mthcht-ThreatHunting-Keywords/Lateral_Movement_category_detection.csv at main

mirror of https://github.com/mthcht/ThreatHunting-Keywords synced 2026-06-08 16:12:28 +00:00

Files

T

mthcht 755048bf5e Mars and April 2025 update

very few additions and some corrections

2025-04-24 05:55:50 +02:00

1019 KiB

Raw Permalink Blame History

1	keyword	metadata_keyword_regex	metadata_keyword_type	metadata_tool	metadata_description	metadata_tool_techniques	metadata_tool_tactics	metadata_malwares_name	metadata_groups_name	metadata_category	metadata_link	metadata_enable_endpoint_detection	metadata_enable_proxy_detection	metadata_tags	metadata_comment	metadata_severity_score	metadata_popularity_score	metadata_github_stars	metadata_github_forks	metadata_github_updated_at	metadata_github_created_at	metadata_entry_id
2	* .exe -addgroupmember -victim * -target *	.{0,1000}\s\.exe\s\-addgroupmember\s\-victim\s.{0,1000}\s\-target\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	30
3	* .exe -chp -victim * -target *	.{0,1000}\s\.exe\s\-chp\s\-victim\s.{0,1000}\s\-target\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	31
4	* .exe -laps -victim * -target * -clsid *	.{0,1000}\s\.exe\s\-laps\s\-victim\s.{0,1000}\s\-target\s.{0,1000}\s\-clsid\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	32
5	* .exe -ldapwhoami -victim * -target * -clsid *	.{0,1000}\s\.exe\s\-ldapwhoami\s\-victim\s.{0,1000}\s\-target\s.{0,1000}\s\-clsid\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	33
6	* .exe -rbcd -victim * -target * -clsid *	.{0,1000}\s\.exe\s\-rbcd\s\-victim\s.{0,1000}\s\-target\s.{0,1000}\s\-clsid\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	34
7	* /Q /C >1 \\127.0.01\ADMIN$\__*	.{0,1000}\s\/Q\s\/C\s\>1\s\\\\127\.0\.01\\ADMIN\$\\__.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	92
8	* \\\\localhost /user:Username /pwd:Password \"C:\\InstallMe.bat*	.{0,1000}\s\\\\\\\\localhost\s\/user\:Username\s\/pwd\:Password\s\s\\\"C\:\\\\InstallMe\.bat.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	131
9	* > \\127.0.0.1\ADMIN$\__16* 2>&1*	.{0,1000}\s\>\s\\\\127\.0\.0\.1\\ADMIN\$\\__16.{0,1000}\s2\>\&1.{0,1000}	offensive_tool_keyword	wmiexec	potential wmiexec commandline pattern	T1021.005 - T1047 - T1059.001 - T1059.003 - T1059.005	TA0008 - TA0002 - TA0011	N/A	Dispossessor - HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/rapid7/metasploit-framework/blob/2722067108b5c034da9f77b95eaf1c1db33db4fa/modules/auxiliary/scanner/smb/impacket/wmiexec.py#L127	1	0	N/A	N/A	7	10	35400	14272	2025-04-22T20:14:59Z	2011-08-30T06:13:20Z	145
10	* > \\127.0.0.1\ADMIN$\__17* 2>&1*	.{0,1000}\s\>\s\\\\127\.0\.0\.1\\ADMIN\$\\__17.{0,1000}\s2\>\&1.{0,1000}	offensive_tool_keyword	wmiexec	potential wmiexec commandline pattern	T1021.005 - T1047 - T1059.001 - T1059.003 - T1059.005	TA0008 - TA0002 - TA0011	N/A	Dispossessor - HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/rapid7/metasploit-framework/blob/2722067108b5c034da9f77b95eaf1c1db33db4fa/modules/auxiliary/scanner/smb/impacket/wmiexec.py#L127	1	0	N/A	N/A	7	10	35400	14272	2025-04-22T20:14:59Z	2011-08-30T06:13:20Z	146
11	* -accepteula -nobanner -d cmd.exe /c *	.{0,1000}\s\-accepteula\s\-nobanner\s\-d\scmd\.exe\s\/c\s.{0,1000}	greyware_tool_keyword	psexec	Adversaries may place the PsExec executable in the temp directory and execute it from there as part of their offensive activities. By doing so. they can leverage PsExec to execute commands or launch processes on remote systems. enabling Lateral Movement. privilege escalation. or the execution of malicious payloads.	T1136.002 - T1543.003 - T1570 - T1021.002 - T1569.002	TA0002 - TA0008 - TA0009 - TA0011	N/A	Turla - Chimera - APT1 - Thrip - Moses Staff - BlackTech - Cleaver - DarkVishnya - Sandworm Team - HAFNIUM - Akira - APT39 - FIN5 - FIN6 - Indrik Spider - TEMP.Veles - Kimsuky - GALLIUM - APT29 - Carbanak - Leafminer - FIN8 - Fox Kitten - Dragonfly - Magic Hound - OilRig - Cobalt Group - Naikon - Threat Group-1314 - menuPass - Wizard Spider - ALLANITE - APT20 - APT27 - Antlion - BOSS SPIDER - Common Raven - ENERGETIC BEAR - FIN7 - GOBLIN PANDA - PowerPool - INDRIK SPIDER - WIZARD SPIDER - TINY SPIDER - TA2101 - TRAVELING SPIDER - Common Raven - Antlion - Scattered Spider - COZY BEAR - EMBER BEAR - BERSERK BEAR - Gamaredon - Dispossessor	Lateral Movement	https://learn.microsoft.com/fr-fr/sysinternals/downloads/psexec	1	0	N/A	greyware tool - risks of False positive !	10	10	N/A	N/A	N/A	N/A	178
12	* advfirewall firewall add rule * dir=in protocol=tcp localport=3389 action=allow*	.{0,1000}\sadvfirewall\sfirewall\sadd\srule\s.{0,1000}\sdir\=in\sprotocol\=tcp\slocalport\=3389\saction\=allow.{0,1000}	greyware_tool_keyword	netsh	Opens port 3389 for RDP inbound access through the firewall	T1021.001 - T1562.004	TA0008 - TA0005	N/A	N/A	Lateral Movement	N/A	1	0	N/A	N/A	8	8	N/A	N/A	N/A	N/A	240
13	* --am-si-bypass=*	.{0,1000}\s\-\-am\-si\-bypass\=.{0,1000}	offensive_tool_keyword	CheeseTools	tools for Lateral Movement/Code Execution	T1021.006 - T1059.003 - T1105	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/klezVirus/CheeseTools	1	0	N/A	N/A	10	8	706	143	2021-08-17T20:22:56Z	2020-08-24T01:28:12Z	264
14	* atexec-pro.py*	.{0,1000}\satexec\-pro\.py.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	0	N/A	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	302
15	* -bindPipe * -destHost * -destPort *	.{0,1000}\s\-bindPipe\s.{0,1000}\s\-destHost\s.{0,1000}\s\-destPort\s.{0,1000}	offensive_tool_keyword	invoke-piper	Forward local or remote tcp ports through SMB pipes.	T1003.001 - T1048 - T1021.002 - T1021.001 - T1090	TA0002 -TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/p3nt4/Invoke-Piper	1	0	N/A	N/A	N/A	3	295	51	2021-03-07T19:07:01Z	2017-08-03T08:06:44Z	392
16	* --blockDLLs --ruy-lopez*	.{0,1000}\s\-\-blockDLLs\s\-\-ruy\-lopez.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10	1	N/A	N/A	N/A	N/A	410
17	* --bruteforce-range *	.{0,1000}\s\-\-bruteforce\-range\s.{0,1000}	offensive_tool_keyword	SCCMSecrets	SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting - initial access and lateral movement.	T1555 - T1078 - T1070 - T1021	TA0006 - TA0008 - TA0001	N/A	N/A	Lateral Movement	https://github.com/synacktiv/SCCMSecrets	1	0	N/A	N/A	8	3	208	22	2024-12-17T14:29:39Z	2024-08-14T09:45:44Z	467
18	* -brute-opnums *	.{0,1000}\s\-brute\-opnums\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	469
19	* -brute-uuids *	.{0,1000}\s\-brute\-uuids\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	474
20	* -c * -s * -o share_listing -m 150*	.{0,1000}\s\-c\s.{0,1000}\s\-s\s.{0,1000}\s\-o\sshare_listing\s\-m\s150.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	493
21	* -c active_users -u *	.{0,1000}\s\-c\sactive_users\s\-u\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	498
22	* -c command_exec --execute tasklist*	.{0,1000}\s\-c\scommand_exec\s\-\-execute\stasklist.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	500
23	* -c command_exec --execute whoami*	.{0,1000}\s\-c\scommand_exec\s\-\-execute\swhoami.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	501
24	* -c edr_query *	.{0,1000}\s\-c\sedr_query\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	504
25	* -c logon_events * -u *	.{0,1000}\s\-c\slogon_events\s.{0,1000}\s\-u\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	509
26	* -c ls --directory * -u * -p *	.{0,1000}\s\-c\sls\s\-\-directory\s.{0,1000}\s\-u\s.{0,1000}\s\-p\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	510
27	* -c process_kill --process *	.{0,1000}\s\-c\sprocess_kill\s\-\-process\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	511
28	* -c service_mod --execute create -s *	.{0,1000}\s\-c\sservice_mod\s\-\-execute\screate\s\-s\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	513
29	* -c upload --fileto * --file *	.{0,1000}\s\-c\supload\s\-\-fileto\s.{0,1000}\s\-\-file\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	514
30	* -c vacant_system * -u *	.{0,1000}\s\-c\svacant_system\s.{0,1000}\s\-u\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	515
31	* ccmpwn.py*	.{0,1000}\sccmpwn\.py.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	553
32	* CIMplant.exe*	.{0,1000}\sCIMplant\.exe.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	586
33	* CSExec.py*	.{0,1000}\sCSExec\.py.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				744
34	* -csrc C:\\Windows\\notepad.exe -c cmd.exe*	.{0,1000}\s\-csrc\sC\:\\\\Windows\\\\notepad\.exe\s\-c\scmd\.exe.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	746
35	* dacledit.py*	.{0,1000}\sdacledit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	774
36	* -dc-ip * -computer-pass *	.{0,1000}\s\-dc\-ip\s.{0,1000}\s\-computer\-pass\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	788
37	* -dc-ip * -impersonate *	.{0,1000}\s\-dc\-ip\s.{0,1000}\s\-impersonate\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	790
38	* -dc-ip * -so *	.{0,1000}\s\-dc\-ip\s.{0,1000}\s\s\-so\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	792
39	* -dc-ip * -target-ip *	.{0,1000}\s\-dc\-ip\s.{0,1000}\s\-target\-ip\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	793
40	* diagrun=true service=DNS* dllpath=.dll computername=*	.{0,1000}\sdiagrun\=true\sservice\=DNS.{0,1000}\sdllpath\=.{0,1000}\.dll.{0,1000}\scomputername\=.{0,1000}	offensive_tool_keyword	PerfExec	PerfExec - an example performance dll that will run CMD.exe and a .NET assembly that will execute the DLL or gather performance data locally or remotely.	T1055.001 - T1059.001 - T1059.003 - T1027.002	TA0002 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/PerfExec	1	0	N/A	N/A	7	1	77	12	2023-08-02T20:53:24Z	2023-07-11T16:43:47Z	833
41	* --dll --dllhijack *	.{0,1000}\s\-\-dll\s\-\-dllhijack\s.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				868
42	* --donut --rehash n --silent -o /tmp/*	.{0,1000}\s\-\-donut\s\-\-rehash\sn\s\-\-silent\s\-o\s\/tmp\/.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				929
43	* -endpoint * -adcs * -listenerport *	.{0,1000}\s\-endpoint\s.{0,1000}\s\-adcs\s.{0,1000}\s\-listenerport\s.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	1049
44	* exec -dll .dll -config .config*	.{0,1000}\sexec\s\-dll\s.{0,1000}\.dll\s\-config\s.{0,1000}\.config.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	1102
45	* exec-command -clear*	.{0,1000}\sexec\-command\s\-clear.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	1103
46	* exec-command -command *	.{0,1000}\sexec\-command\s\-command\s.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	1104
47	* exec-command -shell*	.{0,1000}\sexec\-command\s\-shell.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	1105
48	* Execute command elevated through Run Dialog*	.{0,1000}\s\sExecute\scommand\selevated\sthrough\sRun\sDialog.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	#content	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	1114
49	* Execute command elevated through task manager*	.{0,1000}\s\sExecute\scommand\selevated\sthrough\stask\smanager.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	#content	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	1115
50	* filetransfer -download -src-file .exe/tmp*	.{0,1000}\sfiletransfer\s\-download\s\-src\-file\s.{0,1000}\.exe.{0,1000}\/tmp.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	1195
51	* filetransfer -upload -src-file .exe\temp*	.{0,1000}\sfiletransfer\s\-upload\s\-src\-file\s.{0,1000}\.exe.{0,1000}\\temp.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	1196
52	* -force-forwardable	.{0,1000}\s\-force\-forwardable	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1209
53	* -forceshadowcred *	.{0,1000}\s\-forceshadowcred\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	1212
54	* generate_bind_fuegoshell.ps1*	.{0,1000}\sgenerate_bind_fuegoshell\.ps1.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	1296
55	* generate_reverse_fuegoshell.ps1*	.{0,1000}\sgenerate_reverse_fuegoshell\.ps1.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	1298
56	* get class-instances SMS_R_System *	.{0,1000}\sget\sclass\-instances\sSMS_R_System\s.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1302
57	* get class-properties SMS_Admin*	.{0,1000}\sget\sclass\-properties\sSMS_Admin.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1303
58	* get collection-members -n USERS*	.{0,1000}\sget\scollection\-members\s\-n\sUSERS.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1304
59	* get primary-users -u *	.{0,1000}\sget\sprimary\-users\s\-u\s.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1305
60	* get site-push-settings*	.{0,1000}\sget\ssite\-push\-settings.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1306
61	* goWMIExec_linux_*	.{0,1000}\sgoWMIExec_linux_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	#linux	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	1367
62	* goWMIExec_mac_*	.{0,1000}\sgoWMIExec_mac_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	1368
63	* goWMIExec_win_*	.{0,1000}\sgoWMIExec_win_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	1369
64	* -hashes * -spn * -impersonate *	.{0,1000}\s\-hashes\s.{0,1000}\s\-spn\s.{0,1000}\s\-impersonate\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1412
65	* -i portscan445.gnmap -o shares_found.txt*	.{0,1000}\s\-i\sportscan445\.gnmap\s\-o\sshares_found\.txt.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	1598
66	* impacket*	.{0,1000}\simpacket.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1630
67	* impacket/*	.{0,1000}\simpacket\/.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1633
68	* -impersonate* -hashes*	.{0,1000}\s\-impersonate.{0,1000}\s\-hashes.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1636
69	* Impersonate.exe *	.{0,1000}\sImpersonate\.exe\s.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	1637
70	* impersonate.py *	.{0,1000}\simpersonate\.py\s.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	1638
71	* invoke admin-service -q *	.{0,1000}\sinvoke\sadmin\-service\s\-q\s.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1732
72	* invoke admin-service -q *	.{0,1000}\sinvoke\sadmin\-service\s\-q\s.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1733
73	* invoke query FROM SMS_Admin	.{0,1000}\sinvoke\squery\s.{0,1000}FROM\sSMS_Admin.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	1734
74	* -just-dc-ntlm *	.{0,1000}\s\-just\-dc\-ntlm\s\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1832
75	* -just-dc-ntlm -just-dc-user krbtgt *	.{0,1000}\s\-just\-dc\-ntlm\s\-just\-dc\-user\skrbtgt\s.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	1834
76	* -just-dc-user *	.{0,1000}\s\-just\-dc\-user\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1835
77	* -k -request-user * -dc-ip*	.{0,1000}\s\-k\s\-request\-user\s.{0,1000}\s\-dc\-ip.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1841
78	* KrbRelay.HiveParser*	.{0,1000}\sKrbRelay\.HiveParser.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#content	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	1915
79	* LatLoader.py*	.{0,1000}\sLatLoader\.py.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	0	N/A	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	1928
80	* LMHASH:NTHASH*	.{0,1000}\sLMHASH\:NTHASH.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	1995
81	* local class-instances SMS_Authority*	.{0,1000}\slocal\sclass\-instances\sSMS_Authority.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2003
82	* local class-properties SMS_Authority*	.{0,1000}\slocal\sclass\-properties\sSMS_Authority.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2004
83	* -local dc011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAAA*	.{0,1000}\s\-local\sdc011UWhRCAAAAAAAAAAAAAAAAAAAAAAAAAAwbEAYBAAAAA.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	2005
84	* local grep ccmsetup started ccmsetup.log*	.{0,1000}\slocal\sgrep\s.{0,1000}ccmsetup\sstarted\s.{0,1000}ccmsetup\.log.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2006
85	* local query * FROM SMS_Authority*	.{0,1000}\slocal\squery\s.{0,1000}\sFROM\sSMS_Authority.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2007
86	* local secrets -m disk*	.{0,1000}\slocal\ssecrets\s\-m\sdisk.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2008
87	* local secrets -m wmi*	.{0,1000}\slocal\ssecrets\s\-m\swmi.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2009
88	* -m venv csexec *	.{0,1000}\s\-m\svenv\scsexec\s.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2102
89	* -no-pass rid-hijack*	.{0,1000}\s\-no\-pass\srid\-hijack.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	2359
90	* -no-pass -usersfile *	.{0,1000}\s\-no\-pass\s\-usersfile\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	2360
91	* --no-ppid-spoof*	.{0,1000}\s\-\-no\-ppid\-spoof.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2363
92	* --no-sigthief*	.{0,1000}\s\-\-no\-sigthief.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2370
93	* -ntds .dit -system *	.{0,1000}\s\-ntds\s.{0,1000}\.dit\s.{0,1000}\-system\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	2382
94	* -nthash * -domain-sid *	.{0,1000}\s\-nthash\s.{0,1000}\s\-domain\-sid\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	2391
95	* ntlm.py*	.{0,1000}\sntlm\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	2394
96	* ntlmrelayx.py*	.{0,1000}\sntlmrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/LuemmelSec/ntlmrelayx.py_to_exe	1	0	N/A	N/A	10	1	86	17	2023-05-26T05:35:52Z	2023-05-15T17:58:26Z	2403
97	* -p LastLogonTimestamp -p LastLogonUserName *	.{0,1000}\s\-p\sLastLogonTimestamp\s\-p\sLastLogonUserName\s.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2490
98	* PAExec service*	.{0,1000}\sPAExec\sservice.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	2504
99	* -pi \\\\\\\\.\\\\pipe\\\\*	.{0,1000}\s\-pi\s\\\\\\\\\\\\\\\\\.\\\\\\\\pipe\\\\\\\\.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2604
100	* -PipeName * -ServiceName * -Command whoami*	.{0,1000}\s\-PipeName\s.{0,1000}\s\-ServiceName\s.{0,1000}\s\-Command\swhoami.{0,1000}	offensive_tool_keyword	Invoke-SMBRemoting	Interactive Shell and Command Execution over Named-Pipes (SMB)	T1059 - T1021.002 - T1572	TA0002 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Leo4j/Invoke-SMBRemoting	1	0	N/A	N/A	9	2	163	25	2024-12-05T16:30:18Z	2023-09-06T16:00:47Z	2610
101	* PrincipalsAllowedToDelegateToAccount *	.{0,1000}\sPrincipalsAllowedToDelegateToAccount\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	2666
102	* psexecsvc.py*	.{0,1000}\spsexecsvc\.py.{0,1000}	offensive_tool_keyword	susinternals	python implementation of PSExec native service implementation	T1569.002 - T1021.002 - T1035	TA0002 - TA0004 - TA0008 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/susinternals	1	0	N/A	N/A	7	2	194	18	2025-02-11T09:34:50Z	2025-02-10T07:40:36Z	2692
103	* radare : -ble*	.{0,1000}\sradare\s.{0,1000}\:.{0,1000}\s\-ble.{0,1000}	offensive_tool_keyword	RadareEye	Tool for especially scanning nearby devices and execute a given command on its own system while the target device comes in range.	T1125 - T1071 - T1105 - T1057	TA0010 - TA0002 - TA0007	N/A	N/A	Lateral Movement	https://github.com/souravbaghz/RadareEye	1	0	N/A	N/A	N/A	4	364	49	2021-12-11T06:16:37Z	2021-01-07T04:52:58Z	2760
104	- RDP Session Hijack	.{0,1000}\-\sRDP\sSession\sHijack.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	0	#content	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	2787
105	* RDPWInst.exe*	.{0,1000}\sRDPWInst\.exe.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	2794
106	* rdpwrap.dll*	.{0,1000}\srdpwrap\.dll.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	2795
