Skip to content

Adversary Techniques

Attack techniques mapped to MITRE ATT&CK, each written the same way: how the attack works → attacker commands → affected Windows versions → artifacts left behind (host + network) → detection (Splunk/Zeek) → response and remediation by Windows version. Every page links back to the Windows, Network and Splunk sections where the underlying artifacts and queries live.

Start here for mixed-version environments

Hardening by Windows version is the cross-reference: every control from XP / 2003 to 11 / Server 2025 in one matrix, plus a technique → control map.

By ATT&CK tactic

Tactic Technique ATT&CK Page
Initial Access / Execution Phishing → user execution (macro, LNK, ISO, cradle) T1566, T1204 Phishing delivery
Execution / Defense Evasion PowerShell download cradles & encoded commands T1059.001 PowerShell cradles
Execution / Defense Evasion Signed binary proxy execution (mshta, regsvr32, certutil…) T1218, T1105 LOLBins
Credential Access LSASS memory dumping T1003.001 LSASS dumping
Credential Access SAM, LSA Secrets & NTDS.dit extraction T1003.002/.003/.004 SAM & NTDS
Credential Access DCSync T1003.006 DCSync
Credential Access Kerberoasting T1558.003 Kerberoasting
Credential Access AS-REP roasting T1558.004 AS-REP roasting
Credential Access / Persistence Golden, Silver tickets & Pass-the-Ticket T1558.001/.002, T1550.003 Golden & Silver tickets
Credential Access / Lateral Movement LLMNR/NBT-NS poisoning, NTLM relay, coercion T1557.001, T1187 LLMNR & NTLM relay
Credential Access / Priv Esc AD Certificate Services abuse (ESC1/ESC8) T1649 ADCS abuse
Lateral Movement / Defense Evasion Pass-the-Hash T1550.002 Pass-the-Hash
Lateral Movement / Execution PsExec & SMB admin shares T1021.002, T1569.002 PsExec & SMB
Lateral Movement / Execution WMI & WinRM remote execution T1047, T1021.006 WMI & WinRM
Initial Access / Lateral Movement RDP brute force, lateral RDP, session hijack T1021.001, T1133, T1563.002 RDP
Privilege Escalation UAC bypass T1548.002 UAC bypass
Privilege Escalation Token impersonation & Potato attacks T1134 Token & Potato
Defense Evasion / Priv Esc Process injection & hollowing T1055 Process injection
Defense Evasion Disabling AV/EDR/logging, BYOVD, log clearing T1562, T1070.001 Impair defenses
Persistence Services, scheduled tasks, Run keys T1543.003, T1053.005, T1547.001 Persistence
Lateral Movement (exploit) EternalBlue / SMBv1 (MS17-010) T1210 EternalBlue
Priv Esc / Lateral (exploit) PrintNightmare & Print Spooler T1068, T1210 PrintNightmare

A typical intrusion, in this section's pages

flowchart LR
    P[Phishing delivery] --> PS[PowerShell / LOLBins]
    EXT[Exposed RDP] --> H
    PS --> BEA[Beacon / C2<br/>process injection]
    BEA --> H[Foothold]
    H --> ESC[UAC bypass / Potato]
    ESC --> EV[Impair defenses]
    EV --> L[LSASS / SAM dumping]
    H -.no creds.-> REL[LLMNR / NTLM relay]
    H --> K[Kerberoast / AS-REP roast]
    REL --> ADCS[ADCS abuse]
    L --> PTH[Pass-the-Hash]
    PTH --> LM[PsExec / WMI / WinRM / RDP]
    K --> LM
    LM --> PER[Persistence]
    ADCS --> DOM[DCSync]
    LM --> DOM
    DOM --> GT[Golden ticket]
    GT --> OBJ[Objective / ransomware]
    PER -.-> BEA

Read left to right: a lure or exposed RDP gives a foothold, the operator elevates and blinds sensors, steals credentials (from memory, disk, Kerberos or the network), moves laterally, reaches a DC via DCSync, and forges tickets for persistence. Each box is a page; each arrow is a place to detect and contain.

Pages

How to use these pages in an investigation

Start from what you observed (a suspicious process, an alert, a beacon) and read the matching page's artifacts table to know what else to collect, then run its detection queries to scope how far it spread. The response section says what to contain and rotate, and the remediation by Windows version table says which fixes the affected hosts can actually take. For the underlying mechanics — what a given event ID means, how an artifact is parsed, the exact SPL commands — follow the links into Windows, Network and Splunk.

Adding a technique

python new.py adversary/<name> -t technique — the template already has the five-part structure. Add an Affected Windows versions section and a Remediation by Windows version table to match the pages above, then add a row to Hardening by version. It appears in the sidebar automatically.