movement via PsExec/WMI/DCOM, DCSync for NTDS extraction, and Golden/Silver ticket forging. Covers the full kill chain from domain user to domain admin.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Hunts for lateral movement via remote service creation, admin share writes, and remote WMI process creation by correlating Windows logon, service install, and process-creation events. Activates for requests to hunt lateral movement, detect PsExec/WMIexec activity, or find remote execution over SMB and WMI.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive lateral movement tradecraft for authorized red team engagements covering credential-based movement (pass-the-hash, pass-the-ticket, overpass-the-hash), NTLM relay attacks (ntlmrelayx with PetitPotam, DFSCoerce, PrinterBug coercion), remote execution protocols (WMI, WinRM, DCOM, PsExec and alternatives), RDP session hijacking, and network pivoting through tunneling tools (chisel, ligolo-ng, SSH tunnels, SOCKS proxies). Provides operator-ready command sequences for mimikatz, crackmapexec/netexec, impacket suite, and evil-winrm with emphasis on OPSEC considerations, SMB signing bypass, and detection evasion. Maps to MITRE ATT&CK T1021 (Remote Services), T1550 (Use Alternate Authentication Material), and sub-techniques. Includes defender-perspective detection guidance for blue team awareness and a rapid engagement cheatsheet for common lateral movement scenarios encountered during internal penetration tests and assumed-breach exercises.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Active Directory attack methodology for internal network red team engagements. Covers reconnaissance (BloodHound, PowerView, ADExplorer), credential abuse (Kerberoasting, ASREProasting, NTLM relay, LLMNR/NBT-NS poisoning), privilege escalation (ACL abuse, GPO abuse, unconstrained/constrained delegation), lateral movement (Pass-the-Hash, Pass-the-Ticket, Overpass-the-Hash, WMI/WinRM/PsExec), persistence (Golden/Silver/Diamond Tickets, DCSync, DCShadow, AdminSDHolder, Skeleton Key), forest trust attacks, ADCS abuse (ESC1-ESC15), and modern MDI/Defender for Identity evasion. Use when assessing on-prem AD, hybrid AD/Entra ID environments, or ADCS deployments.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.