107	* --read \\ --tcp-connect 127.0.0.1:* --write *	.{0,1000}\s\-\-read\s.{0,1000}\\\\.{0,1000}\s\-\-tcp\-connect\s127\.0\.0\.1\:.{0,1000}\s\-\-write\s.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	2796
108	* --reflective-injection *	.{0,1000}\s\-\-reflective\-injection\s.{0,1000}	offensive_tool_keyword	CheeseTools	tools for Lateral Movement/Code Execution	T1021.006 - T1059.003 - T1105	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/klezVirus/CheeseTools	1	0	N/A	N/A	10	8	706	143	2021-08-17T20:22:56Z	2020-08-24T01:28:12Z	2817
109	* RemCom.exe*	.{0,1000}\sRemCom\.exe.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	2825
110	* RemComSvc.exe*	.{0,1000}\sRemComSvc\.exe.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	2826
111	* RemComSvc.h*	.{0,1000}\sRemComSvc\.h.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	2827
112	* -remote -bindPipe * -bindPort * -security*	.{0,1000}\s\-remote\s\-bindPipe\s.{0,1000}\s\s\-bindPort\s.{0,1000}\s\-security.{0,1000}	offensive_tool_keyword	invoke-piper	Forward local or remote tcp ports through SMB pipes.	T1003.001 - T1048 - T1021.002 - T1021.001 - T1090	TA0002 -TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/p3nt4/Invoke-Piper	1	0	N/A	N/A	N/A	3	295	51	2021-03-07T19:07:01Z	2017-08-03T08:06:44Z	2828
113	* remoteshell.py*	.{0,1000}\sremoteshell\.py.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	2851
114	* remove device GUID:001B2EE1-AE95-4146-AE7B-5928F1E4F396*	.{0,1000}\sremove\sdevice\sGUID\:001B2EE1\-AE95\-4146\-AE7B\-5928F1E4F396.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	2855
115	* rid-hijack -*	.{0,1000}\srid\-hijack\s\-.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	2903
116	* -s * -c command_exec --execute *	.{0,1000}\s\-s\s.{0,1000}\s\-c\scommand_exec\s\-\-execute\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	2956
117	* -s * -c disable_wdigest *	.{0,1000}\s\-s\s.{0,1000}\s\-c\sdisable_wdigest\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	2957
118	* -s * -c disable_winrm *	.{0,1000}\s\-s\s.{0,1000}\s\-c\sdisable_winrm\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	2958
119	* -s * -c enable_wdigest *	.{0,1000}\s\-s\s.{0,1000}\s\-c\senable_wdigest\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	2959
120	* -s * -c enable_winrm *	.{0,1000}\s\-s\s.{0,1000}\s\-c\senable_winrm\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	2960
121	* -s * -c remote_posh *	.{0,1000}\s\-s\s.{0,1000}\s\-c\sremote_posh\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	2961
122	* -s putty.exe_sig *	.{0,1000}\s\-s\sputty\.exe_sig\s.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2965
123	* -sam * -system * -security * LOCAL > .out	.{0,1000}\s\-sam\s.{0,1000}\s\-system\s.{0,1000}\s\-security\s.{0,1000}\sLOCAL\s\>\s.{0,1000}\.out.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://casvancooten.com/posts/2020/11/windows-active-directory-exploitation-cheat-sheet-and-command-reference	1	0	N/A	N/A	10	10	N/A	N/A	N/A	N/A	2977
124	* -sc GetSyscallStub *	.{0,1000}\s\-sc\sGetSyscallStub\s.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2985
125	* -sc SysWhispers3*	.{0,1000}\s\-sc\sSysWhispers3.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				2986
126	* --server * --cert-path .pfx --elevate --target --restore *	.{0,1000}\s\-\-server\s.{0,1000}\s\-\-cert\-path\s.{0,1000}\.pfx\s\-\-elevate\s\-\-target\s.{0,1000}\s\-\-restore\s.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	3039
127	* --server * --cert-path .pfx --elevate --target --sid *	.{0,1000}\s\-\-server\s.{0,1000}\s\-\-cert\-path\s.{0,1000}\.pfx\s\-\-elevate\s\-\-target\s.{0,1000}\s\-\-sid\s.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	3040
128	* service -dump all-services.json*	.{0,1000}\sservice\s\-dump\sall\-services\.json.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	3047
129	* --service fortynorth*	.{0,1000}\s\-\-service\sfortynorth.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	3048
130	* -shadowcred -victim *	.{0,1000}\s\-shadowcred\s\-victim\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	3071
131	* --shadow-credentials --shadow-target *	.{0,1000}\s\-\-shadow\-credentials\s\-\-shadow\-target\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	3072
132	* SharpRDPHijack*	.{0,1000}\sSharpRDPHijack.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	0	N/A	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	3093
133	* SharpWSManWinRM.vbs*	.{0,1000}\sSharpWSManWinRM\.vbs.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	3103
134	* --shellcode --dc-ip	.{0,1000}\s\-\-shellcode\s.{0,1000}\-\-dc\-ip\s.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3107
135	* --shellcode --silent	.{0,1000}\s\-\-shellcode\s.{0,1000}\-\-silent.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3108
136	* --shellcode --remoteinject*	.{0,1000}\s\-\-shellcode\s\-\-remoteinject.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3109
137	* --silent -obf NixImports -o /tmp/*	.{0,1000}\s\-\-silent\s\-obf\sNixImports\s\-o\s\/tmp\/.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3135
138	* -smb --smbkeyword * -victim *	.{0,1000}\s\-smb\s\-\-smbkeyword\s.{0,1000}\s\-victim\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	3202
139	* smb_control.bat*	.{0,1000}\ssmb_control\.bat.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	3204
140	* SMBGrab.pl*	.{0,1000}\sSMBGrab\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	3223
141	* SMBHunt.pl*	.{0,1000}\sSMBHunt\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	3224
142	* SMBList.pl*	.{0,1000}\sSMBList\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	3225
143	* -spn cifs/* -hashes*	.{0,1000}\s\-spn\scifs\/.{0,1000}\s\-hashes.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket/blob/master/examples/getST.py	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	3312
144	* --syscalls GetSyscallStub*	.{0,1000}\s\-\-syscalls\sGetSyscallStub.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3438
145	* --syscalls SysWhispers3*	.{0,1000}\s\-\-syscalls\sSysWhispers3.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3440
146	* System account. On victim computer should be installed AD CS*	.{0,1000}\sSystem\saccount\.\sOn\svictim\scomputer\sshould\sbe\sinstalled\sAD\sCS.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	3442
147	* -system SYSTEM -ntds NTDS.dit LOCAL*	.{0,1000}\s\-system\sSYSTEM\s\-ntds\sNTDS\.dit\sLOCAL.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	3443
148	* -system SYSTEM -ntds NTDS.dit -outputfile*	.{0,1000}\s\-system\sSYSTEM\s\-ntds\sNTDS\.dit\s\-outputfile.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	3444
149	* --syswhispers --jump*	.{0,1000}\s\-\-syswhispers\s\-\-jump.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				3445
150	* --target=* --payload=cmd.exe /c	.{0,1000}\s\-\-target\=.{0,1000}\s\-\-payload\=.{0,1000}cmd\.exe\s\/c.{0,1000}	offensive_tool_keyword	SharpNoPSExec	Get file less command execution for Lateral Movement.	T1021.006 - T1059.003 - T1105	TA0008 - TA0002 - TA0011	N/A	N/A	Lateral Movement	https://github.com/juliourena/SharpNoPSExec	1	0	N/A	N/A	10	7	615	90	2022-06-03T10:32:55Z	2021-04-24T22:02:38Z	3465
151	* -target-domain * -outputfile * -no-pass*	.{0,1000}\s\-target\-domain\s.{0,1000}\s\-outputfile\s.{0,1000}\s\-no\-pass.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	3466
152	* --tcp-listen 127.0.0.1:* --write * --read *	.{0,1000}\s\-\-tcp\-listen\s127\.0\.0\.1\:.{0,1000}\s\-\-write\s.{0,1000}\s\-\-read\s.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	3488
153	* TGT_Monitor.ps1*	.{0,1000}\sTGT_Monitor\.ps1.{0,1000}	offensive_tool_keyword	TGT_Monitor	This script continuously monitors cache for new TGTs and displays them on the screen (admin privs required)	T1557.001 - T1040	TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/TGT_Monitor	1	0	N/A	N/A	9	1	3	0	2023-11-08T18:48:55Z	2023-11-07T22:53:45Z	3507
154	* tmp_payload.txt*	.{0,1000}\stmp_payload\.txt.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	3527
155	* -Type SMBClient -Target * -TargetExclude * -Username * -Hash *	.{0,1000}\s\-Type\sSMBClient\s\-Target\s.{0,1000}\s\-TargetExclude\s.{0,1000}\s\-Username\s.{0,1000}\s\-Hash\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	N/A	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	3579
156	* -Type SMBEnum -Target * -TargetExclude * -Username * -Hash *	.{0,1000}\s\-Type\sSMBEnum\s\-Target\s.{0,1000}\s\-TargetExclude\s.{0,1000}\s\-Username\s.{0,1000}\s\-Hash\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	N/A	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	3580
157	* -Type SMBExec -Target * -TargetExclude * -Username * -Hash *	.{0,1000}\s\-Type\sSMBExec\s\-Target\s.{0,1000}\s\-TargetExclude\s.{0,1000}\s\-Username\s.{0,1000}\s\-Hash\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	N/A	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	3581
158	* -Type WMIExec *	.{0,1000}\s\-Type\sWMIExec\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	N/A	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	3584
159	* -Type WMIExec -Target * -TargetExclude * -Username * -Hash *	.{0,1000}\s\-Type\sWMIExec\s\-Target\s.{0,1000}\s\-TargetExclude\s.{0,1000}\s\-Username\s.{0,1000}\s\-Hash\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	N/A	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	3585
160	* --victimdn *	.{0,1000}\s\-\-victimdn\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	3668
161	* --wldp-bypass=*	.{0,1000}\s\-\-wldp\-bypass\=.{0,1000}	offensive_tool_keyword	CheeseTools	tools for Lateral Movement/Code Execution	T1021.006 - T1059.003 - T1105	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/klezVirus/CheeseTools	1	0	N/A	N/A	10	8	706	143	2021-08-17T20:22:56Z	2020-08-24T01:28:12Z	3739
162	* wmiexec.py -k -no-pass *	.{0,1000}\swmiexec\.py\s\-k\s\-no\-pass\s.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	3742
163	* WMIHACKER.vbs*	.{0,1000}\sWMIHACKER\.vbs.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	3744
164	* wmihacker_0.4.vbe*	.{0,1000}\swmihacker_0\.4\.vbe.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	3745
165	* WMIHACKER_0.6.vbs*	.{0,1000}\sWMIHACKER_0\.6\.vbs.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	3746
166	* wmirun=true dllpath=.dll computername=*	.{0,1000}\swmirun\=true\sdllpath\=.{0,1000}\.dll.{0,1000}\scomputername\=.{0,1000}	offensive_tool_keyword	PerfExec	PerfExec - an example performance dll that will run CMD.exe and a .NET assembly that will execute the DLL or gather performance data locally or remotely.	T1055.001 - T1059.001 - T1059.003 - T1027.002	TA0002 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/PerfExec	1	0	N/A	N/A	7	1	77	12	2023-08-02T20:53:24Z	2023-07-11T16:43:47Z	3748
167	* WSManWinRM.js *	.{0,1000}\sWSManWinRM\.js\s.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	3763
168	* WSManWinRM.ps1*	.{0,1000}\sWSManWinRM\.ps1.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	3764
169	"%~dp0RDPWInst" -i -o	.{0,1000}\"\%\~dp0RDPWInst\"\s\-i\s\-o.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	3813
170	"Granted user DCSYNC rights!*	.{0,1000}\"Granted\suser\s.{0,1000}\sDCSYNC\srights!.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	3841
171	# Smbtouch Scanner	.{0,1000}\#\sSmbtouch\sScanner.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	0	N/A	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	3907
172	#1 - Smuggling binary via Service DisplayName	.{0,1000}\#1\s\-\sSmuggling\sbinary\svia\sService\sDisplayName.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	3915
173	#2 - Smuggling binary via WMI	.{0,1000}\#2\s\-\sSmuggling\sbinary\svia\sWMI.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	3916
174	$myC2ipAdress	.{0,1000}\$myC2ipAdress.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	4000
175	$myVictimIPAdress	.{0,1000}\$myVictimIPAdress.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	4001
176	%~dp0RDPWInst.exe	.{0,1000}\%\~dp0RDPWInst\.exe.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	4028
177	%SystemRoot%\\MEMORY.DMP	.{0,1000}\%SystemRoot\%\\\\MEMORY\.DMP.{0,1000}	greyware_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	4041
178	%SYSTEMROOT%\PAExec-	.{0,1000}\%SYSTEMROOT\%\\PAExec\-.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	4042
179	*PSEXECSVC19=b64decode(	.{0,1000}.{0,1000}PSEXECSVC19\=b64decode\(.{0,1000}	offensive_tool_keyword	susinternals	python implementation of PSExec native service implementation	T1569.002 - T1021.002 - T1035	TA0002 - TA0004 - TA0008 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/susinternals	1	0	#content	N/A	7	2	194	18	2025-02-11T09:34:50Z	2025-02-10T07:40:36Z	4092
180	.\RemComSvc\	.{0,1000}\.\\RemComSvc\\.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	4229
181	.exe computername= command=* username=* password=* connectdrive=true*	.{0,1000}\.exe\scomputername\=.{0,1000}\scommand\=.{0,1000}\susername\=.{0,1000}\spassword\=.{0,1000}\sconnectdrive\=true.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4408
182	.exe computername= command=* username=* password=* elevated=taskmgr*	.{0,1000}\.exe\scomputername\=.{0,1000}\scommand\=.{0,1000}\susername\=.{0,1000}\spassword\=.{0,1000}\selevated\=taskmgr.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4409
183	.exe computername= command=* username=* password=* elevated=winr*	.{0,1000}\.exe\scomputername\=.{0,1000}\scommand\=.{0,1000}\susername\=.{0,1000}\spassword\=.{0,1000}\selevated\=winr.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4410
184	.exe computername= command=* username=* password=* exec=cmd*	.{0,1000}\.exe\scomputername\=.{0,1000}\scommand\=.{0,1000}\susername\=.{0,1000}\spassword\=.{0,1000}\sexec\=cmd.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4411
185	.exe computername= command=* username=* password=* nla=true*	.{0,1000}\.exe\scomputername\=.{0,1000}\scommand\=.{0,1000}\susername\=.{0,1000}\spassword\=.{0,1000}\s\snla\=true.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4412
186	.exe computername= command=* username=* password=* takeover=true*	.{0,1000}\.exe\scomputername\=.{0,1000}\scommand\=.{0,1000}\susername\=.{0,1000}\spassword\=.{0,1000}\s\stakeover\=true.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4413
187	.exe create /payload /kb*	.{0,1000}\.exe\screate\s\/payload.{0,1000}\s\/kb.{0,1000}	offensive_tool_keyword	SharpWSUS	SharpWSUS is a CSharp tool for Lateral Movement through WSUS	T1047 - T1021.002 - T1021.003 - T1077 - T1069 - T1057 - T1105 - T1028 - T1070.004 - T1053 - T1086 - T1106 - T1059	TA0002 - TA0003 - TA0008	N/A	Black Basta	Lateral Movement	https://github.com/nettitude/SharpWSUS	1	0	N/A	N/A	N/A	5	452	77	2022-11-20T23:41:40Z	2022-05-04T08:27:57Z	4415
188	.exe --Method ShellWindows --ComputerName --Command *	.{0,1000}\.exe\s\-\-Method\sShellWindows\s\-\-ComputerName\s.{0,1000}\s\-\-Command\s.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	4537
189	.exe -s -c service_mod *	.{0,1000}\.exe\s\-s\s.{0,1000}\s\-c\sservice_mod\s.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	4589
190	.exe --session=2 --shadow --console	.{0,1000}\.exe\s\-\-session\=2\s\-\-shadow\s\-\-console.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	0	N/A	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	4606
191	.exe -spn -redirecthost *	.{0,1000}\.exe\s\-spn\s.{0,1000}\s\-redirecthost\s.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	4618
192	.pfx -Domain -PatchLsass*	.{0,1000}\.pfx\s\-Domain\s.{0,1000}\s\-PatchLsass.{0,1000}	offensive_tool_keyword	Invoke-RunAsWithCert	A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine	T1550.003 - T1078 - T1027	TA0006 - TA0005	N/A	N/A	Lateral Movement	https://github.com/synacktiv/Invoke-RunAsWithCert	1	0	N/A	N/A	8	2	150	14	2024-05-13T08:26:56Z	2024-05-03T12:44:21Z	4731
193	.py amsi -disable*	.{0,1000}\.py\s.{0,1000}\samsi\s\-disable.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	4790
194	.py amsi -enable*	.{0,1000}\.py\s.{0,1000}\samsi\s\-enable.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	4791
195	.py coerce -computer *	.{0,1000}\.py\s.{0,1000}\scoerce\s\-computer\s.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	4794
196	.py -k -no-pass*	.{0,1000}\.py\s.{0,1000}\s\-k\s\-no\-pass.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	4799
197	.py -action add_computer -crt -key * -domain * -dc-ip * -computer-name * -computer-pass *	.{0,1000}\.py\s\-action\sadd_computer\s\-crt\s.{0,1000}\s\-key\s.{0,1000}\s\-domain\s.{0,1000}\s\-dc\-ip\s.{0,1000}\s\-computer\-name\s.{0,1000}\s\-computer\-pass\s.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	4813
198	.py -use-remoteSSMethod	.{0,1000}\.py\s\-use\-remoteSSMethod\s.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	4848
199	.py service -action create -service-name *	.{0,1000}\.py.{0,1000}\sservice\s\-action\screate\s\-service\-name\s.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	4853
200	.WriteLine("SharpRDP")	.{0,1000}\.WriteLine$\"SharpRDP\"$.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	4955
201	/addcomputer.py	.{0,1000}\/addcomputer\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	5169
202	/atexec.py	.{0,1000}\/atexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	5435
203	/atexec.py	.{0,1000}\/atexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	5436
204	/atexec-pro.git	.{0,1000}\/atexec\-pro\.git.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	1	N/A	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	5437
205	/atexec-pro.py	.{0,1000}\/atexec\-pro\.py.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	1	N/A	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	5438
206	/attacks/.py	.{0,1000}\/attacks\/.{0,1000}\.py	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	5463
207	/batch_cme_smb.sh	.{0,1000}\/batch_cme_smb\.sh.{0,1000}	offensive_tool_keyword	crackmapexec	crack mapexec script used by Dispossessor ransomware group	T1486 - T1490 - T1059 - T1213 - T1078	TA0040 - TA0043 - TA0001 - TA0009	N/A	Dispossessor - APT39 - Dragonfly - FIN7 - MuddyWater - ENERGETIC BEAR - EMBER BEAR - BERSERK BEAR - Black Basta	Lateral Movement	https://vx-underground.org/Archive/Dispossessor%20Leaks	1	1	N/A	N/A	10	10	N/A	N/A	N/A	N/A	5571
208	/ccmpwn.git	.{0,1000}\/ccmpwn\.git.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	1	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	5963
209	/ccmpwn.py	.{0,1000}\/ccmpwn\.py.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	1	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	5964
210	/Certipy.exe	.{0,1000}\/Certipy\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	5975
211	/changepasswd.py	.{0,1000}\/changepasswd\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	#linux	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	5988
212	/CheeseTools.git	.{0,1000}\/CheeseTools\.git.{0,1000}	offensive_tool_keyword	CheeseTools	tools for Lateral Movement/Code Execution	T1021.006 - T1059.003 - T1105	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/klezVirus/CheeseTools	1	1	N/A	N/A	10	8	706	143	2021-08-17T20:22:56Z	2020-08-24T01:28:12Z	6003
213	/CIMplant.exe	.{0,1000}\/CIMplant\.exe.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	1	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	6045
214	/CIMplant.git	.{0,1000}\/CIMplant\.git.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	1	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	6046
215	/CIMplant/Commander.cs	.{0,1000}\/CIMplant\/Commander\.cs.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	1	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	6047
