Infiltr8: Red-Book

Infiltr8: Red-Book

Code & Process Injection

Loading .NET Reflective Assembly Loading .NET Assembly from Windows Script Hosting Process Hollowing WndProc Callback Shellcode Execution Fibers Shellcode Execution Vector Exception Handler Shellcode Execution NtQueueApcThread & NtTestAlert Shellcode Execution Thread Pool Callback Shellcode Execution Module Stomping Shellcode Injection Remote .NET Assembly Loading through WaaSRemediation DCOM Abuse DLL Injection CreateRemoteThread Injection Reflective DLL Injection NtMapViewOfSection Injection SetWindowHookEx Injection PoolParty MockingJay

Defense Evasion

Privilege Escalation

Credential Access

Lateral Movement

Red-TeamingExecution

Code & Process Injection

CreateRemoteThread InjectionWIP DLL InjectionWIP Loading .NET Assembly from Windows Script HostingMITRE ATT&CK™ Reflective Code Loading - Technique T1620 Loading .NET Reflective AssemblyMITRE ATT&CK™ Reflective Code Loading - Technique T1620 Fibers Shellcode Execution MockingJayWIP Module Stomping Shellcode Injection NtMapViewOfSection InjectionWIP NtQueueApcThread & NtTestAlert Shellcode Execution>-PoolPartyWIP Process HollowingMITRE ATT&CK™ Process Injection: Process Hollowing - Technique T1055.012 Reflective DLL InjectionWIP Remote .NET Assembly Loading through WaaSRemediation DCOM Abuse SetWindowHookEx InjectionWIP Thread Pool Callback Shellcode Execution Vector Exception Handler Shellcode Execution WndProc Callback Shellcode Execution

Execution

MITRE ATT&CK™ Execution - Tactic TA0002

Loading .NET Reflective Assembly

MITRE ATT&CK™ Reflective Code Loading - Technique T1620