📓
📓
📓
📓
Red Team Notes 2.0
Search…
📓
📓
📓
📓
Red Team Notes 2.0
Introduction
Red Team
Red Team Techniques
Initial Access
Execution
Persistence
Privilege Escalation
Defense Evasion
Credential Access
Discovery
Lateral Movement
T1080: Taint Shared Content
T1072: Software Deployment Tools
T1021: Remote Services
T1563: Remote Service Session Hijacking
T1570: Lateral Tool Transfer
T1534: Internal Spearphishing
T1210: Exploitation of Remote Services
T1550 Use Alternate Authentication Material
Active Directory
Active Directory
Active Directory Attacks
Red Team Infrastructure
RED TEAM INFRASTRUCTURE
Domain Name and Categorization
Reconnaissance
Weaponization
Delivery
Situational Awareness
Credential Dumping
Persistence
Defense Evasion
Privilege Escalation
Lateral Movement
Powered By GitBook
T1072: Software Deployment Tools
Adversaries may gain access to and use third-party software suites installed within an enterprise network, such as administration, monitoring, and deployment systems, to move laterally through the network. Third-party applications and software deployment systems may be in use in the network environment for administration purposes (e.g., SCCM, VNC, HBSS, Altiris, etc.).
Access to third-party network-wide or enterprise-wide software system may enable an adversary to have remote code execution on all systems that are connected to such a system. The access may be used to laterally move to other systems, gather information, or cause a specific effect, such as wiping the hard drives on all endpoints.
The permission required for this action vary by system configuration; local credentials may be sufficient with direct access to the third-party system, or specific domain credentials may be required. However, the system may require administrative account to log in or to perform it's intended purpose.
We have demonstrated this with VNC third party tool
Previous
T1080: Taint Shared Content
Next
T1021: Remote Services
Last modified 1yr ago
Copy link