216	/CppWSManWinRM.exe	.{0,1000}\/CppWSManWinRM\.exe.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	1	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	6211
217	/csexec.exe	.{0,1000}\/csexec\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	1	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	6304
218	/CSExec.git	.{0,1000}\/CSExec\.git.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	1	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	6305
219	/CSExec.py	.{0,1000}\/CSExec\.py.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	1	N/A	private github repo	10		N/A				6306
220	/CSExec.py.git	.{0,1000}\/CSExec\.py\.git.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	1	N/A	private github repo	10		N/A				6307
221	/csexecsvc.exe	.{0,1000}\/csexecsvc\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	1	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	6308
222	/csexecsvc-net35.exe	.{0,1000}\/csexecsvc\-net35\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	1	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	6309
223	/csexecsvc-net40.exe	.{0,1000}\/csexecsvc\-net40\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	1	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	6310
224	/csexecsvc-net45.exe	.{0,1000}\/csexecsvc\-net45\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	1	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	6311
225	/CVE-2024-22274-RCE.git	.{0,1000}\/CVE\-2024\-22274\-RCE\.git.{0,1000}	offensive_tool_keyword	POC	PoC - Authenticated Remote Code Execution in VMware vCenter Server (CVE-2024-22274 Exploit)	T1213 - T1059 - T1056 - T1078 - T1578	TA0001 - TA0002 - TA0008 - TA0009	N/A	N/A	Lateral Movement	https://github.com/l0n3m4n/CVE-2024-22274-RCE	1	1	N/A	N/A	10	1	42	8	2024-07-16T23:22:14Z	2024-07-15T07:26:59Z	6379
226	/dacledit.py	.{0,1000}\/dacledit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6393
227	/dacledit.py	.{0,1000}\/dacledit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6394
228	/dcomexec.exe	.{0,1000}\/dcomexec\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6454
229	/dcomexec.py	.{0,1000}\/dcomexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6455
230	/dcomhijack.cna	.{0,1000}\/dcomhijack\.cna.{0,1000}	offensive_tool_keyword	dcomhijack	Lateral Movement Using DCOM with impacket and DLL Hijacking	T1570 - T1021.003 - T1574.001 - T1574.002	TA0008 - TA0003 - TA0005	N/A	N/A	Lateral Movement	https://github.com/WKL-Sec/dcomhijack	1	1	N/A	N/A	7	3	290	24	2023-06-18T20:34:03Z	2023-06-17T20:23:24Z	6456
231	/dcomhijack.git	.{0,1000}\/dcomhijack\.git.{0,1000}	offensive_tool_keyword	dcomhijack	Lateral Movement Using DCOM and DLL Hijacking	T1021 - T1021.003 - T1574 - T1574.007 - T1574.002	TA0008 - TA0005 - TA0002	N/A	N/A	Lateral Movement	https://github.com/WKL-Sec/dcomhijack	1	1	N/A	N/A	10	3	290	24	2023-06-18T20:34:03Z	2023-06-17T20:23:24Z	6457
232	/dcomhijack.git	.{0,1000}\/dcomhijack\.git.{0,1000}	offensive_tool_keyword	dcomhijack	Lateral Movement Using DCOM with impacket and DLL Hijacking	T1570 - T1021.003 - T1574.001 - T1574.002	TA0008 - TA0003 - TA0005	N/A	N/A	Lateral Movement	https://github.com/WKL-Sec/dcomhijack	1	1	N/A	N/A	7	3	290	24	2023-06-18T20:34:03Z	2023-06-17T20:23:24Z	6458
233	/dcomhijack.py	.{0,1000}\/dcomhijack\.py.{0,1000}	offensive_tool_keyword	dcomhijack	Lateral Movement Using DCOM with impacket and DLL Hijacking	T1570 - T1021.003 - T1574.001 - T1574.002	TA0008 - TA0003 - TA0005	N/A	N/A	Lateral Movement	https://github.com/WKL-Sec/dcomhijack	1	1	N/A	N/A	7	3	290	24	2023-06-18T20:34:03Z	2023-06-17T20:23:24Z	6459
234	/DCOMUploadExec.exe	.{0,1000}\/DCOMUploadExec\.exe.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	1	N/A	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	6461
235	/DCOMUploadExec.git	.{0,1000}\/DCOMUploadExec\.git.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	1	N/A	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	6462
236	/describeTicket.py	.{0,1000}\/describeTicket\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6546
237	/DFSCoerce.exe	.{0,1000}\/DFSCoerce\.exe.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	1	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	6562
238	/dpapi.py	.{0,1000}\/dpapi\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6775
239	/DumpNTLMInfo.py	.{0,1000}\/DumpNTLMInfo\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6840
240	/esentutl.py	.{0,1000}\/esentutl\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	6988
241	/exchanger.py	.{0,1000}\/exchanger\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7104
242	/exchanger.py	.{0,1000}\/exchanger\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7105
243	/File-Tunnel.git	.{0,1000}\/File\-Tunnel\.git.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	1	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	7198
244	/findDelegation.py	.{0,1000}\/findDelegation\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7204
245	/ft-linux-x64	.{0,1000}\/ft\-linux\-x64\s.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#linux	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	7294
246	/fuegoshell.git	.{0,1000}\/fuegoshell\.git.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	1	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	7309
247	/generate_bind_fuegoshell.ps1	.{0,1000}\/generate_bind_fuegoshell\.ps1.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	1	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	7348
248	/generate_reverse_fuegoshell.ps1	.{0,1000}\/generate_reverse_fuegoshell\.ps1.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	1	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	7349
249	/GetADComputers.py	.{0,1000}\/GetADComputers\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7351
250	/GetADUsers.py	.{0,1000}\/GetADUsers\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7352
251	/getArch.py	.{0,1000}\/getArch\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7354
252	/Get-GPPPassword.py	.{0,1000}\/Get\-GPPPassword\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7360
253	/GetLAPSPassword.py	.{0,1000}\/GetLAPSPassword\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7363
254	/GetNPUsers.exe	.{0,1000}\/GetNPUsers\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7375
255	/GetNPUsers.py	.{0,1000}\/GetNPUsers\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7377
256	/getOSandSMBproperties.exe	.{0,1000}\/getOSandSMBproperties\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7378
257	/getPac.exe	.{0,1000}\/getPac\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7380
258	/getPac.py	.{0,1000}\/getPac\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7381
259	/getST.py	.{0,1000}\/getST\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7386
260	/getST2.py	.{0,1000}\/getST\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7387
261	/getTGT.py	.{0,1000}\/getTGT\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7390
262	/GetUserSPNs.py	.{0,1000}\/GetUserSPNs\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7391
263	/goldenPac.py	.{0,1000}\/goldenPac\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	7569
264	/goWMIExec.git	.{0,1000}\/goWMIExec\.git.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	1	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	7604
265	/goWMIExec_linux_	.{0,1000}\/goWMIExec_linux_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	1	#linux	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	7605
266	/goWMIExec_mac_	.{0,1000}\/goWMIExec_mac_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	1	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	7606
267	/goWMIExec_win_	.{0,1000}\/goWMIExec_win_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	1	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	7607
268	/httpattack.py	.{0,1000}\/httpattack\.py.{0,1000}	offensive_tool_keyword	PKINITtools	Tools for Kerberos PKINIT and relaying to AD CS	T1550.003 - T1557.002 - T1552.004 - T1212 - T1550	TA0009 - TA0008	N/A	N/A	Lateral Movement	https://github.com/dirkjanm/PKINITtools	1	1	N/A	N/A	N/A	8	737	82	2025-01-03T14:25:52Z	2021-07-27T19:06:09Z	7837
269	/impacket.	.{0,1000}\/impacket\..{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8034
270	/impacket.git	.{0,1000}\/impacket\.git.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8035
271	/impacket/	.{0,1000}\/impacket\/.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8037
272	/Impersonate.exe	.{0,1000}\/Impersonate\.exe.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	1	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	8039
273	/impersonate.git	.{0,1000}\/impersonate\.git.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	1	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	8040
274	/impersonate.py	.{0,1000}\/impersonate\.py.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	1	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	8041
275	/Invoke-RunAsWithCert.git	.{0,1000}\/Invoke\-RunAsWithCert\.git.{0,1000}	offensive_tool_keyword	Invoke-RunAsWithCert	A PowerShell script to perform PKINIT authentication with the Windows API from a non domain-joined machine	T1550.003 - T1078 - T1027	TA0006 - TA0005	N/A	N/A	Lateral Movement	https://github.com/synacktiv/Invoke-RunAsWithCert	1	1	N/A	N/A	8	2	150	14	2024-05-13T08:26:56Z	2024-05-03T12:44:21Z	8163
276	/Invoke-SMBRemoting.git	.{0,1000}\/Invoke\-SMBRemoting\.git.{0,1000}	offensive_tool_keyword	Invoke-SMBRemoting	Interactive Shell and Command Execution over Named-Pipes (SMB)	T1059 - T1021.002 - T1572	TA0002 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Leo4j/Invoke-SMBRemoting	1	1	N/A	N/A	9	2	163	25	2024-12-05T16:30:18Z	2023-09-06T16:00:47Z	8165
277	/kalilinux/packages/winexe	.{0,1000}\/kalilinux\/packages\/winexe.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	1	#linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	8284
278	/karmaSMB.exe	.{0,1000}\/karmaSMB\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8287
279	/karmaSMB.py	.{0,1000}\/karmaSMB\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8288
280	/kerberos-ldap-password-hunter	.{0,1000}\/kerberos\-ldap\-password\-hunter.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/oldboy21/LDAP-Password-Hunter	1	1	N/A	N/A	10	2	198	25	2023-01-06T15:32:34Z	2021-07-26T14:27:01Z	8329
281	/keylistattack.py	.{0,1000}\/keylistattack\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8342
282	/kintercept.py	.{0,1000}\/kintercept\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8370
283	/krb5/.py	.{0,1000}\/krb5\/.{0,1000}\.py	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8394
284	/KrbRelay.exe	.{0,1000}\/KrbRelay\.exe.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	1	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	8399
285	/KrbRelay-SMBServer.git	.{0,1000}\/KrbRelay\-SMBServer\.git.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	1	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	8403
286	/KrbRelay-SMBServer/releases/	.{0,1000}\/KrbRelay\-SMBServer\/releases\/.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	1	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	8404
287	/LatLoader.git	.{0,1000}\/LatLoader\.git.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	1	N/A	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	8454
288	/LatLoader.py	.{0,1000}\/LatLoader\.py.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	1	N/A	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	8455
289	/ldap.py	.{0,1000}\/ldap\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8464
290	/libs/powershells/upload.ps1	.{0,1000}\/libs\/powershells\/upload\.ps1.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	0	#linux	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	8508
291	/lookupsid.py	.{0,1000}\/lookupsid\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8627
292	/lookupsid.py	.{0,1000}\/lookupsid\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8628
293	/machine_role.py	.{0,1000}\/machine_role\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8680
294	/mimikatz.py	.{0,1000}\/mimikatz\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8826
295	/mqtt_check.py	.{0,1000}\/mqtt_check\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8905
296	/mssqlclient.py	.{0,1000}\/mssqlclient\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8947
297	/mssqlinstance.py	.{0,1000}\/mssqlinstance\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	8955
298	/mssqlproxy.git	.{0,1000}\/mssqlproxy\.git.{0,1000}	offensive_tool_keyword	mssqlproxy	mssqlproxy is a toolkit aimed to perform Lateral Movement in restricted environments through a compromised Microsoft SQL Server via socket reuse	T1021.002 - T1071.001 - T1573.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/blackarrowsec/mssqlproxy	1	1	N/A	N/A	10	8	741	114	2021-02-16T20:13:04Z	2020-02-12T08:44:28Z	8957
299	/netview.py	.{0,1000}\/netview\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9125
300	/nmapAnswerMachine.exe	.{0,1000}\/nmapAnswerMachine\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9202
301	/nmapAnswerMachine.py	.{0,1000}\/nmapAnswerMachine\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9203
302	/ntfs-read.py	.{0,1000}\/ntfs\-read\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9281
303	/ntlm.py	.{0,1000}\/ntlm\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9283
304	/ntlmrelayx.exe	.{0,1000}\/ntlmrelayx\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9295
305	/ntlmrelayx.exe	.{0,1000}\/ntlmrelayx\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9296
306	/ntlmrelayx.py	.{0,1000}\/ntlmrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9297
307	/ntlmrelayx.py	.{0,1000}\/ntlmrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/LuemmelSec/ntlmrelayx.py_to_exe	1	1	N/A	N/A	10	1	86	17	2023-05-26T05:35:52Z	2023-05-15T17:58:26Z	9298
308	/ntlmrelayx/	.{0,1000}\/ntlmrelayx\/.{0,1000}	offensive_tool_keyword	PKINITtools	Tools for Kerberos PKINIT and relaying to AD CS	T1550.003 - T1557.002 - T1552.004 - T1212 - T1550	TA0009 - TA0008	N/A	N/A	Lateral Movement	https://github.com/dirkjanm/PKINITtools	1	1	N/A	N/A	N/A	8	737	82	2025-01-03T14:25:52Z	2021-07-27T19:06:09Z	9300
309	/owneredit.py	.{0,1000}\/owneredit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9470
310	/PAExec.cpp	.{0,1000}\/PAExec\.cpp.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	1	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	9480
311	*/paexec.exe	.{0,1000}\/paexec\.exe	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	1	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	9481
312	/PAExec.git	.{0,1000}\/PAExec\.git.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	1	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	9482
313	/paexec_eula.txt	.{0,1000}\/paexec_eula\.txt.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	9483
314	/PassTheCert.git	.{0,1000}\/PassTheCert\.git.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	1	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	9523
315	/PetitPotam.exe	.{0,1000}\/PetitPotam\.exe.{0,1000}	offensive_tool_keyword	petipotam	PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.	T1557.001 - T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/topotam/PetitPotam	1	1	N/A	N/A	10	10	1944	290	2024-08-15T03:52:26Z	2021-07-18T18:19:54Z	9638
316	/PetitPotam.git	.{0,1000}\/PetitPotam\.git.{0,1000}	offensive_tool_keyword	petipotam	PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.	T1557.001 - T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/topotam/PetitPotam	1	1	N/A	N/A	10	10	1944	290	2024-08-15T03:52:26Z	2021-07-18T18:19:54Z	9639
317	/ping6.py	.{0,1000}\/ping6\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9694
318	/PKINITtools	.{0,1000}\/PKINITtools.{0,1000}	offensive_tool_keyword	PKINITtools	Tools for Kerberos PKINIT and relaying to AD CS	T1550.003 - T1557.002 - T1552.004 - T1212 - T1550	TA0009 - TA0008	N/A	N/A	Lateral Movement	https://github.com/dirkjanm/PKINITtools	1	1	N/A	N/A	N/A	8	737	82	2025-01-03T14:25:52Z	2021-07-27T19:06:09Z	9712
319	/psexec.py	.{0,1000}\/psexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	9965
320	/psexecsvc.py	.{0,1000}\/psexecsvc\.py.{0,1000}	offensive_tool_keyword	susinternals	python implementation of PSExec native service implementation	T1569.002 - T1021.002 - T1035	TA0002 - TA0004 - TA0008 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/susinternals	1	1	N/A	N/A	7	2	194	18	2025-02-11T09:34:50Z	2025-02-10T07:40:36Z	9966
321	/pth-toolkit.git	.{0,1000}\/pth\-toolkit\.git.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	1	N/A	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	9999
322	/rbcd.py	.{0,1000}\/rbcd\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10194
323	/rdp_check.py	.{0,1000}\/rdp_check\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10212
324	/RDPWInst.exe	.{0,1000}\/RDPWInst\.exe.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	1	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	10235
325	/RDPWInst-v.msi*	.{0,1000}\/RDPWInst\-v.{0,1000}\.msi.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	1	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	10236
326	/rdpwrap.dll	.{0,1000}\/rdpwrap\.dll.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	1	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	10237
327	/rdpwrap.git	.{0,1000}\/rdpwrap\.git.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	1	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	10238
328	/RDPWrap-v.zip*	.{0,1000}\/RDPWrap\-v.{0,1000}\.zip.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	1	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	10239
329	/registry-read.py	.{0,1000}\/registry\-read\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10324
330	/releases/download/impacket_	.{0,1000}\/releases\/download\/impacket_.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10341
331	/RemCom.exe	.{0,1000}\/RemCom\.exe.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	1	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	10352
332	/RemCom.git	.{0,1000}\/RemCom\.git.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	1	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	10353
333	/RemComSvc.exe	.{0,1000}\/RemComSvc\.exe.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	1	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	10354
334	/RemoteKrbRelay.git	.{0,1000}\/RemoteKrbRelay\.git.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	1	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	10378
335	/RemoteMaintsvc.exe	.{0,1000}\/RemoteMaintsvc\.exe.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	1	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	10379
336	/RemoteMaintsvc.exe	.{0,1000}\/RemoteMaintsvc\.exe.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	1	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	10380
337	/remoteshell.py	.{0,1000}\/remoteshell\.py.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	1	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	10401
338	/remoteshell.py	.{0,1000}\/remoteshell\.py.{0,1000}	offensive_tool_keyword	wmiexec2	wmiexec2.0 is the same wmiexec that everyone knows and loves (debatable). This 2.0 version is obfuscated to avoid well known signatures from various AV engines.	T1021.005 - T1047 - T1059.001 - T1059.003 - T1059.005	TA0008 - TA0002 - TA0011	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/ice-wzl/wmiexec2	1	1	N/A	N/A	9	1	34	1	2024-06-12T17:56:15Z	2023-02-07T22:10:08Z	10402
339	/res/rdpwrap.ini	.{0,1000}\/res\/rdpwrap\.ini.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	10405
