# Red Team Notes

## Red Team Notes

- [Introduction](https://dmcxblue.gitbook.io/red-team-notes/master.md): Red Team notes
- [Red Team Notes 2.0](https://dmcxblue.gitbook.io/red-team-notes/red-team-notes-2.0.md): Updates Notes!!
- [Red Team](https://dmcxblue.gitbook.io/red-team-notes/red-team.md): The offensive side
- [Initial Access](https://dmcxblue.gitbook.io/red-team-notes/initial-acces.md): The adversary is trying to get into your network.
- [Spear Phishing Links](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing-links.md): The use of Links attached to the email or sent in plain text to confuse the victim on to clicking and avoiding Email providers scanners.
- [HTA Files](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing-links/tools.md): Microsoft HTML Applications (HTA)
- [Binaries](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing-links/binaries.md): The use of binaries has highly decreased but this is still a good example on how User's download EXE files and give access to attackers
- [PDF Files](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing-links/pdf.md): These will just be simple PDF files with a link on the Document, I will add a Link that when click will send the user to a controlled server
- [SET(Social-Engineering Toolkit)](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing-links/set-social-engineering-toolkit.md): A social engineering framework frequently used for the gather of credentials or user execution access. I am using this Framework to automate most of the job to setup a Phishing Page
- [Spear Phishing Attachments](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing.md): The use of attaching a malicious file onto an Email.
- [Macros](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing/macros.md): Macro are series of instructions to automate tasks a scripting language helping adversaries to automate various attacks.
- [Dynamic Data Exchange](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing/macroless.md): ID: T1173 Tactic: Execution
- [SCR Files](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing/scr-files.md): SCR files are screensaver files use by Windows for energy saving purposes. I will create simply binaries and changing the extension from EXE to SCR.
- [LNK Files](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/spear-phishing/lnk-files.md): Also known as Shortcuts
- [(+) Links and Attachments](https://dmcxblue.gitbook.io/red-team-notes/initial-acces/untitled-3.md): An approach to better understand this technique at a deeper level
- [Execution](https://dmcxblue.gitbook.io/red-team-notes/execution.md): The adversary is trying to run malicious code.
- [Component Object Model and Distributed COM](https://dmcxblue.gitbook.io/red-team-notes/execution/com.md): ID: T1175 Tactic: Lateral Movement, Execution
- [MSHTA](https://dmcxblue.gitbook.io/red-team-notes/execution/mshta.md): Microsoft HTML Applications
- [PowerShell](https://dmcxblue.gitbook.io/red-team-notes/execution/powershell.md): PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.
- [Rundll32](https://dmcxblue.gitbook.io/red-team-notes/execution/untitled.md): This program can be called to execute an arbitrary binary. This can be taking in as an advantage to avoid triggering security tools.
- [Scheduled Tasks](https://dmcxblue.gitbook.io/red-team-notes/execution/scheduled-tasks.md): ID: T1053 Tactic: Execution, Persistence, Privilege Escalation
- [Scripting](https://dmcxblue.gitbook.io/red-team-notes/execution/untitled-1.md): ID: T1064 Tactic: Defense Evasion, Execution
- [Trusted Developer Utilities](https://dmcxblue.gitbook.io/red-team-notes/execution/trusted-developer-utilities.md): ID: T1127 Tactic: Defense Evasion, Execution
- [MSBuild](https://dmcxblue.gitbook.io/red-team-notes/execution/trusted-developer-utilities/msbuild.md): A trusted Windows signed binary.
- [Regsvr32](https://dmcxblue.gitbook.io/red-team-notes/execution/trusted-developer-utilities/regsvr32.md): ID: T1117 Tactic: Defense Evasion, Execution
- [Windows Remote Management](https://dmcxblue.gitbook.io/red-team-notes/execution/windows-remote-management.md): ID: T1028 Tactic: Execution, Lateral Movement
- [Windows Management Instrumentation (WMI)](https://dmcxblue.gitbook.io/red-team-notes/execution/windows-management-instrumentation-wmi.md): ID: T1047 Tactic: Execution
- [Persistence](https://dmcxblue.gitbook.io/red-team-notes/persistence.md): The adversary is trying to maintain their foothold
- [Scheduled Tasks](https://dmcxblue.gitbook.io/red-team-notes/persistence/scheduled-tasks.md): ID: T1053 Tactic: Execution, Persistence, Privilege Escalation
- [Create Account](https://dmcxblue.gitbook.io/red-team-notes/persistence/create-account.md): ID: T1136 Tactic: Persistence
- [DLL Search Order Hijacking](https://dmcxblue.gitbook.io/red-team-notes/persistence/dll-search-order-hijacking.md): ID: T1038 Tactic: Persistence, Privilege Escalation, Defense Evasion
- [Hooking](https://dmcxblue.gitbook.io/red-team-notes/persistence/hooking.md): ID: T1179 Tactic: Persistence, Privilege Escalation, Credential Access
- [Logon Scripts](https://dmcxblue.gitbook.io/red-team-notes/persistence/logon-scripts.md): ID: T1037 Tactic: Lateral Movement, Persistence
- [Modify Existing Service](https://dmcxblue.gitbook.io/red-team-notes/persistence/modify-existing-service.md): ID: T1031 Tactic: Persistence
- [New Service](https://dmcxblue.gitbook.io/red-team-notes/persistence/new-service.md): ID: T1050 Tactic: Persistence, Privilege Escalation
- [Path Interception](https://dmcxblue.gitbook.io/red-team-notes/persistence/path-interception.md): ID: T1034 Tactic: Persistence, Privilege Escalation
- [Registry Keys / StartUp Folder](https://dmcxblue.gitbook.io/red-team-notes/persistence/registry-keys-startup-folder.md): ID: T1060 Tactic: Persistence
- [ShortCut Modification](https://dmcxblue.gitbook.io/red-team-notes/persistence/shortcut-modification.md): ID: T1023 Tactic: Persistence
- [Privesc](https://dmcxblue.gitbook.io/red-team-notes/privesc.md): The adversary is trying to gain higher-level permissions.