340	/rpc/rpcproxy.dll?	.{0,1000}\/rpc\/rpcproxy\.dll\?.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10533
341	/rpcdump.py	.{0,1000}\/rpcdump\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10543
342	/rpcmap.py	.{0,1000}\/rpcmap\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10548
343	/Rubeus.exe	.{0,1000}\/Rubeus\.exe.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	0	#linux	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	10592
344	/sambaPipe.py	.{0,1000}\/sambaPipe\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10676
345	/samrdump.exe	.{0,1000}\/samrdump\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10681
346	/samrdump.py	.{0,1000}\/samrdump\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10682
347	/SCCMSecrets.git	.{0,1000}\/SCCMSecrets\.git.{0,1000}	offensive_tool_keyword	SCCMSecrets	SCCMSecrets.py aims at exploiting SCCM policies distribution for credentials harvesting - initial access and lateral movement.	T1555 - T1078 - T1070 - T1021	TA0006 - TA0008 - TA0001	N/A	N/A	Lateral Movement	https://github.com/synacktiv/SCCMSecrets	1	1	N/A	N/A	8	3	208	22	2024-12-17T14:29:39Z	2024-08-14T09:45:44Z	10718
348	/SCCMVNC.git	.{0,1000}\/SCCMVNC\.git.{0,1000}	offensive_tool_keyword	SCCMVNC	A tool to modify SCCM remote control settings on the client machine - enabling remote control without permission prompts or notifications. This can be done without requiring access to SCCM server.	T1078 - T1562 - T1557	TA0005 - TA0003 - TA0008	N/A	N/A	Lateral Movement	https://github.com/netero1010/SCCMVNC	1	1	N/A	N/A	8	1	87	10	2024-10-20T14:29:43Z	2024-10-20T14:15:28Z	10719
349	/scshell	.{0,1000}\/scshell.{0,1000}	offensive_tool_keyword	scshell	SCShell is a fileless Lateral Movement tool that relies on ChangeServiceConfigA to run commands. The beauty of this tool is that it does not perform authentication against SMB. Everything is performed over DCERPC.The utility can be used remotely WITHOUT registering a service or creating a service. It also doesn't have to drop any file on the remote system* (Depend on the technique used to execute)	T1071.001 - T1071.004 - T1046 - T1059 - T1024	TA0002 - TA0003 - TA0007	N/A	N/A	Lateral Movement	https://github.com/Mr-Un1k0d3r/SCShell	1	0	#linux	N/A	N/A	10	1484	248	2023-07-10T01:31:54Z	2019-11-13T23:39:27Z	10743
350	/secretsdump.exe	.{0,1000}\/secretsdump\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10769
351	/secretsdump.py	.{0,1000}\/secretsdump\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	10770
352	/SessionExec.exe	.{0,1000}\/SessionExec\.exe.{0,1000}	offensive_tool_keyword	SessionExec	Execute commands in other Sessions	T1053 - T1569	TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/SessionExec	1	1	N/A	N/A	10	1	86	14	2024-07-29T12:24:28Z	2024-07-21T15:32:07Z	10804
353	/SharpCOM.exe	.{0,1000}\/SharpCOM\.exe.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	1	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	10911
354	/SharpCOM.git	.{0,1000}\/SharpCOM\.git.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	1	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	10912
355	/SharpExcelDCom.exe	.{0,1000}\/SharpExcelDCom\.exe.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	1	N/A	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	10968
356	/SharpExShell.exe	.{0,1000}\/SharpExShell\.exe.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	1	N/A	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	10976
357	/SharpExShell.git	.{0,1000}\/SharpExShell\.git.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	1	N/A	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	10977
358	/SharpMove.exe	.{0,1000}\/SharpMove\.exe.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	1	N/A	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	11040
359	/SharpMove.git	.{0,1000}\/SharpMove\.git.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	1	N/A	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	11041
360	/SharpNoPSExec	.{0,1000}\/SharpNoPSExec.{0,1000}	offensive_tool_keyword	SharpNoPSExec	Get file less command execution for Lateral Movement.	T1021.006 - T1059.003 - T1105	TA0008 - TA0002 - TA0011	N/A	N/A	Lateral Movement	https://github.com/juliourena/SharpNoPSExec	1	1	N/A	N/A	10	7	615	90	2022-06-03T10:32:55Z	2021-04-24T22:02:38Z	11046
361	/SharpRDP.git	.{0,1000}\/SharpRDP\.git.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	1	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	11062
362	/SharpRDPHijack	.{0,1000}\/SharpRDPHijack.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	1	N/A	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	11063
363	/SharpSCCM.git	.{0,1000}\/SharpSCCM\.git.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	1	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	11076
364	/SharpSCCM/releases/download/	.{0,1000}\/SharpSCCM\/releases\/download\/.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	1	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	11077
365	/SharpShellPipe.git	.{0,1000}\/SharpShellPipe\.git.{0,1000}	offensive_tool_keyword	SharpShellPipe	interactive remote shell access via named pipes and the SMB protocol.	T1056.002 - T1021.002 - T1059.001	TA0005 - TA0009 - TA0002	N/A	N/A	Lateral Movement	https://github.com/DarkCoderSc/SharpShellPipe	1	1	N/A	N/A	8	2	118	14	2025-02-21T12:33:43Z	2023-08-25T15:18:30Z	11091
366	/SharpSpoolTrigger	.{0,1000}\/SharpSpoolTrigger.{0,1000}	offensive_tool_keyword	SharpSystemTriggers	Collection of remote authentication triggers in C#	T1078 - T1059.001 - T1550	TA0008	N/A	N/A	Lateral Movement	https://github.com/cube0x0/SharpSystemTriggers	1	1	N/A	N/A	10	5	483	57	2024-05-15T21:24:56Z	2021-09-12T18:18:15Z	11107
367	/SharpSystemTriggers	.{0,1000}\/SharpSystemTriggers.{0,1000}	offensive_tool_keyword	SharpSystemTriggers	Collection of remote authentication triggers in C#	T1078 - T1059.001 - T1550	TA0008	N/A	N/A	Lateral Movement	https://github.com/cube0x0/SharpSystemTriggers	1	1	N/A	N/A	10	5	483	57	2024-05-15T21:24:56Z	2021-09-12T18:18:15Z	11133
368	/SharpWSManWinRM.vbs	.{0,1000}\/SharpWSManWinRM\.vbs.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	1	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	11168
369	/SharpWSUS	.{0,1000}\/SharpWSUS.{0,1000}	offensive_tool_keyword	SharpWSUS	SharpWSUS is a CSharp tool for Lateral Movement through WSUS	T1047 - T1021.002 - T1021.003 - T1077 - T1069 - T1057 - T1105 - T1028 - T1070.004 - T1053 - T1086 - T1106 - T1059	TA0002 - TA0003 - TA0008	N/A	Black Basta	Lateral Movement	https://github.com/nettitude/SharpWSUS	1	1	N/A	N/A	N/A	5	452	77	2022-11-20T23:41:40Z	2022-05-04T08:27:57Z	11169
370	/smb.py	.{0,1000}\/smb\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11350
371	/SMB_RPC/.py	.{0,1000}\/SMB_RPC\/.{0,1000}\.py	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11352
372	/smb3.py	.{0,1000}\/smb3\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/SecureAuthCorp/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11357
373	/smbclient.exe	.{0,1000}\/smbclient\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	risk of false positives	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11359
374	/smbclient.py	.{0,1000}\/smbclient\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11360
375	/SMBCrunch.git	.{0,1000}\/SMBCrunch\.git.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	1	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	11362
376	/smbexec.py	.{0,1000}\/smbexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11373
377	/SMBGrab.pl	.{0,1000}\/SMBGrab\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	1	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	11379
378	/SMBHunt.pl	.{0,1000}\/SMBHunt\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	1	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	11380
379	/SMBList.pl	.{0,1000}\/SMBList\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	1	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	11382
380	/smbpasswd.py	.{0,1000}\/smbpasswd\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11390
381	/smbrelayx.exe	.{0,1000}\/smbrelayx\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11395
382	/smbrelayx.py	.{0,1000}\/smbrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11396
383	/smbserver.py	.{0,1000}\/smbserver\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11403
384	/Smbtouch-Scanner.git	.{0,1000}\/Smbtouch\-Scanner\.git.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	1	N/A	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	11417
385	/sniff.py	.{0,1000}\/sniff\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11459
386	/sniff.py	.{0,1000}\/sniff\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11460
387	/sniffer.exe	.{0,1000}\/sniffer\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11461
388	/sniffer.py	.{0,1000}\/sniffer\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11463
389	/TChopper.git	.{0,1000}\/TChopper\.git.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	1	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	11825
390	/TGT_Monitor.git	.{0,1000}\/TGT_Monitor\.git.{0,1000}	offensive_tool_keyword	TGT_Monitor	This script continuously monitors cache for new TGTs and displays them on the screen (admin privs required)	T1557.001 - T1040	TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/TGT_Monitor	1	1	N/A	N/A	9	1	3	0	2023-11-08T18:48:55Z	2023-11-07T22:53:45Z	11876
391	/TGT_Monitor.ps1	.{0,1000}\/TGT_Monitor\.ps1.{0,1000}	offensive_tool_keyword	TGT_Monitor	This script continuously monitors cache for new TGTs and displays them on the screen (admin privs required)	T1557.001 - T1040	TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/TGT_Monitor	1	1	N/A	N/A	9	1	3	0	2023-11-08T18:48:55Z	2023-11-07T22:53:45Z	11877
392	/ticketConverter.py	.{0,1000}\/ticketConverter\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11912
393	/ticketer.exe	.{0,1000}\/ticketer\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11913
394	/ticketer.py	.{0,1000}\/ticketer\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	11916
395	/tmp/smb_auth_temp_.txt*	.{0,1000}\/tmp\/smb_auth_temp_.{0,1000}\.txt.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	#linux	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	11995
396	/VncSharp.exe	.{0,1000}\/VncSharp\.exe.{0,1000}	greyware_tool_keyword	VncSharp	VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework	T1021.001 - T1219 - T1071.001	TA0007 - TA0008	Carbanak	FIN7 - Carbanak	Lateral Movement	https://github.com/humphd/VncSharp	1	1	N/A	N/A	8	3	246	179	2019-02-18T16:04:27Z	2012-03-05T15:23:41Z	12471
397	/VncSharp.git	.{0,1000}\/VncSharp\.git.{0,1000}	greyware_tool_keyword	VncSharp	VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework	T1021.001 - T1219 - T1071.001	TA0007 - TA0008	Carbanak	FIN7 - Carbanak	Lateral Movement	https://github.com/humphd/VncSharp	1	1	N/A	N/A	8	3	246	179	2019-02-18T16:04:27Z	2012-03-05T15:23:41Z	12472
398	/winexe --runas*	.{0,1000}\/winexe\s.{0,1000}\-\-runas.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	0	#linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	12615
399	/winexe -U	.{0,1000}\/winexe\s\-U\s.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	0	#linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	12616
400	/winexe.git	.{0,1000}\/winexe\.git.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	1	#linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	12617
401	/winexe-0.91.tar.gz	.{0,1000}\/winexe\-0\.91\.tar\.gz.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	1	#linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	12618
402	/winexe-1.00.tar.gz	.{0,1000}\/winexe\-1\.00\.tar\.gz.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	1	#linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	12619
403	/winregistry.py*	.{0,1000}\/winregistry\.py.{0,1000}.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	12644
404	/WMEye.git	.{0,1000}\/WMEye\.git.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	1	N/A	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	12690
405	/wmeye/	.{0,1000}\/wmeye\/.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	1	N/A	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	12691
406	/wmiexec.py	.{0,1000}\/wmiexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	12698
407	/wmiexec2.git	.{0,1000}\/wmiexec2\.git.{0,1000}	offensive_tool_keyword	wmiexec2	wmiexec2.0 is the same wmiexec that everyone knows and loves (debatable). This 2.0 version is obfuscated to avoid well known signatures from various AV engines.	T1021.005 - T1047 - T1059.001 - T1059.003 - T1059.005	TA0008 - TA0002 - TA0011	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/ice-wzl/wmiexec2	1	1	N/A	N/A	9	1	34	1	2024-06-12T17:56:15Z	2023-02-07T22:10:08Z	12700
408	/wmiexec-Pro	.{0,1000}\/wmiexec\-Pro.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	1	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	12701
409	/wmiexec-Pro.git	.{0,1000}\/wmiexec\-Pro\.git.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	1	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	12702
410	/WMIHACKER.git	.{0,1000}\/WMIHACKER\.git.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	1	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	12703
411	/WMIHACKER.vbs	.{0,1000}\/WMIHACKER\.vbs.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	1	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	12705
412	/wmipersist.exe	.{0,1000}\/wmipersist\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	12706
413	/wmipersist.py	.{0,1000}\/wmipersist\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	12707
414	/wmiquery.py	.{0,1000}\/wmiquery\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	12709
415	/WSMan-WinRM.git	.{0,1000}\/WSMan\-WinRM\.git.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	1	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	12742
416	/WSManWinRM.ps1	.{0,1000}\/WSManWinRM\.ps1.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	1	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	12743
417	:9090/api/v1.0/relays*	.{0,1000}\:9090.{0,1000}\/api\/v1\.0\/relays.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	12867
418	[ talha.tariq@gmail.com ]	.{0,1000}\[\stalha\.tariq\@gmail\.com\s\].{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	12890
419	[!] Dont forget about adding your attack in AcceptSecurityContext(	.{0,1000}\[!\]\sDont\sforget\sabout\sadding\syour\sattack\sin\sAcceptSecurityContext\(.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#content	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	12904
420	[!] I will dump all computer passwords	.{0,1000}\[!\]\sI\swill\sdump\sall\scomputer\spasswords.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#content	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	12935
421	[!] Please specify smb attack keyword --smbkeyword	.{0,1000}\[!\]\sPlease\sspecify\ssmb\sattack\skeyword\s\-\-smbkeyword\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#content	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	12951
422	[-] does not have Service Control Manager write privilege on *	.{0,1000}\[\-\]\s.{0,1000}\sdoes\snot\shave\sService\sControl\sManager\swrite\sprivilege\son\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	#content	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	12996
423	[-] Got error 'LDAP_INSUFFICIENT_ACCESS' when trying to add new KeyCredential	.{0,1000}\[\-\]\sGot\serror\s\'LDAP_INSUFFICIENT_ACCESS\'\swhen\strying\sto\sadd\snew\sKeyCredential.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#content	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	13016
424	[-] Got RPC_ACCESS_DENIED!! EfsRpcOpenFileRaw is probably PATCHED!	.{0,1000}\[\-\]\sGot\sRPC_ACCESS_DENIED!!\sEfsRpcOpenFileRaw\sis\sprobably\sPATCHED!.{0,1000}	offensive_tool_keyword	petipotam	PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.	T1557.001 - T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/topotam/PetitPotam	1	0	#content	N/A	10	10	1944	290	2024-08-15T03:52:26Z	2021-07-18T18:19:54Z	13017
425	[-] Inveigh Relay session	.{0,1000}\[\-\]\sInveigh\sRelay\ssession\s.{0,1000}	offensive_tool_keyword	Invoke-TheHash	Invoke-TheHash contains PowerShell functions for performing pass the hash WMI and SMB tasks. WMI and SMB connections are accessed through the .NET TCPClient. Authentication is performed by passing an NTLM hash into the NTLMv2 authentication protocol. Local administrator privilege is not required client-side.	T1028 - T1047 - T1075 - T1078	TA0003 - TA0004 - TA0006	N/A	FoxKitten	Lateral Movement	https://github.com/Kevin-Robertson/Invoke-TheHash	1	0	#content	N/A	10	10	1569	308	2018-12-09T15:38:36Z	2017-01-03T01:05:39Z	13019
426	[+] AMSI Bypassed!	.{0,1000}\[\+\]\sAMSI\sBypassed!.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	#content	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	13046
427	[+] Clearing msDS-KeyCredentialLink before adding our new KeyCredential	.{0,1000}\[\+\]\sClearing\smsDS\-KeyCredentialLink\sbefore\sadding\sour\snew\sKeyCredential.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#content	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	13078
428	[+] Create evil class for file transfer	.{0,1000}\[\+\]\sCreate\sevil\sclass\sfor\sfile\stransfer.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	#content	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	13085
429	[+] Created a remote GAC file stream	.{0,1000}\[\+\]\sCreated\sa\sremote\sGAC\sfile\sstream.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	0	#content	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	13086
430	[+] Exploitation successful: You have root access	.{0,1000}\[\+\]\sExploitation\ssuccessful\:\sYou\shave\sroot\saccess.{0,1000}	offensive_tool_keyword	POC	PoC - Authenticated Remote Code Execution in VMware vCenter Server (CVE-2024-22274 Exploit)	T1213 - T1059 - T1056 - T1078 - T1578	TA0001 - TA0002 - TA0008 - TA0009	N/A	N/A	Lateral Movement	https://github.com/l0n3m4n/CVE-2024-22274-RCE	1	0	#content	N/A	10	1	42	8	2024-07-16T23:22:14Z	2024-07-15T07:26:59Z	13140
431	[+] Got Krb Auth from NT/System. Relaying to ADCS now	.{0,1000}\[\+\]\sGot\sKrb\sAuth\sfrom\sNT\/System\.\sRelaying\sto\sADCS\snow.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#content	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	13159
432	[+] Looking for the SSN via Halos Gate	.{0,1000}\[\+\]\sLooking\sfor\sthe\sSSN\svia\sHalos\sGate.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	0	#content	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	13218
433	[+] New incoming shell from :	.{0,1000}\[\+\]\sNew\sincoming\sshell\sfrom\s\:\s.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	#content	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	13231
434	[+] Nuke is landing.	.{0,1000}\[\+\]\sNuke\sis\slanding\..{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	#content	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	13241
435	[+] Payload executed successfully	.{0,1000}\[\+\]\sPayload\sexecuted\ssuccessfully.{0,1000}	offensive_tool_keyword	POC	PoC - Authenticated Remote Code Execution in VMware vCenter Server (CVE-2024-22274 Exploit)	T1213 - T1059 - T1056 - T1078 - T1578	TA0001 - TA0002 - TA0008 - TA0009	N/A	N/A	Lateral Movement	https://github.com/l0n3m4n/CVE-2024-22274-RCE	1	0	#content	N/A	10	1	42	8	2024-07-16T23:22:14Z	2024-07-15T07:26:59Z	13252
436	[+] task has been created successfully ..!	.{0,1000}\[\+\]\stask\shas\sbeen\screated\ssuccessfully\s\s\.\.!.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	#content	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	13364
437	[->] sending payload..as chuncks	.{0,1000}\[\-\>\]\ssending\spayload\.\.as\schuncks.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	#content	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	13426
438	[X] ShellCode Property Created	.{0,1000}\[X\]\sShellCode\sProperty\sCreated.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	0	#content	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	13530
439	[X] Uploading Shellcode into target	.{0,1000}\[X\]\sUploading\sShellcode\sinto\starget.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	0	#content	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	13531
440	\$.kirbi*	.{0,1000}\\\$.{0,1000}\.kirbi.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	13544
441	\\\pipe\psexecsvc*	.{0,1000}\\\\.{0,1000}\\pipe\\psexecsvc.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#namedpipe	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	13574
442	\\.\pipe\RemoteMaint	.{0,1000}\\\\\.\\pipe\\RemoteMaint.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	#namedpipe	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	13600
443	\\\\.\\pipe\\RemoteMaint	.{0,1000}\\\\\\\\\.\\\\pipe\\\\RemoteMaint.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	#namedpipe	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	13642
444	\\127.0.0.1\c$	.{0,1000}\\\\127\.0\.0\.1\\c\$.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	13649
445	\\DCSC_stdInPipe	.{0,1000}\\\\DCSC_stdInPipe.{0,1000}	offensive_tool_keyword	SharpShellPipe	interactive remote shell access via named pipes and the SMB protocol.	T1056.002 - T1021.002 - T1059.001	TA0005 - TA0009 - TA0002	N/A	N/A	Lateral Movement	https://github.com/DarkCoderSc/SharpShellPipe	1	0	N/A	N/A	8	2	118	14	2025-02-21T12:33:43Z	2023-08-25T15:18:30Z	13652
446	\\DCSC_stdOutPipe	.{0,1000}\\\\DCSC_stdOutPipe.{0,1000}	offensive_tool_keyword	SharpShellPipe	interactive remote shell access via named pipes and the SMB protocol.	T1056.002 - T1021.002 - T1059.001	TA0005 - TA0009 - TA0002	N/A	N/A	Lateral Movement	https://github.com/DarkCoderSc/SharpShellPipe	1	0	N/A	N/A	8	2	118	14	2025-02-21T12:33:43Z	2023-08-25T15:18:30Z	13653
447	\\windows\\temp\\sam.tmp	.{0,1000}\\\\windows\\\\temp\\\\sam\.tmp.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	13697
448	\\windows\\temp\\sys.tmp	.{0,1000}\\\\windows\\\\temp\\\\sys\.tmp.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	13698
449	\__output 2^>^&1 >	.{0,1000}\\__output\s2\^\>\^\&1\s\>.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	smbexec behavior	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	13700
450	\__output 2>&1 >	.{0,1000}\\__output\s2\>\&1\s\>.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	smbexec behavior	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	13701
451	\addcomputer.py	.{0,1000}\\addcomputer\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	13813
452	\atexec.py	.{0,1000}\\atexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14129
453	\atexec-pro.py	.{0,1000}\\atexec\-pro\.py.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	0	N/A	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	14130
454	\atexec-pro-main	.{0,1000}\\atexec\-pro\-main.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	0	N/A	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	14131
455	\bin\RDPConf.exe	.{0,1000}\\bin\\RDPConf\.exe.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	14306
456	\C$\__output	.{0,1000}\\C\$\\__output.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	smbexec behavior	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14431
457	\ccmpwn.py	.{0,1000}\\ccmpwn\.py.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	14473
458	\ccmpwn\	.{0,1000}\\ccmpwn\\.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	14474
459	\Certipy.exe	.{0,1000}\\Certipy\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14478
460	\changepasswd.py	.{0,1000}\\changepasswd\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14484
461	\Checkerv2.0.exe -outfile -outformat *	.{0,1000}\\Checkerv2\.0\.exe\s\-outfile\s.{0,1000}\s\-outformat\s.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	14492
462	\CIMplant.exe	.{0,1000}\\CIMplant\.exe.{0,1000}	offensive_tool_keyword	CIMplant	C# port of WMImplant which uses either CIM or WMI to query remote systems	T1047 - T1059.001 - T1021.006	TA0002 - TA0007 - TA0008	N/A	Scattered Spider*	Lateral Movement	https://github.com/RedSiege/CIMplant	1	0	N/A	N/A	10	2	199	29	2021-07-14T18:18:42Z	2021-01-29T21:41:58Z	14530
463	\CppWSManWinRM.exe	.{0,1000}\\CppWSManWinRM\.exe.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	14643
464	\csexec.exe	.{0,1000}\\csexec\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	14687
465	\csexecsvc.exe	.{0,1000}\\csexecsvc\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	14689
466	\csexecsvc-net35.exe	.{0,1000}\\csexecsvc\-net35\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	14691
467	\csexecsvc-net40.exe	.{0,1000}\\csexecsvc\-net40\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	14693
468	\csexecsvc-net45.exe	.{0,1000}\\csexecsvc\-net45\.exe.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	N/A	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	14695
469	\dacledit-.bak*	.{0,1000}\\dacledit\-.{0,1000}\.bak.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14763
470	\dacledit.py	.{0,1000}\\dacledit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14764
471	\dacledit.py	.{0,1000}\\dacledit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14765
472	\dcomexec.exe	.{0,1000}\\dcomexec\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14814
473	\dcomexec.py	.{0,1000}\\dcomexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14815
474	\dcomhijack.py	.{0,1000}\\dcomhijack\.py.{0,1000}	offensive_tool_keyword	dcomhijack	Lateral Movement Using DCOM with impacket and DLL Hijacking	T1570 - T1021.003 - T1574.001 - T1574.002	TA0008 - TA0003 - TA0005	N/A	N/A	Lateral Movement	https://github.com/WKL-Sec/dcomhijack	1	0	N/A	N/A	7	3	290	24	2023-06-18T20:34:03Z	2023-06-17T20:23:24Z	14816
475	\DCOMUploadExec.exe	.{0,1000}\\DCOMUploadExec\.exe.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	0	N/A	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	14817
476	\DCOMUploadExec.sln	.{0,1000}\\DCOMUploadExec\.sln.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	0	N/A	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	14818
477	\DCOMUploadExec-main	.{0,1000}\\DCOMUploadExec\-main.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	0	N/A	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	14819
478	\describeTicket.py	.{0,1000}\\describeTicket\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	14908
479	\DFSCoerce.exe	.{0,1000}\\DFSCoerce\.exe.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	14923
480	\dpapi.py	.{0,1000}\\dpapi\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15059
481	\DumpNTLMInfo.py	.{0,1000}\\DumpNTLMInfo\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15116
482	\esentutl.py	.{0,1000}\\esentutl\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15308
483	\exchanger.py	.{0,1000}\\exchanger\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15366
484	\filetransfer.py	.{0,1000}\\filetransfer\.py.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	15438
485	\File-Tunnel-main	.{0,1000}\\File\-Tunnel\-main.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15439
486	\File-Tunnel-master	.{0,1000}\\File\-Tunnel\-master.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15440
487	\findDelegation.py	.{0,1000}\\findDelegation\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15447
488	\ft.dll	.{0,1000}\\ft\.dll.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15504
489	\ft.exe --	.{0,1000}\\ft\.exe\s\-\-.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15505
490	\ft.exe" --	.{0,1000}\\ft\.exe\"\s\-\-.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15506
491	\ft.exe" /install	.{0,1000}\\ft\.exe\"\s\/install.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15507
492	\ft.exe" /load	.{0,1000}\\ft\.exe\"\s\/load.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15508
493	\ft.exe" -install	.{0,1000}\\ft\.exe\"\s\-install.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	15509
494	\generate_bind_fuegoshell.ps1	.{0,1000}\\generate_bind_fuegoshell\.ps1.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	15533
495	\generate_reverse_fuegoshell.ps1	.{0,1000}\\generate_reverse_fuegoshell\.ps1.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	N/A	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	15534
496	\GetADComputers.py	.{0,1000}\\GetADComputers\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15536
497	\GetADUsers.py	.{0,1000}\\GetADUsers\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15544
498	\getArch.py	.{0,1000}\\getArch\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15551
499	\Get-GPPPassword.py	.{0,1000}\\Get\-GPPPassword\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15569
500	\GetLAPSPassword.py	.{0,1000}\\GetLAPSPassword\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15576
501	\GetNPUsers.exe	.{0,1000}\\GetNPUsers\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15587
502	\GetNPUsers.py	.{0,1000}\\GetNPUsers\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15589
503	\getOSandSMBproperties.exe	.{0,1000}\\getOSandSMBproperties\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15590
504	\getPac.exe	.{0,1000}\\getPac\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15592
505	\getPac.py	.{0,1000}\\getPac\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15593
506	\getST.py	.{0,1000}\\getST\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15606
507	\getST2.py	.{0,1000}\\getST\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15607
508	\getTGT.py	.{0,1000}\\getTGT\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15612
509	\GetUserSPNs.py	.{0,1000}\\GetUserSPNs\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15614
510	\goldenPac.py	.{0,1000}\\goldenPac\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15670
511	\goWMIExec_linux_	.{0,1000}\\goWMIExec_linux_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	15707
512	\goWMIExec_mac_	.{0,1000}\\goWMIExec_mac_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	15708
513	\goWMIExec_win_	.{0,1000}\\goWMIExec_win_.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	N/A	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	15709
514	*\http_SCNotification.exe	.{0,1000}\\http_SCNotification\.exe	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	15838
515	\impacket.	.{0,1000}\\impacket\..{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	15888
516	\Impersonate.exe	.{0,1000}\\Impersonate\.exe.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	15893
517	\impersonate.py	.{0,1000}\\impersonate\.py.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	15894
518	\Impersonate\Impersonate.cpp	.{0,1000}\\Impersonate\\Impersonate\.cpp.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	15896
519	\InactiveDomainAdmins.csv	.{0,1000}\\InactiveDomainAdmins\.csv.{0,1000}	offensive_tool_keyword	HoneypotBuster	Microsoft PowerShell module designed for red teams that can be used to find honeypots and honeytokens in the network or at the host	T1083 - T1059.001 - T1112	TA0007 - TA0002	N/A	N/A	Lateral Movement	https://github.com/JavelinNetworks/HoneypotBuster	1	0	N/A	N/A	8	3	282	57	2017-12-05T13:03:11Z	2017-07-22T15:40:44Z	15902
520	\karmaSMB.exe	.{0,1000}\\karmaSMB\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16061
521	\karmaSMB.py	.{0,1000}\\karmaSMB\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16062
522	\keylistattack.py	.{0,1000}\\keylistattack\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16120
523	\kintercept.py	.{0,1000}\\kintercept\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16149
524	\krb5\.py	.{0,1000}\\krb5\\.{0,1000}\.py	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16169
525	\KrbRelay.exe	.{0,1000}\\KrbRelay\.exe.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	16171
526	\KrbRelay-SMBServer.sln	.{0,1000}\\KrbRelay\-SMBServer\.sln.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	16175
527	\LatLoader.py	.{0,1000}\\LatLoader\.py.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	0	N/A	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	16212
528	\LatLoader-main	.{0,1000}\\LatLoader\-main.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	0	N/A	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	16213
529	\lookupsid.py	.{0,1000}\\lookupsid\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16381
530	\machine_role.py	.{0,1000}\\machine_role\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16427
531	\mimikatz.py	.{0,1000}\\mimikatz\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16589
532	\mqtt_check.py	.{0,1000}\\mqtt_check\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16664
533	\mssqlclient.py	.{0,1000}\\mssqlclient\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16699
534	\mssqlinstance.py	.{0,1000}\\mssqlinstance\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16700
535	\netview.py	.{0,1000}\\netview\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16837
536	\nmapAnswerMachine.exe	.{0,1000}\\nmapAnswerMachine\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16889
537	\nmapAnswerMachine.py	.{0,1000}\\nmapAnswerMachine\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16890
538	-\nSharp RDP Hijack\n-	.{0,1000}\-\\nSharp\sRDP\sHijack\\n\-.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	0	#content	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	16974
539	\ntfs-read.py	.{0,1000}\\ntfs\-read\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16990
540	\ntlm.py	.{0,1000}\\ntlm\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16992
541	\ntlmrelayx.exe	.{0,1000}\\ntlmrelayx\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16997
542	\ntlmrelayx.exe	.{0,1000}\\ntlmrelayx\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16998
543	\ntlmrelayx.py	.{0,1000}\\ntlmrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	16999
544	\ntlmrelayx.py	.{0,1000}\\ntlmrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/LuemmelSec/ntlmrelayx.py_to_exe	1	0	N/A	N/A	10	1	86	17	2023-05-26T05:35:52Z	2023-05-15T17:58:26Z	17000
545	\owneredit.py	.{0,1000}\\owneredit\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	17074
546	\PAExec.cpp	.{0,1000}\\PAExec\.cpp.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17082
547	\PAExec.exe	.{0,1000}\\PAExec\.exe.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17083
548	\PAEXEC.EXE-.pf*	.{0,1000}\\PAEXEC\.EXE\-.{0,1000}\.pf.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17084
549	\PAExec.log	.{0,1000}\\PAExec\.log.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17085
550	\paexec.obj	.{0,1000}\\paexec\.obj.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17086
551	\paexec.pdb	.{0,1000}\\paexec\.pdb.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17087
552	\PAExec.sln	.{0,1000}\\PAExec\.sln.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17088
553	\PAExec\.exe*	.{0,1000}\\PAExec\\.{0,1000}\.exe.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17089
554	\paexec_eula.txt	.{0,1000}\\paexec_eula\.txt.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17090
555	\PAExec_Move	.{0,1000}\\PAExec_Move.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	N/A	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17091
556	\PassTheCert.cs	.{0,1000}\\PassTheCert\.cs.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	17115
557	\PassTheCert.sln	.{0,1000}\\PassTheCert\.sln.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	N/A	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	17122
558	\PerfExec.exe	.{0,1000}\\PerfExec\.exe.{0,1000}	offensive_tool_keyword	PerfExec	PerfExec - an example performance dll that will run CMD.exe and a .NET assembly that will execute the DLL or gather performance data locally or remotely.	T1055.001 - T1059.001 - T1059.003 - T1027.002	TA0002 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/PerfExec	1	0	N/A	N/A	7	1	77	12	2023-08-02T20:53:24Z	2023-07-11T16:43:47Z	17184
559	\PetitPotam.exe	.{0,1000}\\PetitPotam\.exe.{0,1000}	offensive_tool_keyword	petipotam	PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.	T1557.001 - T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/topotam/PetitPotam	1	0	N/A	N/A	10	10	1944	290	2024-08-15T03:52:26Z	2021-07-18T18:19:54Z	17219
560	\pipe\PAExecErr	.{0,1000}\\pipe\\PAExecErr.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	#namedpipe	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17276
561	\pipe\PAExecIn	.{0,1000}\\pipe\\PAExecIn.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	#namedpipe	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17277
562	\pipe\PAExecOut	.{0,1000}\\pipe\\PAExecOut.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	#namedpipe	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	17278
563	\PsExec.exe	.{0,1000}\\PsExec\.exe.{0,1000}	greyware_tool_keyword	psexec	PsExec is a legitimate Microsoft tool for remote administration. However. attackers can misuse it to execute malicious commands or software on other network machines. install persistent threats. and evade some security systems.	T1136.002 - T1543.003 - T1570 - T1021.002 - T1569.002	TA0002 - TA0004 - TA0008 - TA0011	N/A	Turla - Chimera - APT1 - Thrip - Moses Staff - BlackTech - Cleaver - DarkVishnya - Sandworm Team - HAFNIUM - Akira - APT39 - FIN5 - FIN6 - Indrik Spider - TEMP.Veles - Kimsuky - GALLIUM - APT29 - Carbanak - Leafminer - FIN8 - Fox Kitten - Dragonfly - Magic Hound - OilRig - Cobalt Group - Naikon - Threat Group-1314 - menuPass - Wizard Spider - ALLANITE - APT20 - APT27 - Antlion - BOSS SPIDER - Common Raven - ENERGETIC BEAR - FIN7 - GOBLIN PANDA - PowerPool - INDRIK SPIDER - WIZARD SPIDER - TINY SPIDER - TA2101 - TRAVELING SPIDER - Common Raven - Antlion - Scattered Spider - COZY BEAR - EMBER BEAR - BERSERK BEAR - Gamaredon - Dispossessor	Lateral Movement	https://learn.microsoft.com/fr-fr/sysinternals/downloads/psexec	1	0	N/A	greyware tool - risks of False positive !	10	10	N/A	N/A	N/A	N/A	17602
564	\psexec.py	.{0,1000}\\psexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	17603
565	\psexecsvc.py	.{0,1000}\\psexecsvc\.py.{0,1000}	offensive_tool_keyword	susinternals	python implementation of PSExec native service implementation	T1569.002 - T1021.002 - T1035	TA0002 - TA0004 - TA0008 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/susinternals	1	0	N/A	N/A	7	2	194	18	2025-02-11T09:34:50Z	2025-02-10T07:40:36Z	17605
566	\pth-toolkit-master\	.{0,1000}\\pth\-toolkit\-master\\.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	N/A	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	17631
567	\Public\chop.enc	.{0,1000}\\Public\\chop\.enc.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	17632
568	\rbcd.py	.{0,1000}\\rbcd\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	17772
569	\RDP Wrapper\	.{0,1000}\\RDP\sWrapper\\.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17785
570	\rdp_check.py	.{0,1000}\\rdp_check\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	17787
571	\RDPCheck.exe	.{0,1000}\\RDPCheck\.exe.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17788
572	\RDPWInst.exe	.{0,1000}\\RDPWInst\.exe.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17803
573	\RDPWInst-v.msi*	.{0,1000}\\RDPWInst\-v.{0,1000}\.msi.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17804