- [Access Token Manipulation](https://dmcxblue.gitbook.io/red-team-notes/privesc/access-token-manipulation.md): ID: T1134 Tactic: Defense Evasion, Privilege Escalation
- [DLL Search Order Hijacking](https://dmcxblue.gitbook.io/red-team-notes/privesc/dll-search-order-hijacking.md)
- [Exploitation for Privesc](https://dmcxblue.gitbook.io/red-team-notes/privesc/exploitation-for-privesc.md): ID: T1068 Tactic: Privilege Escalation
- [File System Permissions Weakness](https://dmcxblue.gitbook.io/red-team-notes/privesc/file-system-permissions-weakness.md): ID: T1044 Tactic: Persistence, Privilege Escalation
- [Always Install Elevated](https://dmcxblue.gitbook.io/red-team-notes/privesc/unquoted-service-path.md): A functionality that allows a regular user to install MSI files with high privileges.
- [Defense Evasion](https://dmcxblue.gitbook.io/red-team-notes/untitled.md): The adversary is trying to avoid being detected.
- [Credential Access](https://dmcxblue.gitbook.io/red-team-notes/untitled-1.md): The adversary is trying to steal account names and passwords.
- [Credential Dumping](https://dmcxblue.gitbook.io/red-team-notes/untitled-1/credential-dumping.md): ID: T1003 Tactic: Credential Access
- [Kerberoasting](https://dmcxblue.gitbook.io/red-team-notes/untitled-1/kerberoasting.md): ID: T1208 Tactic: Credential Access
- [LLMNR/NBT-NS Poisoning and Relay](https://dmcxblue.gitbook.io/red-team-notes/untitled-1/llmnr-nbt-ns-poisoning-and-relay.md): ID: T1171 Tactic: Credential Access
- [Discovery](https://dmcxblue.gitbook.io/red-team-notes/untitled-2.md): The adversary is trying to figure out your environment.
- [Lateral Movement](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement.md): The adversary is trying to move through your environment
- [Pass the Ticket](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/pass-the-ticket.md): ID: T1097 Tactic: Lateral Movement
- [Pass the Hash](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/pass-the-hash.md): ID: T1075 Tactic: Lateral Movement
- [Remote Desktops](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/remote-desktops.md): ID: T1076 Tactic: Lateral Movement
- [Internal Spearphishing](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/internal-spearphishing.md): ID: T1534 Tactic: Lateral Movement
- [Windows Admin Shares](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/untitled.md): ID: T1077 Tactic: Lateral Movement
- [Component Object Model and Distributed COM](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/component-object-model-and-distributed-com.md): ID: T1175 Tactic: Lateral Movement, Execution
- [Windows Remote Management](https://dmcxblue.gitbook.io/red-team-notes/lateral-movement/windows-remote-management.md): ID: T1028 Tactic: Execution, Lateral Movement
- [Collection](https://dmcxblue.gitbook.io/red-team-notes/collection.md)
- [Command and Control](https://dmcxblue.gitbook.io/red-team-notes/command-and-control.md)
- [Exfiltration](https://dmcxblue.gitbook.io/red-team-notes/exfiltration.md)
- [Impact](https://dmcxblue.gitbook.io/red-team-notes/impact.md)
- [Introduction](https://dmcxblue.gitbook.io/red-team-notes/active-directory/introduction.md)
- [Kerberos](https://dmcxblue.gitbook.io/red-team-notes/active-directory/introduction/kerberos.md): A computer-network authentication protocol that works on the basis of tickets.
- [LDAP](https://dmcxblue.gitbook.io/red-team-notes/active-directory/introduction/ldap.md): Lightweight Directory Access Protocol
- [Enumeration](https://dmcxblue.gitbook.io/red-team-notes/active-directory/enumeration.md): Techniques used to Discover interesting stuff in the Active Directory.
- [Attacks](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled.md): Some Techniques used to gain any form of Access, Code Execution, Privesc, Persistence or Info in General.
- [Unconstrained Delegation](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled/untitled-3.md)
- [Constrained Delegation](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled/untitled-2.md)
- [DCSync](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled/untitled-1.md)
- [Kerberoasting](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled/untitled.md)
- [Silver Tickets](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled/silver-tickets.md)
- [Golden Tickets](https://dmcxblue.gitbook.io/red-team-notes/active-directory/untitled/golden-tickets.md)
- [Detection](https://dmcxblue.gitbook.io/red-team-notes/detection/untitled.md): Blue Team (Sort Of)
- [Initial Access](https://dmcxblue.gitbook.io/red-team-notes/detection/initial-access.md): The Adversary is trying to gain access to your Network
- [Execution](https://dmcxblue.gitbook.io/red-team-notes/detection/execution.md): The adversary is trying to run malicious code
- [MSHTA (Detection)](https://dmcxblue.gitbook.io/red-team-notes/detection/execution/mshta-detection.md): Microsoft HTML Application
- [References & Resources](https://dmcxblue.gitbook.io/red-team-notes/resources-and-references/untitled.md): Some of the places I looked for and want to see in the future.