574	\RDPWrap.cpp	.{0,1000}\\RDPWrap\.cpp.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17805
575	\rdpwrap.dll	.{0,1000}\\rdpwrap\.dll.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17806
576	\rdpwrap.ini	.{0,1000}\\rdpwrap\.ini.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17807
577	\RDPWrap.sln	.{0,1000}\\RDPWrap\.sln.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17808
578	\rdpwrap.txt	.{0,1000}\\rdpwrap\.txt.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17809
579	\rdpwrap-master	.{0,1000}\\rdpwrap\-master.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17810
580	\RDPWrapSetup	.{0,1000}\\RDPWrapSetup.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17811
581	\RDPWrap-v.zip*	.{0,1000}\\RDPWrap\-v.{0,1000}\.zip.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	N/A	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	17812
582	\registry-read.py	.{0,1000}\\registry\-read\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	17888
583	\RemCom.cpp	.{0,1000}\\RemCom\.cpp.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17903
584	\RemCom.exe	.{0,1000}\\RemCom\.exe.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17904
585	\RemCom.pdb	.{0,1000}\\RemCom\.pdb.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17905
586	\RemCom.vcxproj	.{0,1000}\\RemCom\.vcxproj.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17906
587	\RemCom-master\	.{0,1000}\\RemCom\-master\\.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17907
588	\RemComSvc.exe	.{0,1000}\\RemComSvc\.exe.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17908
589	\RemComSvc\	.{0,1000}\\RemComSvc\\.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17909
590	\Remote Command Executor.sln	.{0,1000}\\Remote\sCommand\sExecutor\.sln.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	N/A	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	17915
591	\RemoteKrbRelay\	.{0,1000}\\RemoteKrbRelay\\.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	17946
592	\RemoteKrbRelay-main	.{0,1000}\\RemoteKrbRelay\-main.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	17947
593	\RemoteMaint.sln	.{0,1000}\\RemoteMaint\.sln.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	17948
594	\RemoteMaint.vcxproj	.{0,1000}\\RemoteMaint\.vcxproj.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	17949
595	\RemoteMaintsvc.exe	.{0,1000}\\RemoteMaintsvc\.exe.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	17950
596	\RemoteMaintsvc.exe	.{0,1000}\\RemoteMaintsvc\.exe.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	17951
597	\remoteshell.py	.{0,1000}\\remoteshell\.py.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	N/A	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	18010
598	\rid_hijack.py	.{0,1000}\\rid_hijack\.py.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	N/A	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	18066
599	\ROADtoken\bin\	.{0,1000}\\ROADtoken\\bin\\.{0,1000}	offensive_tool_keyword	Maestro	Maestro is a post-exploitation tool that simplifies interaction with Intune/EntraID from a C2 agent on a user's workstation bypassing the need for user password knowledge - token manipulation or Azure authentication processes	T1550.004 - T1078 - T1087 - T1071 - T1102	TA0006 - TA0003 - TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/Maestro	1	0	N/A	behavior detections opportunities here https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30	9	4	333	33	2025-02-11T23:02:00Z	2024-01-15T18:45:50Z	18081
600	\rpcdump.py	.{0,1000}\\rpcdump\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18136
601	\rpcmap.py	.{0,1000}\\rpcmap\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18142
602	\sambaPipe.py	.{0,1000}\\sambaPipe\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18270
603	\samrdump.exe	.{0,1000}\\samrdump\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18274
604	\samrdump.py	.{0,1000}\\samrdump\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18275
605	\secretsdump.exe	.{0,1000}\\secretsdump\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18346
606	\secretsdump.py	.{0,1000}\\secretsdump\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18347
607	\services.py	.{0,1000}\\services\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18364
608	\SessionExec.exe	.{0,1000}\\SessionExec\.exe.{0,1000}	offensive_tool_keyword	SessionExec	Execute commands in other Sessions	T1053 - T1569	TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/SessionExec	1	0	N/A	N/A	10	1	86	14	2024-07-29T12:24:28Z	2024-07-21T15:32:07Z	18375
609	\SharpCOM.csproj	.{0,1000}\\SharpCOM\.csproj.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	18478
610	\SharpCOM.exe	.{0,1000}\\SharpCOM\.exe.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	18481
611	\SharpCOM.sln	.{0,1000}\\SharpCOM\.sln.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	18482
612	\SharpExcelDCom.exe	.{0,1000}\\SharpExcelDCom\.exe.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	0	N/A	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	18542
613	\SharpExShell.exe	.{0,1000}\\SharpExShell\.exe.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	0	N/A	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	18548
614	\SharpExShell.sln	.{0,1000}\\SharpExShell\.sln.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	0	N/A	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	18549
615	\SharpMove.exe	.{0,1000}\\SharpMove\.exe.{0,1000}	offensive_tool_keyword	cobaltstrike	Cobalt Strike kit for Lateral Movement	T1021.002 - T1021.006 - T1021.004	TA0008 - TA0002	N/A	APT19 - MAZE - APT32 - APT37 - APT41 - Aquatic Panda - AvosLocker - Black Basta - BlackByte - BlackCat - BlackSuit - CL0P - Cactus - Chimera - Cobalt Group - Conti - Common Raven - CopyKittens - Cuba - Dagon Locker - DarkHydrus - Diavol - Earth Lusca - EvilCorp* - FIN6 - FIN7 - Hive - Indrik Spider - Karakurt - Leviathan - LockBit - LuminousMoth - Mustang Panda - NetWalker - Nokoyawa - PLAY - Phobos - Qilin - Quantum - REvil - RagnarLocker - RansomEXX - Royal - Ryuk - Snatch - TA505 - Threat Group-3390 - Trigona - Vice Society - Wizard Spider - XingLocker - Yanluowang - menuPass - Unit 29155 - Akira - APT15 - APT26 - BRONZE STARLIGHT - COZY BEAR - Sandworm	Lateral Movement	https://github.com/0xthirteen/MoveKit	1	0	N/A	N/A	10	7	666	109	2020-02-21T20:23:45Z	2020-01-24T22:19:16Z	18620
616	\SharpMove.exe	.{0,1000}\\SharpMove\.exe.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	0	N/A	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	18625
617	\SharpMove.sln	.{0,1000}\\SharpMove\.sln.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	0	N/A	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	18626
618	\SharpNoPSExec	.{0,1000}\\SharpNoPSExec.{0,1000}	offensive_tool_keyword	SharpNoPSExec	Get file less command execution for Lateral Movement.	T1021.006 - T1059.003 - T1105	TA0008 - TA0002 - TA0011	N/A	N/A	Lateral Movement	https://github.com/juliourena/SharpNoPSExec	1	0	N/A	N/A	10	7	615	90	2022-06-03T10:32:55Z	2021-04-24T22:02:38Z	18632
619	\SharpRDP\	.{0,1000}\\SharpRDP\\.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	0	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	18650
620	\SharpRDPHijack	.{0,1000}\\SharpRDPHijack.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	0	N/A	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	18651
621	\SharpSCCM-main	.{0,1000}\\SharpSCCM\-main.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	N/A	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	18665
622	\SharpWSManWinRM.cs	.{0,1000}\\SharpWSManWinRM\.cs.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	18764
623	\SharpWSManWinRM.vbs	.{0,1000}\\SharpWSManWinRM\.vbs.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	18765
624	\smb_control.bat	.{0,1000}\\smb_control\.bat.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	18881
625	\SMB_RPC\.py	.{0,1000}\\SMB_RPC\\.{0,1000}\.py	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18882
626	\smb_SCNotification.exe	.{0,1000}\\smb_SCNotification\.exe.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	N/A	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	18883
627	\smbclient.exe	.{0,1000}\\smbclient\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	risk of false positives	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18886
628	\smbclient.py	.{0,1000}\\smbclient\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18887
629	\smbexec.py	.{0,1000}\\smbexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18888
630	\SMBGrab.pl	.{0,1000}\\SMBGrab\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	18889
631	\SMBHunt.pl	.{0,1000}\\SMBHunt\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	18890
632	\SMBList.pl	.{0,1000}\\SMBList\.pl.{0,1000}	offensive_tool_keyword	SMBCrunch	SMBCrunch allows a red teamer to quickly identify Windows File Shares in a network - performs a recursive directory listing of the provided shares and can even grab a file from the remote share if it looks like a juicy target.	T1021.002 - T1005 - T1210	TA0001 - TA0002 - TA0003 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Raikia/SMBCrunch	1	0	N/A	N/A	9	2	165	20	2018-03-07T15:50:12Z	2016-03-25T10:10:19Z	18891
633	\smblogin.ps1	.{0,1000}\\smblogin\.ps1.{0,1000}	offensive_tool_keyword	Minimalistic-offensive	A repository of tools for pentesting of restricted and isolated environments.	T1110 - T1046 - T1021 - T1203 - T1485	TA0006 - TA0007 - TA0008	N/A	Dispossessor	Lateral Movement	https://github.com/InfosecMatter/Minimalistic-offensive-security-tools	1	0	N/A	N/A	7	6	562	121	2021-10-26T11:04:46Z	2020-05-10T17:40:31Z	18892
634	\smblogin.results.txt	.{0,1000}\\smblogin\.results\.txt.{0,1000}	offensive_tool_keyword	Minimalistic-offensive	A repository of tools for pentesting of restricted and isolated environments.	T1110 - T1046 - T1021 - T1203 - T1485	TA0006 - TA0007 - TA0008	N/A	Dispossessor	Lateral Movement	https://github.com/InfosecMatter/Minimalistic-offensive-security-tools	1	0	N/A	N/A	7	6	562	121	2021-10-26T11:04:46Z	2020-05-10T17:40:31Z	18893
635	\smbpasswd.py	.{0,1000}\\smbpasswd\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18898
636	\smbrelayx.exe	.{0,1000}\\smbrelayx\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18901
637	\smbrelayx.py	.{0,1000}\\smbrelayx\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18902
638	\smbserver.py	.{0,1000}\\smbserver\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18906
639	\sniff.py	.{0,1000}\\sniff\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18922
640	\sniff.py	.{0,1000}\\sniff\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18923
641	\sniffer.exe	.{0,1000}\\sniffer\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18924
642	\sniffer.py	.{0,1000}\\sniffer\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	18925
643	\SOFTWARE\Sysinternals\PsExec\EulaAccepted	.{0,1000}\\SOFTWARE\\Sysinternals\\PsExec\\EulaAccepted.{0,1000}	greyware_tool_keyword	psexec	PsExec is a legitimate Microsoft tool for remote administration. However. attackers can misuse it to execute malicious commands or software on other network machines. install persistent threats. and evade some security systems.	T1136.002 - T1543.003 - T1570 - T1021.002 - T1569.002	TA0002 - TA0008 - TA0009 - TA0011	N/A	Turla - Chimera - APT1 - Thrip - Moses Staff - BlackTech - Cleaver - DarkVishnya - Sandworm Team - HAFNIUM - Akira - APT39 - FIN5 - FIN6 - Indrik Spider - TEMP.Veles - Kimsuky - GALLIUM - APT29 - Carbanak - Leafminer - FIN8 - Fox Kitten - Dragonfly - Magic Hound - OilRig - Cobalt Group - Naikon - Threat Group-1314 - menuPass - Wizard Spider - ALLANITE - APT20 - APT27 - Antlion - BOSS SPIDER - Common Raven - ENERGETIC BEAR - FIN7 - GOBLIN PANDA - PowerPool - INDRIK SPIDER - WIZARD SPIDER - TINY SPIDER - TA2101 - TRAVELING SPIDER - Common Raven - Antlion - Scattered Spider - COZY BEAR - EMBER BEAR - BERSERK BEAR - Gamaredon - Dispossessor	Lateral Movement	https://learn.microsoft.com/fr-fr/sysinternals/downloads/psexec	1	0	#registry	greyware tool - risks of False positive !	10	10	N/A	N/A	N/A	N/A	18976
644	\TChopper\chopper.	.{0,1000}\\TChopper\\chopper\..{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	19238
645	\Tchopper-main.zip	.{0,1000}\\Tchopper\-main\.zip.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	19239
646	\Temp\cme_hosted	.{0,1000}\\Temp\\cme_hosted.{0,1000}	offensive_tool_keyword	crackmapexec	CrackMapExec behavior	T1087.002 - T1110 - T1110.001 - T1110.003 - T1059.001 - T1083 - T1112 - T1135 - T1003.002 - T1003.003 - T1003.004 - T1201 - T1069.002 - T1018 - T1053.002 - T1082 - T1016 - T1049 - T1550.002 - T1047	TA0001 - TA0002 - TA0007 - TA0008	N/A	APT39 - Dragonfly - FIN7 - MuddyWater - ENERGETIC BEAR - EMBER BEAR - BERSERK BEAR - Black Basta	Lateral Movement	https://github.com/Porchetta-Industries/CrackMapExec	1	0	N/A	N/A	10	10	8690	1667	2023-12-06T17:09:42Z	2015-08-14T14:11:55Z	19279
647	\temp\ft.exe	.{0,1000}\\temp\\ft\.exe.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	N/A	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	19287
648	\Temp\Impersonate.exe	.{0,1000}\\Temp\\Impersonate\.exe.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	N/A	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	19289
649	\Temp\whoami.txt	.{0,1000}\\Temp\\whoami\.txt.{0,1000}	offensive_tool_keyword	crackmapexec	CrackMapExec behavior	T1087.002 - T1110 - T1110.001 - T1110.003 - T1059.001 - T1083 - T1112 - T1135 - T1003.002 - T1003.003 - T1003.004 - T1201 - T1069.002 - T1018 - T1053.002 - T1082 - T1016 - T1049 - T1550.002 - T1047	TA0001 - TA0002 - TA0007 - TA0008	N/A	APT39 - Dragonfly - FIN7 - MuddyWater - ENERGETIC BEAR - EMBER BEAR - BERSERK BEAR - Black Basta	Lateral Movement	https://github.com/Porchetta-Industries/CrackMapExec	1	0	N/A	N/A	10	10	8690	1667	2023-12-06T17:09:42Z	2015-08-14T14:11:55Z	19306
650	\TGT_Monitor.ps1	.{0,1000}\\TGT_Monitor\.ps1.{0,1000}	offensive_tool_keyword	TGT_Monitor	This script continuously monitors cache for new TGTs and displays them on the screen (admin privs required)	T1557.001 - T1040	TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/TGT_Monitor	1	0	N/A	N/A	9	1	3	0	2023-11-08T18:48:55Z	2023-11-07T22:53:45Z	19324
651	\ticketConverter.py	.{0,1000}\\ticketConverter\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19343
652	\ticketer.exe	.{0,1000}\\ticketer\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19344
653	\ticketer.py	.{0,1000}\\ticketer\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19345
654	\tmp_payload.txt	.{0,1000}\\tmp_payload\.txt.{0,1000}	offensive_tool_keyword	Tchopper	conduct Lateral Movement attack by leveraging unfiltered services display name to smuggle binaries as chunks into the target machine	T1021 - T1564	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/lawrenceamer/Tchopper	1	0	N/A	N/A	9	1	54	7	2021-06-14T08:27:31Z	2021-06-08T15:51:14Z	19366
655	\tstool.py	.{0,1000}\\tstool\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19437
656	\Users\Public\Documents\comm.txt	.{0,1000}\\Users\\Public\\Documents\\comm\.txt.{0,1000}	offensive_tool_keyword	Invoke-s4u2self	A tool that abuses s4u2self to gain access to remote hosts	T1550.002 - T1557.001	TA0008 - TA0009	N/A	N/A	Lateral Movement	https://github.com/Leo4j/Invoke-s4u2self	1	0	N/A	N/A	9	1	5	2	2025-02-13T16:27:51Z	2023-09-14T13:31:05Z	19560
657	\vcenter_creds.txt	.{0,1000}\\vcenter_creds\.txt.{0,1000}	offensive_tool_keyword	POC	PoC - Authenticated Remote Code Execution in VMware vCenter Server (CVE-2024-22274 Exploit)	T1213 - T1059 - T1056 - T1078 - T1578	TA0001 - TA0002 - TA0008 - TA0009	N/A	N/A	Lateral Movement	https://github.com/l0n3m4n/CVE-2024-22274-RCE	1	0	N/A	N/A	10	1	42	8	2024-07-16T23:22:14Z	2024-07-15T07:26:59Z	19598
658	\VncSharp.exe	.{0,1000}\\VncSharp\.exe.{0,1000}	greyware_tool_keyword	VncSharp	VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework	T1021.001 - T1219 - T1071.001	TA0007 - TA0008	Carbanak	FIN7 - Carbanak	Lateral Movement	https://github.com/humphd/VncSharp	1	0	N/A	N/A	8	3	246	179	2019-02-18T16:04:27Z	2012-03-05T15:23:41Z	19624
659	\VncSharp.sln	.{0,1000}\\VncSharp\.sln.{0,1000}	greyware_tool_keyword	VncSharp	VncSharp is a GPL implementation of the VNC Remote Framebuffer (RFB) Protocol for the .NET Framework	T1021.001 - T1219 - T1071.001	TA0007 - TA0008	Carbanak	FIN7 - Carbanak	Lateral Movement	https://github.com/humphd/VncSharp	1	0	N/A	N/A	8	3	246	179	2019-02-18T16:04:27Z	2012-03-05T15:23:41Z	19625
660	\windows\\temp\\sec.tmp	.{0,1000}\\windows\\\\temp\\\\sec\.tmp.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	19719
661	\Windows\Prefetch\PSEXEC	.{0,1000}\\Windows\\Prefetch\\PSEXEC.{0,1000}	greyware_tool_keyword	psexec	PsExec is a legitimate Microsoft tool for remote administration. However. attackers can misuse it to execute malicious commands or software on other network machines. install persistent threats. and evade some security systems.	T1136.002 - T1543.003 - T1570 - T1021.002 - T1569.002	TA0002 - TA0008 - TA0009 - TA0011	N/A	Turla - Chimera - APT1 - Thrip - Moses Staff - BlackTech - Cleaver - DarkVishnya - Sandworm Team - HAFNIUM - Akira - APT39 - FIN5 - FIN6 - Indrik Spider - TEMP.Veles - Kimsuky - GALLIUM - APT29 - Carbanak - Leafminer - FIN8 - Fox Kitten - Dragonfly - Magic Hound - OilRig - Cobalt Group - Naikon - Threat Group-1314 - menuPass - Wizard Spider - ALLANITE - APT20 - APT27 - Antlion - BOSS SPIDER - Common Raven - ENERGETIC BEAR - FIN7 - GOBLIN PANDA - PowerPool - INDRIK SPIDER - WIZARD SPIDER - TINY SPIDER - TA2101 - TRAVELING SPIDER - Common Raven - Antlion - Scattered Spider - COZY BEAR - EMBER BEAR - BERSERK BEAR - Gamaredon - Dispossessor	Lateral Movement	https://learn.microsoft.com/fr-fr/sysinternals/downloads/psexec	1	0	N/A	greyware tool - risks of False positive !	10	10	N/A	N/A	N/A	N/A	19726
662	\Windows\PSEXEC-.key*	.{0,1000}\\Windows\\PSEXEC\-.{0,1000}\.key.{0,1000}	greyware_tool_keyword	psexec	.key file created and deleted on the target system	T1136.002 - T1543.003 - T1570 - T1021.002 - T1569.002	TA0002 - TA0008 - TA0009 - TA0011	N/A	Turla - Chimera - APT1 - Thrip - Moses Staff - BlackTech - Cleaver - DarkVishnya - Sandworm Team - HAFNIUM - Akira - APT39 - FIN5 - FIN6 - Indrik Spider - TEMP.Veles - Kimsuky - GALLIUM - APT29 - Carbanak - Leafminer - FIN8 - Fox Kitten - Dragonfly - Magic Hound - OilRig - Cobalt Group - Naikon - Threat Group-1314 - menuPass - Wizard Spider - ALLANITE - APT20 - APT27 - Antlion - BOSS SPIDER - Common Raven - ENERGETIC BEAR - FIN7 - GOBLIN PANDA - PowerPool - INDRIK SPIDER - WIZARD SPIDER - TINY SPIDER - TA2101 - TRAVELING SPIDER - Common Raven - Antlion - Scattered Spider - COZY BEAR - EMBER BEAR - BERSERK BEAR - Gamaredon - Dispossessor	Lateral Movement	https://learn.microsoft.com/fr-fr/sysinternals/downloads/psexec	1	0	N/A	contain the hostname of the attacker in the file name	10	10	N/A	N/A	N/A	N/A	19727
663	\windows\temp\sam.tmp	.{0,1000}\\windows\\temp\\sam\.tmp.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	19755
664	\windows\temp\sam.tmp	.{0,1000}\\windows\\temp\\sam\.tmp.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	19756
665	\windows\temp\sec.tmp	.{0,1000}\\windows\\temp\\sec\.tmp.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	19759
666	\windows\temp\sec.tmp	.{0,1000}\\windows\\temp\\sec\.tmp.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	19760
667	\windows\temp\sys.tmp	.{0,1000}\\windows\\temp\\sys\.tmp.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	N/A	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	19761
668	\windows\temp\sys.tmp	.{0,1000}\\windows\\temp\\sys\.tmp.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	N/A	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	19762
669	\Windows\Temp\temp.ps1	.{0,1000}\\Windows\\Temp\\temp\.ps1.{0,1000}	offensive_tool_keyword	crackmapexec	CrackMapExec behavior	T1087.002 - T1110 - T1110.001 - T1110.003 - T1059.001 - T1083 - T1112 - T1135 - T1003.002 - T1003.003 - T1003.004 - T1201 - T1069.002 - T1018 - T1053.002 - T1082 - T1016 - T1049 - T1550.002 - T1047	TA0001 - TA0002 - TA0007 - TA0008	N/A	APT39 - Dragonfly - FIN7 - MuddyWater - ENERGETIC BEAR - EMBER BEAR - BERSERK BEAR - Black Basta	Lateral Movement	https://github.com/Porchetta-Industries/CrackMapExec	1	0	N/A	N/A	10	10	8690	1667	2023-12-06T17:09:42Z	2015-08-14T14:11:55Z	19764
670	\winexesvc.exe	.{0,1000}\\winexesvc\.exe.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	0	#servicename	N/A	8	8	N/A	N/A	N/A	N/A	19777
671	\wmeye.csproj	.{0,1000}\\wmeye\.csproj.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	0	N/A	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	19832
672	\wmeye.pdb	.{0,1000}\\wmeye\.pdb.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	0	N/A	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	19833
673	\wmiexec.py	.{0,1000}\\wmiexec\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19842
674	\WMIHACKER.vbs	.{0,1000}\\WMIHACKER\.vbs.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	19845
675	\wmihacker_0.4.vbe	.{0,1000}\\wmihacker_0\.4\.vbe.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	19846
676	\WMIHACKER_0.6.vbs	.{0,1000}\\WMIHACKER_0\.6\.vbs.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	N/A	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	19847
677	\wmipersist.exe	.{0,1000}\\wmipersist\.exe.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19848
678	\wmipersist.py	.{0,1000}\\wmipersist\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19849
679	\wmiquery.py	.{0,1000}\\wmiquery\.py.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	19850
680	\WSManWinRM.ps1	.{0,1000}\\WSManWinRM\.ps1.{0,1000}	offensive_tool_keyword	WSMan-WinRM	remote commands over WinRM using the WSMan.Automation COM object	T1021.004 - T1059.001	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/bohops/WSMan-WinRM	1	0	N/A	N/A	10	3	236	40	2020-05-12T16:49:01Z	2020-05-12T01:30:42Z	19876
681	] Stopping LLMNR spoofing"	.{0,1000}\]\sStopping\sLLMNR\sspoofing\".{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#content	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	20083
682	_impacket.tar.gz*	.{0,1000}_impacket.{0,1000}\.tar\.gz.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	1	N/A	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	20131
683	~/.csexec	.{0,1000}\~\/\.csexec.{0,1000}	offensive_tool_keyword	CSExec	An alternative to *exec.py from impacket with some builtin tricks	T1059.001 - T1059.005 - T1071.001	TA0002	N/A	N/A	Lateral Movement	https://github.com/Metro-Holografix/CSExec.py	1	0	N/A	private github repo	10		N/A				20196
684	=Administrator.ccache	.{0,1000}\=Administrator\.ccache.{0,1000}	offensive_tool_keyword	PKINITtools	Tools for Kerberos PKINIT and relaying to AD CS	T1550.003 - T1557.002 - T1552.004 - T1212 - T1550	TA0009 - TA0008	N/A	N/A	Lateral Movement	https://github.com/dirkjanm/PKINITtools	1	0	N/A	N/A	N/A	8	737	82	2025-01-03T14:25:52Z	2021-07-27T19:06:09Z	20292
685	>\fuego-control	.{0,1000}\>\\fuego\-control.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	#namedpipe	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	20307
686	>\fuego-data	.{0,1000}\>\\fuego\-data.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	#namedpipe	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	20308
687	>\fuegoshell	.{0,1000}\>\\fuegoshell.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	#namedpipe	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	20309
688	>csexec<	.{0,1000}\>csexec\<.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#companyname	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	20361
689	>csexecsvc<	.{0,1000}\>csexecsvc\<.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#servicename	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	20362
690	>SharpCOM<	.{0,1000}\>SharpCOM\<.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	N/A	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	20538
691	>winexesvc<	.{0,1000}\>winexesvc\<.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	0	#servicename	N/A	8	8	N/A	N/A	N/A	N/A	20620
692	00630066-0B43-474E-A93B-417CF1A65195	.{0,1000}00630066\-0B43\-474E\-A93B\-417CF1A65195.{0,1000}	offensive_tool_keyword	impersonate	A windows token impersonation tool	T1134 - T1550	TA0004 - TA0003	N/A	N/A	Lateral Movement	https://github.com/sensepost/impersonate	1	0	#GUIDproject	N/A	10	4	301	38	2023-04-19T12:53:50Z	2022-10-28T06:30:02Z	20660
693	0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f	.{0,1000}0259d41720f7084716a3b2bbe34ac6d3021224420f81a4e839b0b3401e5ef29f.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	0	#filehash	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	20799
694	03652836-898E-4A9F-B781-B7D86E750F60	.{0,1000}03652836\-898E\-4A9F\-B781\-B7D86E750F60.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	#GUIDproject	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	20891
695	037f7348a66495d6502220e15f3766aa070dd12eb40b3d08d3f855c4cd77cf7f	.{0,1000}037f7348a66495d6502220e15f3766aa070dd12eb40b3d08d3f855c4cd77cf7f.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	#filehash	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	20903
696	04080e338ffd161caf57ae0c76b1267210fe2c2a68ede32c52d4efca6e38514a	.{0,1000}04080e338ffd161caf57ae0c76b1267210fe2c2a68ede32c52d4efca6e38514a.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	20944
697	0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887	.{0,1000}0439628816cabe113315751e7113a9e9f720d7e499ffdd78acbac1ed8ba35887.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	0	#filehash	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	20973
698	050720C033870D6BC6D8138D662A3AC0AC5B07858A428C594F81B7B1B55AB963	.{0,1000}050720C033870D6BC6D8138D662A3AC0AC5B07858A428C594F81B7B1B55AB963.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	21024
699	05C00EED2E07D2BB64FFC34AA3BA0A8D9F0DE71909ABA35706A074F23285F83B	.{0,1000}05C00EED2E07D2BB64FFC34AA3BA0A8D9F0DE71909ABA35706A074F23285F83B.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	21072
700	080de56a40e4ff15b0157da0224988a36f3e7c2347d58824ab3880f338d3eaec	.{0,1000}080de56a40e4ff15b0157da0224988a36f3e7c2347d58824ab3880f338d3eaec.{0,1000}	offensive_tool_keyword	WMEye	WMEye is a post exploitation tool that uses WMI Event Filter and MSBuild Execution for Lateral Movement	T1047 - T1053.005 - T1124 - T1203 - T1569.002	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/pwn1sher/WMEye	1	0	#filehash	N/A	8	4	365	59	2021-12-24T05:38:50Z	2021-09-07T08:18:30Z	21237
701	099c3eb732a58c9f6c99b0920f10a1d516577009c1c2ac1a1da4133a7092db57	.{0,1000}099c3eb732a58c9f6c99b0920f10a1d516577009c1c2ac1a1da4133a7092db57.{0,1000}	offensive_tool_keyword	POC	PoC - Authenticated Remote Code Execution in VMware vCenter Server (CVE-2024-22274 Exploit)	T1213 - T1059 - T1056 - T1078 - T1578	TA0001 - TA0002 - TA0008 - TA0009	N/A	N/A	Lateral Movement	https://github.com/l0n3m4n/CVE-2024-22274-RCE	1	0	#filehash	N/A	10	1	42	8	2024-07-16T23:22:14Z	2024-07-15T07:26:59Z	21356
702	0c9c1d4a02cdc9cac7b19c0b055468d9c04714c00bd3df254490ecf4953c5c95	.{0,1000}0c9c1d4a02cdc9cac7b19c0b055468d9c04714c00bd3df254490ecf4953c5c95.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	#filehash	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	21560
703	0d8f28ea01d3866ad7ee4abbdc5bdfd83d41702dcf029584ef30cb0055be8538	.{0,1000}0d8f28ea01d3866ad7ee4abbdc5bdfd83d41702dcf029584ef30cb0055be8538.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	#filehash	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	21636
704	0db0228defb8d913de486d4f799be97bc75b5aa2ae72c2fc1e99389aeb92b170	.{0,1000}0db0228defb8d913de486d4f799be97bc75b5aa2ae72c2fc1e99389aeb92b170.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#filehash	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	21643
705	0DD419E5-D7B3-4360-874E-5838A7519355	.{0,1000}0DD419E5\-D7B3\-4360\-874E\-5838A7519355.{0,1000}	offensive_tool_keyword	CheeseTools	tools for Lateral Movement/Code Execution	T1021.006 - T1059.003 - T1105	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/klezVirus/CheeseTools	1	0	#GUIDproject	N/A	10	8	706	143	2021-08-17T20:22:56Z	2020-08-24T01:28:12Z	21660
706	0e5ae252e2597d44f6e8def9fcdd3562954130a0261776e083959d067795c450	.{0,1000}0e5ae252e2597d44f6e8def9fcdd3562954130a0261776e083959d067795c450.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	#filehash	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	21700
707	0xthirteen/MoveKit	.{0,1000}0xthirteen\/MoveKit.{0,1000}	offensive_tool_keyword	cobaltstrike	Cobalt Strike kit for Lateral Movement	T1021.002 - T1021.006 - T1021.004	TA0008 - TA0002	N/A	APT19 - MAZE - APT32 - APT37 - APT41 - Aquatic Panda - AvosLocker - Black Basta - BlackByte - BlackCat - BlackSuit - CL0P - Cactus - Chimera - Cobalt Group - Conti - Common Raven - CopyKittens - Cuba - Dagon Locker - DarkHydrus - Diavol - Earth Lusca - EvilCorp* - FIN6 - FIN7 - Hive - Indrik Spider - Karakurt - Leviathan - LockBit - LuminousMoth - Mustang Panda - NetWalker - Nokoyawa - PLAY - Phobos - Qilin - Quantum - REvil - RagnarLocker - RansomEXX - Royal - Ryuk - Snatch - TA505 - Threat Group-3390 - Trigona - Vice Society - Wizard Spider - XingLocker - Yanluowang - menuPass - Unit 29155 - Akira - APT15 - APT26 - BRONZE STARLIGHT - COZY BEAR - Sandworm	Lateral Movement	https://github.com/0xthirteen/MoveKit	1	1	N/A	N/A	10	7	666	109	2020-02-21T20:23:45Z	2020-01-24T22:19:16Z	21857
708	0xthirteen/PerfExec	.{0,1000}0xthirteen\/PerfExec.{0,1000}	offensive_tool_keyword	PerfExec	PerfExec - an example performance dll that will run CMD.exe and a .NET assembly that will execute the DLL or gather performance data locally or remotely.	T1055.001 - T1059.001 - T1059.003 - T1027.002	TA0002 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/PerfExec	1	1	N/A	N/A	7	1	77	12	2023-08-02T20:53:24Z	2023-07-11T16:43:47Z	21858
709	0xthirteen/SharpMove	.{0,1000}0xthirteen\/SharpMove.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	1	N/A	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	21859
710	0xthirteen/SharpRDP	.{0,1000}0xthirteen\/SharpRDP.{0,1000}	offensive_tool_keyword	SharpRDP	Remote Desktop Protocol .NET Console Application for Authenticated Command Execution	T1021.001 - T1059.001 - T1059.003	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpRDP	1	1	N/A	N/A	10	10	1041	554	2022-11-13T05:29:33Z	2020-01-21T08:31:50Z	21860
711	1004ed17f2164c6dd249f7d640e8c8250e6c47d9e4d2c8748becb05591a8539b	.{0,1000}1004ed17f2164c6dd249f7d640e8c8250e6c47d9e4d2c8748becb05591a8539b.{0,1000}	offensive_tool_keyword	TGT_Monitor	This script continuously monitors cache for new TGTs and displays them on the screen (admin privs required)	T1557.001 - T1040	TA0006 - TA0008	N/A	N/A	Lateral Movement	https://github.com/Leo4j/TGT_Monitor	1	0	#filehash	N/A	9	1	3	0	2023-11-08T18:48:55Z	2023-11-07T22:53:45Z	21870
712	10244cbbce7a1608b471e26612dbc9ed658d4dde66f5075d6becb5834df8af8b	.{0,1000}10244cbbce7a1608b471e26612dbc9ed658d4dde66f5075d6becb5834df8af8b.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	21879
713	108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a	.{0,1000}108243f61c53f00f8f1adcf67c387a8833f1a2149f063dd9ef29205c90a3c30a.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	0	#filehash	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	21900
714	10dbc6cb2d71505d7add5a2927228077142851657f2578b9c774656505338d32	.{0,1000}10dbc6cb2d71505d7add5a2927228077142851657f2578b9c774656505338d32.{0,1000}	offensive_tool_keyword	atexec-pro	Fileless atexec for lateral movement	T1021.002 - T1105	TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Ridter/atexec-pro	1	0	#filehash	N/A	10	4	366	45	2024-03-28T03:36:50Z	2024-03-27T09:15:00Z	21919
715	11ef63b9bc33b0da6d0b5593e55e460aa8aa8279eb9ad4b90a4dc2b722ffa6e1	.{0,1000}11ef63b9bc33b0da6d0b5593e55e460aa8aa8279eb9ad4b90a4dc2b722ffa6e1.{0,1000}	offensive_tool_keyword	impacketremoteshell	install a legit application and interface with it over smb w/o the signature of cmd.exe / powershell.exe being called or the redirection typically used by those techniques	T1077 - T1059.007 - T1569.001	TA0008 - TA0005 - TA0040	N/A	N/A	Lateral Movement	https://github.com/trustedsec/The_Shelf	1	0	#filehash	N/A	10	3	247	14	2024-11-25T19:33:34Z	2024-05-22T14:31:52Z	21998
716	1232372059db3ecf28cc2609a36b7f20cef2dfe0618770e3ebaa9488bc7fc2de	.{0,1000}1232372059db3ecf28cc2609a36b7f20cef2dfe0618770e3ebaa9488bc7fc2de.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	#filehash	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	22022
717	127f1bfca312fa054a6e761df8c330967ed93dbe80ca78357e9b727faea0c5ef	.{0,1000}127f1bfca312fa054a6e761df8c330967ed93dbe80ca78357e9b727faea0c5ef.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	#filehash	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	22062
718	131bacdddd51f0d5d869b63912606719cd8f7a8f5b5f4237cbdb5c2e22e2cba2	.{0,1000}131bacdddd51f0d5d869b63912606719cd8f7a8f5b5f4237cbdb5c2e22e2cba2.{0,1000}	offensive_tool_keyword	WMIHACKER	Bypass anti-virus software lateral movement command execution test tool - No need 445 Port	T1047 - T1569.002 - T1218 - T1036.005	TA0008 - TA0002 - TA0005	N/A	N/A	Lateral Movement	https://github.com/rootclay/WMIHACKER	1	0	#filehash	N/A	9	10	1423	236	2025-01-20T15:37:28Z	2020-07-02T06:57:25Z	22108
719	13C84182-2F5F-4EE8-A37A-4483E7E57154	.{0,1000}13C84182\-2F5F\-4EE8\-A37A\-4483E7E57154.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	0	#GUIDproject	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	22156
720	14a2502eebb62133aad519e2717558388f459a4fe281566fbeb0251b0ab2611b	.{0,1000}14a2502eebb62133aad519e2717558388f459a4fe281566fbeb0251b0ab2611b.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	22211
721	15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9	.{0,1000}15292172a83f2e7f07114693ab92753ed32311dfba7d54fe36cc7229136874d9.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	0	#filehash	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	22250
722	1917921CEF704F71B692C3EC0D238FE98AF8EF1EE20CACAAD67FBC3BB885EE9A	.{0,1000}1917921CEF704F71B692C3EC0D238FE98AF8EF1EE20CACAAD67FBC3BB885EE9A.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	22504
723	1B826591784D6FBFB1BED96065D7EBD9982723D3EEC2386614088AAA4CA84F0D	.{0,1000}1B826591784D6FBFB1BED96065D7EBD9982723D3EEC2386614088AAA4CA84F0D.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	22692
724	1be9af3e46ecda17aed9e3c5c563003b5f1fd31b9833fd85e69e11fb53a6bc4d	.{0,1000}1be9af3e46ecda17aed9e3c5c563003b5f1fd31b9833fd85e69e11fb53a6bc4d.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#filehash	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	22717
725	1CB9BB2AEE8B6A248427185F165AD3FDDAE8EA923D338C40E93E6F47F1C3F351	.{0,1000}1CB9BB2AEE8B6A248427185F165AD3FDDAE8EA923D338C40E93E6F47F1C3F351.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	22771
726	1DCD5A4349F3E617AF53DCFA24600FD169CFDD53DECE33FD72C6D66C2991D240	.{0,1000}1DCD5A4349F3E617AF53DCFA24600FD169CFDD53DECE33FD72C6D66C2991D240.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	22850
727	2077c0c96383793ffa5b0843740f9b095688df5f5accd1a74c65f634bbc42358	.{0,1000}2077c0c96383793ffa5b0843740f9b095688df5f5accd1a74c65f634bbc42358.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	0	#filehash #linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	23071
728	2170a03a337a89bb3b6a02035ae85946815f8643897ded40fc0a2c29e2e5a960	.{0,1000}2170a03a337a89bb3b6a02035ae85946815f8643897ded40fc0a2c29e2e5a960.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	#filehash	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	23137
729	21f131f283dffa84c44aa6c4c62bb97b77c8de8a08fb6ba50a449bdf9fa8bd46	.{0,1000}21f131f283dffa84c44aa6c4c62bb97b77c8de8a08fb6ba50a449bdf9fa8bd46.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	23161
730	21f59168d9679a4567facac1b9146c930bc5e47c7c5ad248ed9e4e4582c25008	.{0,1000}21f59168d9679a4567facac1b9146c930bc5e47c7c5ad248ed9e4e4582c25008.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	#filehash	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	23164
731	25d89bd7da43e326b9bfadeae2c256cf1f06c8522b475d43baecf309b2fa6da7	.{0,1000}25d89bd7da43e326b9bfadeae2c256cf1f06c8522b475d43baecf309b2fa6da7.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	23448
732	26048dbf252141d3db4df311c6d70188c91bf1e4d3bb8cd8870b373566562a1d	.{0,1000}26048dbf252141d3db4df311c6d70188c91bf1e4d3bb8cd8870b373566562a1d.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	#filehash	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	23457
733	26af9c0734525448e4a8d56c9c7b05df0146497ec71101c33812f3f3503201eb	.{0,1000}26af9c0734525448e4a8d56c9c7b05df0146497ec71101c33812f3f3503201eb.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	23510
734	26ee5086d8cc0404b7088ebe9e121e090261ce9185a9d4bf2394504fc8415f45	.{0,1000}26ee5086d8cc0404b7088ebe9e121e090261ce9185a9d4bf2394504fc8415f45.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	23533
735	27f70a1d533f7a3b8703d89904ae4541d96c8c656661872a495f592f9ed80d9e	.{0,1000}27f70a1d533f7a3b8703d89904ae4541d96c8c656661872a495f592f9ed80d9e.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	0	#filehash	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	23597
736	29548EB7-5E44-21F9-5C82-15DDDC80449A	.{0,1000}29548EB7\-5E44\-21F9\-5C82\-15DDDC80449A.{0,1000}	greyware_tool_keyword	RemCom	Remote Command Executor: A OSS replacement for PsExec and RunAs	T1077 - T1059 - T1021 - T1569.002	TA0002 - TA0005 - TA0008	N/A	APT33 - TA558 - The Gorgon Group - Common Raven - APT-C-36 - Operation Comando	Lateral Movement	https://github.com/kavika13/RemCom	1	0	#GUIDproject	N/A	10	4	346	100	2017-10-30T04:48:38Z	2011-11-09T11:00:09Z	23687
737	29E4E73B-EBA6-495B-A76C-FBB462196C64	.{0,1000}29E4E73B\-EBA6\-495B\-A76C\-FBB462196C64.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	#GUIDproject	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	23725
738	2a222cd3c05cdbf6db8c226743bbb46ce9e384c1f59e39072d60910b1099b80c	.{0,1000}2a222cd3c05cdbf6db8c226743bbb46ce9e384c1f59e39072d60910b1099b80c.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	0	#filehash	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	23735
739	2D4A23D2A7F25F007CB0B5E17F50B6B84C09560BFB3232B176E74AE4F97B3E89	.{0,1000}2D4A23D2A7F25F007CB0B5E17F50B6B84C09560BFB3232B176E74AE4F97B3E89.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	23933
740	2e70b4bcc21c4aba64c283af815b20d52c79c93f14f9df623a6e588491155acf	.{0,1000}2e70b4bcc21c4aba64c283af815b20d52c79c93f14f9df623a6e588491155acf.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	#filehash	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	24004
741	2eb2cc1eb661148109488b8f36aa6b248e88c0f1	.{0,1000}2eb2cc1eb661148109488b8f36aa6b248e88c0f1.{0,1000}	offensive_tool_keyword	crackmapexec	crack mapexec script used by Dispossessor ransomware group	T1486 - T1490 - T1059 - T1213 - T1078	TA0040 - TA0043 - TA0001 - TA0009	N/A	Dispossessor - APT39 - Dragonfly - FIN7 - MuddyWater - ENERGETIC BEAR - EMBER BEAR - BERSERK BEAR - Black Basta	Lateral Movement	https://vx-underground.org/Archive/Dispossessor%20Leaks	1	0	N/A	N/A	10	10	N/A	N/A	N/A	N/A	24036
742	2fbf10428ccc2e463e88aae2aadd3efdf686d510c42d7b5aca2b4f126bb8296f	.{0,1000}2fbf10428ccc2e463e88aae2aadd3efdf686d510c42d7b5aca2b4f126bb8296f.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	24120
743	2fe3e062aad09c372500bdef858a32344d95c7b8036d4cb5f0091a2db17b446f	.{0,1000}2fe3e062aad09c372500bdef858a32344d95c7b8036d4cb5f0091a2db17b446f.{0,1000}	offensive_tool_keyword	dcomhijack	Lateral Movement Using DCOM with impacket and DLL Hijacking	T1570 - T1021.003 - T1574.001 - T1574.002	TA0008 - TA0003 - TA0005	N/A	N/A	Lateral Movement	https://github.com/WKL-Sec/dcomhijack	1	0	#filehash	N/A	7	3	290	24	2023-06-18T20:34:03Z	2023-06-17T20:23:24Z	24136
744	2FEB96F5-08E6-48A3-B306-794277650A08	.{0,1000}2FEB96F5\-08E6\-48A3\-B306\-794277650A08.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	#GUIDproject	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	24140
745	2FEB96F5-08E6-48A3-B306-794277650A08	.{0,1000}2FEB96F5\-08E6\-48A3\-B306\-794277650A08.{0,1000}	greyware_tool_keyword	PAExec	PAExec is a freely-redistributable re-implementation of SysInternal/Microsoft's popular PsExec program	T1047 - T1105 - T1204	TA0003 - TA0008 - TA0040	N/A	N/A	Lateral Movement	https://github.com/poweradminllc/PAExec	1	0	#GUIDproject	N/A	10	6	560	177	2025-02-21T15:14:44Z	2013-11-13T04:05:27Z	24141
746	35a9481ddbed5177431a9ea4bd09468fe987797d7b1231d64942d17eb54ec269	.{0,1000}35a9481ddbed5177431a9ea4bd09468fe987797d7b1231d64942d17eb54ec269.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	#filehash	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	24556
747	35c8d88f94fff53d9dd573801f16aa02e24f771668747e3f0d2975ff4d0b85b8	.{0,1000}35c8d88f94fff53d9dd573801f16aa02e24f771668747e3f0d2975ff4d0b85b8.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	24560
748	3699b102bf5ad1120ef560ae3036f27c74f6161b62b31fda8087bd7ae1496ee1	.{0,1000}3699b102bf5ad1120ef560ae3036f27c74f6161b62b31fda8087bd7ae1496ee1.{0,1000}	greyware_tool_keyword	rdpwrap	RDP Wrapper Library used by malwares	T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/stascorp/rdpwrap	1	0	#filehash	N/A	10	10	15332	3911	2024-06-18T15:08:33Z	2014-10-22T23:18:28Z	24610
749	36F9C306-5F45-4946-A259-610C05BD90DF	.{0,1000}36F9C306\-5F45\-4946\-A259\-610C05BD90DF.{0,1000}	offensive_tool_keyword	CheeseTools	tools for Lateral Movement/Code Execution	T1021.006 - T1059.003 - T1105	TA0008 - TA0002	N/A	N/A	Lateral Movement	https://github.com/klezVirus/CheeseTools	1	0	#GUIDproject	N/A	10	8	706	143	2021-08-17T20:22:56Z	2020-08-24T01:28:12Z	24645
750	37618f36a162e667eb98cb36bc1568524f87efc7cc12ef6d0ea4ef2f225c799d	.{0,1000}37618f36a162e667eb98cb36bc1568524f87efc7cc12ef6d0ea4ef2f225c799d.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	0	#filehash	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	24674
751	379F3514AA07B5A9783639932C3ABF48F68742FE4B65C4A94436632C2AB53AFC	.{0,1000}379F3514AA07B5A9783639932C3ABF48F68742FE4B65C4A94436632C2AB53AFC.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	24690
752	3979fa127a6e7b52d76b4b92fa2fd3be3d51acfcf109da79ac51ab812cc16098	.{0,1000}3979fa127a6e7b52d76b4b92fa2fd3be3d51acfcf109da79ac51ab812cc16098.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	24831
753	3989cbea4af22774f0fa20d10b88c7247e675be8b9ec9dae716a44cb36d50189	.{0,1000}3989cbea4af22774f0fa20d10b88c7247e675be8b9ec9dae716a44cb36d50189.{0,1000}	offensive_tool_keyword	petipotam	PoC tool to coerce Windows hosts to authenticate to other machines via MS-EFSRPC EfsRpcOpenFileRaw or other functions.	T1557.001 - T1021	TA0008	N/A	N/A	Lateral Movement	https://github.com/topotam/PetitPotam	1	0	#filehash	N/A	10	10	1944	290	2024-08-15T03:52:26Z	2021-07-18T18:19:54Z	24835
754	3A128F79ABB162476A7677270884213C983E3F07A4850C930C8F9E7BEB38EB50	.{0,1000}3A128F79ABB162476A7677270884213C983E3F07A4850C930C8F9E7BEB38EB50.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	24865
755	3aff2f105c353378acd29dc43635769952d715d50e8cc87df39acf938c06d7c6	.{0,1000}3aff2f105c353378acd29dc43635769952d715d50e8cc87df39acf938c06d7c6.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	24931
756	3b0c09c1852353c15372d27a6c0971472ef165c093024073990446219a887034	.{0,1000}3b0c09c1852353c15372d27a6c0971472ef165c093024073990446219a887034.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#filehash	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	24936
757	3b3b3491978395ddceeab0ee18aa25ae8fcb1a8df43ef80ab4423517e9c5f566	.{0,1000}3b3b3491978395ddceeab0ee18aa25ae8fcb1a8df43ef80ab4423517e9c5f566.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#filehash	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	24944
758	3B47EEBC-0D33-4E0B-BAB5-782D2D3680AF	.{0,1000}3B47EEBC\-0D33\-4E0B\-BAB5\-782D2D3680AF.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#GUIDproject	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	24948
759	3b765fc9d51180b7ff8c93aa1ab9369fdff33f5ec4ebc4c2e913f8355ca12903	.{0,1000}3b765fc9d51180b7ff8c93aa1ab9369fdff33f5ec4ebc4c2e913f8355ca12903.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	#filehash	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	24959
760	3gstudent/Smbtouch-Scanner	.{0,1000}3gstudent\/Smbtouch\-Scanner.{0,1000}	offensive_tool_keyword	Smbtouch-Scanner	Smbtouch detect whether the target is vulnerable of one of these vulnerabilities: ETERNALBLUE - ETERNALCHAMPION - ETERNALROMANCE - ETERNALSYNERGY	T1210 - T1046 - T1133	TA0007 - TA0043 - TA0008	N/A	APT15 - Turla	Lateral Movement	https://github.com/3gstudent/Smbtouch-Scanner	1	1	N/A	N/A	10	2	140	66	2021-04-17T01:42:06Z	2017-04-21T01:38:55Z	25281
761	404cf0d13d243deeeb2b94b9bf807164376a916377e537604a576e6036f84e9d	.{0,1000}404cf0d13d243deeeb2b94b9bf807164376a916377e537604a576e6036f84e9d.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25321
762	41414141-4141-4141-4141-414141414141	.{0,1000}41414141\-4141\-4141\-4141\-414141414141.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	N/A	default SMB challenge https://pbs.twimg.com/media/GHcBPL8a4AA18Jl?format=jpg	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25395
763	41a381d6e85d5d47296485417fab7a07c110c98927990415993d75c07f384e3c	.{0,1000}41a381d6e85d5d47296485417fab7a07c110c98927990415993d75c07f384e3c.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25432
764	41A90A6A-F9ED-4A2F-8448-D544EC1FD753	.{0,1000}41A90A6A\-F9ED\-4A2F\-8448\-D544EC1FD753.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#GUIDproject	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	25436
765	41A90A6A-F9ED-4A2F-8448-D544EC1FD754	.{0,1000}41A90A6A\-F9ED\-4A2F\-8448\-D544EC1FD754.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#GUIDproject	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	25438
766	41A90A6A-F9ED-4A2F-8448-D544EC1FD755	.{0,1000}41A90A6A\-F9ED\-4A2F\-8448\-D544EC1FD755.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#GUIDproject	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	25440
767	41d38b945928ee53bd8b1f3b230ecf3101f6c2249d1ec4d3d920a163045373b8	.{0,1000}41d38b945928ee53bd8b1f3b230ecf3101f6c2249d1ec4d3d920a163045373b8.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#filehash	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	25452
768	42c6d6eb1e991b9adbdb2ec6563530d9123bd02dbde27e2a547c25d9feb41473	.{0,1000}42c6d6eb1e991b9adbdb2ec6563530d9123bd02dbde27e2a547c25d9feb41473.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25517
769	43BB3C30-39D7-4B6B-972E-1E2B94D4D53A	.{0,1000}43BB3C30\-39D7\-4B6B\-972E\-1E2B94D4D53A.{0,1000}	offensive_tool_keyword	SharpShellPipe	interactive remote shell access via named pipes and the SMB protocol.	T1056.002 - T1021.002 - T1059.001	TA0005 - TA0009 - TA0002	N/A	N/A	Lateral Movement	https://github.com/DarkCoderSc/SharpShellPipe	1	0	#GUIDproject	N/A	8	2	118	14	2025-02-21T12:33:43Z	2023-08-25T15:18:30Z	25594
770	43ebdb62e179113a55ccd4297316532582be71857b85d85ba187cd6146757397	.{0,1000}43ebdb62e179113a55ccd4297316532582be71857b85d85ba187cd6146757397.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25609
771	44de69934c7cc1b42b995276af916e6a14d8f2170f5de9306ed1e134d8f007de	.{0,1000}44de69934c7cc1b42b995276af916e6a14d8f2170f5de9306ed1e134d8f007de.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25674
772	44e769288f34ec5abca4d42a2ff890bf7e9f00218abce392076682226a74de45	.{0,1000}44e769288f34ec5abca4d42a2ff890bf7e9f00218abce392076682226a74de45.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#filehash	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	25675
773	450c54e126cbd38523f6dce014bd30bc95ede55141ffc3360b1dd6989895b28f	.{0,1000}450c54e126cbd38523f6dce014bd30bc95ede55141ffc3360b1dd6989895b28f.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25686
774	455a5ed5b8aca163fd8bbc11a06de8b652517c50a32c634f33a6a093d47e3d4e	.{0,1000}455a5ed5b8aca163fd8bbc11a06de8b652517c50a32c634f33a6a093d47e3d4e.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	25714
775	45787955618ba3211b89021ddf23ecc5d2b55397a006190455c4070dad964572	.{0,1000}45787955618ba3211b89021ddf23ecc5d2b55397a006190455c4070dad964572.{0,1000}	offensive_tool_keyword	LatLoader	PoC module to demonstrate automated lateral movement with the Havoc C2 framework	T1570 - T1071 - T1021 - T1563 - T1105	TA0008 - TA0011 - TA0002 - TA0010	N/A	N/A	Lateral Movement	https://github.com/icyguider/LatLoader	1	0	#filehash	N/A	9	4	301	35	2023-12-09T00:28:32Z	2023-10-06T15:03:17Z	25723
776	4592e0848e4929ac2b6ba4593f8cbfe09f52ce6ca4206ce52087a31073903645	.{0,1000}4592e0848e4929ac2b6ba4593f8cbfe09f52ce6ca4206ce52087a31073903645.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	0	#filehash	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	25730
777	461F72D2-6BDC-4D0E-82EE-59A811AB4844	.{0,1000}461F72D2\-6BDC\-4D0E\-82EE\-59A811AB4844.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#GUIDproject	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	25764
778	4848f468fc1f6b5c933d83be4e9295cf6af8eb74b789fdf0a6f116c7444808b2	.{0,1000}4848f468fc1f6b5c933d83be4e9295cf6af8eb74b789fdf0a6f116c7444808b2.{0,1000}	offensive_tool_keyword	SharpExShell	SharpExShell automates the DCOM lateral movment technique which abuses ActivateMicrosoftApp method of Excel application	T1021.003 - T1218.007 - T1127.001	TA0008 - TA0009 - TA0005	N/A	N/A	Lateral Movement	https://github.com/grayhatkiller/SharpExShell	1	0	#filehash	N/A	8	1	70	15	2024-05-01T23:17:25Z	2023-10-30T18:16:41Z	25916
779	4A5A36539C52FB818E21404B336FC1936B4B5A6AFBB432CD9DB9672F2BAC1B73	.{0,1000}4A5A36539C52FB818E21404B336FC1936B4B5A6AFBB432CD9DB9672F2BAC1B73.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	26043
780	4bf7e7b595356585599b4b2773b8a463d7b9765c97012dcd5a44eb6d547f6a1d	.{0,1000}4bf7e7b595356585599b4b2773b8a463d7b9765c97012dcd5a44eb6d547f6a1d.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	26176
781	4C244D2DFBC2E2A8803D3F5522D9F4A788A3A38AF3A37D86D6374A56218D29E9	.{0,1000}4C244D2DFBC2E2A8803D3F5522D9F4A788A3A38AF3A37D86D6374A56218D29E9.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	26196
782	4EE2C7E8-095D-490A-9465-9B4BB9070669	.{0,1000}4EE2C7E8\-095D\-490A\-9465\-9B4BB9070669.{0,1000}	offensive_tool_keyword	Maestro	Maestro is a post-exploitation tool that simplifies interaction with Intune/EntraID from a C2 agent on a user's workstation bypassing the need for user password knowledge - token manipulation or Azure authentication processes	T1550.004 - T1078 - T1087 - T1071 - T1102	TA0006 - TA0003 - TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/Maestro	1	0	#GUIDproject	behavior detections opportunities here https://posts.specterops.io/requesting-azure-ad-request-tokens-on-azure-ad-joined-machines-for-browser-sso-2b0409caad30	9	4	333	33	2025-02-11T23:02:00Z	2024-01-15T18:45:50Z	26389
783	4f1fcdf5b4c104fb6585cd73272adc8e31a279dffd5cae84e5e83c685f4830bd	.{0,1000}4f1fcdf5b4c104fb6585cd73272adc8e31a279dffd5cae84e5e83c685f4830bd.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	26407
784	51960F7D-76FE-499F-AFBD-ACABD7BA50D1	.{0,1000}51960F7D\-76FE\-499F\-AFBD\-ACABD7BA50D1.{0,1000}	offensive_tool_keyword	SharpCOM	DCOM Lateral Movement	T1175	TA0008	N/A	N/A	Lateral Movement	https://github.com/rvrsh3ll/SharpCOM	1	0	#GUIDproject	N/A	10	2	128	30	2019-09-16T22:52:53Z	2018-12-13T15:10:55Z	26588
785	51f92adcb4397e57d3809d3fa76bbf2cfb8ca772551b755ea8b0b3a6ba316334	.{0,1000}51f92adcb4397e57d3809d3fa76bbf2cfb8ca772551b755ea8b0b3a6ba316334.{0,1000}	offensive_tool_keyword	PassTheCert	tool to authenticate to an LDAP/S server with a certificate through Schannel	T1557 - T1071 - T1021 - T1213 - T1649	TA0006 - TA0008 - TA0009	N/A	Black Basta	Lateral Movement	https://github.com/AlmondOffSec/PassTheCert	1	0	#filehash	N/A	10	7	618	76	2024-07-08T22:37:30Z	2022-04-29T09:08:32Z	26638
786	527e1f97594b67b082c6d687fb93e15c1409bbfcf6584aa019260a27af027262	.{0,1000}527e1f97594b67b082c6d687fb93e15c1409bbfcf6584aa019260a27af027262.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	26672
787	53395d8379dfd716e8708b21490fdec662537be8c56d0df185df59d0ed68eb04	.{0,1000}53395d8379dfd716e8708b21490fdec662537be8c56d0df185df59d0ed68eb04.{0,1000}	offensive_tool_keyword	wmiexec-pro	The new generation of wmiexec.py with new features whole the operations only work with port 135 (don't need smb connection) for AV evasion in Lateral Movement	T1021.006 - T1560.001	TA0008 - TA0040	N/A	HAFNIUM - Threat Group-3390 - Dragonfly - FIN8 - Sandworm Team - menuPass - Magic Hound - DEV-0270 - MUSTANG PANDA	Lateral Movement	https://github.com/XiaoliChan/wmiexec-Pro	1	0	#filehash	N/A	10	10	1070	134	2024-11-23T12:19:10Z	2023-04-04T06:24:07Z	26721
788	5494EDD3-132D-4238-AC25-FA384D78D4E3	.{0,1000}5494EDD3\-132D\-4238\-AC25\-FA384D78D4E3.{0,1000}	offensive_tool_keyword	RemoteKrbRelay	similar to KrbRelay and KrbRelayUp but With RemoteKrbRelay this can be done remotely	T1550.004 - T1557.001 - T1021.005 - T1105	TA0008 - TA0005	N/A	N/A	Lateral Movement	https://github.com/CICADA8-Research/RemoteKrbRelay	1	0	#GUIDproject	N/A	10	6	581	90	2024-06-30T14:08:50Z	2024-06-24T17:38:46Z	26811
789	5499BC48B9E9289A19E8215F3EE3A7003DC2057D13970BFFFC42231A93E690A9	.{0,1000}5499BC48B9E9289A19E8215F3EE3A7003DC2057D13970BFFFC42231A93E690A9.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	26812
790	54c3dcecfeb6224d49ae655207cfe684f95480f16215e32a122e473ac275d0db	.{0,1000}54c3dcecfeb6224d49ae655207cfe684f95480f16215e32a122e473ac275d0db.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	26827
791	54fe99f13b593d3acfc583e17d0bfd2e315d0ee20e737610bede18eb173ae864	.{0,1000}54fe99f13b593d3acfc583e17d0bfd2e315d0ee20e737610bede18eb173ae864.{0,1000}	offensive_tool_keyword	SharpSCCM	SharpSCCM is a post-exploitation tool designed to leverage Microsoft Endpoint Configuration Manager (a.k.a. ConfigMgr. formerly SCCM) for Lateral Movement and credential gathering without requiring access to the SCCM administration console GUI	T1078 - T1077 - T1547.001 - T1021.001 - T1087 - T1555.003	TA0008 - TA0006 - TA0003 - TA0011	N/A	N/A	Lateral Movement	https://github.com/Mayyhem/SharpSCCM/	1	0	#filehash	N/A	10	7	626	94	2024-09-16T14:57:49Z	2021-08-19T05:09:19Z	26845
792	56bb18010f13a33947c24d31f51e16d8c688cf9c753c1d52f79a9ba64e5c0dca	.{0,1000}56bb18010f13a33947c24d31f51e16d8c688cf9c753c1d52f79a9ba64e5c0dca.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	26980
793	577b289bf6f2a7353f4fb0f6a8a84103f6583710a08d8ff1e1fb817b45cccaa4	.{0,1000}577b289bf6f2a7353f4fb0f6a8a84103f6583710a08d8ff1e1fb817b45cccaa4.{0,1000}	offensive_tool_keyword	KrbRelay-SMBServer	acts as an SMB server (instead of DCOM) to relay Kerberos AP-REQ to CIFS or HTTP	T1557 - T1021 - T1205 - T1071	TA0006 - TA0008 - TA0010	N/A	Black Basta	Lateral Movement	https://github.com/decoder-it/KrbRelay-SMBServer	1	0	#filehash	N/A	9	3	215	26	2024-10-08T14:55:59Z	2024-10-05T12:28:55Z	27051
794	57FD94EC-4361-43FD-AB9D-CDB254C0DE8F	.{0,1000}57FD94EC\-4361\-43FD\-AB9D\-CDB254C0DE8F.{0,1000}	offensive_tool_keyword	DCOMUploadExec	DCOM Lateral movement POC abusing the IMsiServer interface - uploads and executes a payload remotely	T1021.003 - T1570 - T1105 - T1569.002	TA0008 - TA0011 - TA0002	N/A	N/A	Lateral Movement	https://github.com/deepinstinct/DCOMUploadExec	1	0	#GUIDproject	N/A	9	4	357	52	2024-12-13T14:03:12Z	2024-11-13T16:05:29Z	27085
795	5804dab3b58ddd2e4e2a198083e43b3f1759056d33e03d3a26a5c5fc4ce5a5f9	.{0,1000}5804dab3b58ddd2e4e2a198083e43b3f1759056d33e03d3a26a5c5fc4ce5a5f9.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	27086
796	58ae9b923139f8bed83bed67aae0bf2e56bfec9901009e61c4e4b6b375050bec	.{0,1000}58ae9b923139f8bed83bed67aae0bf2e56bfec9901009e61c4e4b6b375050bec.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#filehash	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	27137
797	596481231C2187836E29D3AA4498211393C5A31FB762548D4415673CB9D21797	.{0,1000}596481231C2187836E29D3AA4498211393C5A31FB762548D4415673CB9D21797.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	27191
798	5978136ED7A5A34BD587D5D9B7E405560461B166983B94897DF0BD85434653EB	.{0,1000}5978136ED7A5A34BD587D5D9B7E405560461B166983B94897DF0BD85434653EB.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	27193
799	5b64c12376f1ec1b876ede9b84f6883ee5f1ee5065e945dc2115c5e04c02aadf	.{0,1000}5b64c12376f1ec1b876ede9b84f6883ee5f1ee5065e945dc2115c5e04c02aadf.{0,1000}	offensive_tool_keyword	fuegoshell	Fuegoshell is a powershell oneliner generator for Windows remote shell re-using TCP 445	T1059.001 - T1203	TA0002 - TA0011 - TA0008	N/A	N/A	Lateral Movement	https://github.com/v1k1ngfr/fuegoshell	1	0	#filehash	N/A	10	1	44	7	2024-04-27T09:03:28Z	2024-04-27T08:06:03Z	27343
800	5ba6551843aaa623f0acd46941837e7dfde53ebbb648187a7f92efd211909d4f	.{0,1000}5ba6551843aaa623f0acd46941837e7dfde53ebbb648187a7f92efd211909d4f.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	#filehash	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	27361
801	5c5dc6546877d616c4479df133654a0fbccc71d5279aa63f2ca560a5abfea31d	.{0,1000}5c5dc6546877d616c4479df133654a0fbccc71d5279aa63f2ca560a5abfea31d.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	#filehash	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	27416
802	5c611fb030683dba08662997836b3b308c0278130bf2eee6ac6af6a4332285fe	.{0,1000}5c611fb030683dba08662997836b3b308c0278130bf2eee6ac6af6a4332285fe.{0,1000}	offensive_tool_keyword	ccmpwn	Lateral Movement script that leverages the CcmExec service to remotely hijack user sessions	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/mandiant/ccmpwn	1	0	#filehash	N/A	10	3	201	25	2024-03-26T20:51:27Z	2024-03-14T18:43:24Z	27418
803	5ccf7538e23279696252e4ff25a453d2e3693c76d5c2ffce705e8b9b8c1fe1b5	.{0,1000}5ccf7538e23279696252e4ff25a453d2e3693c76d5c2ffce705e8b9b8c1fe1b5.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	27445
804	5cdce3c908a8a7a336d21543c1133071b6395e26ca882cafc05fb6dbdce075f1	.{0,1000}5cdce3c908a8a7a336d21543c1133071b6395e26ca882cafc05fb6dbdce075f1.{0,1000}	offensive_tool_keyword	goWMIExec	re-implementation of invoke-wmiexec (Lateral Movement)	T1021.005	TA0008	N/A	N/A	Lateral Movement	https://github.com/C-Sto/goWMIExec	1	0	#filehash	N/A	10	3	214	42	2023-02-25T01:41:41Z	2019-10-14T22:32:11Z	27447
805	5CF031648822442C641F601094E922898DFA3D93C8D0B3E44FBCE22F43E7E402	.{0,1000}5CF031648822442C641F601094E922898DFA3D93C8D0B3E44FBCE22F43E7E402.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	27453
806	5eb4a246d7a9adaffedd89bcca6d86ba57a30380ce90438b57a45e61b9e06ec0	.{0,1000}5eb4a246d7a9adaffedd89bcca6d86ba57a30380ce90438b57a45e61b9e06ec0.{0,1000}	offensive_tool_keyword	File-Tunnel	Tunnel TCP connections through a file	T1071 - T1105 - T1090	TA0005 - TA0008 - TA0011	N/A	N/A	Lateral Movement	https://github.com/fiddyschmitt/File-Tunnel	1	0	#filehash	N/A	10	10	925	82	2025-04-19T15:06:09Z	2023-02-05T12:57:45Z	27597
807	5f8c475f1a4772644bbae8e3a31e11e78b7f44a1559f5e6bb58b7b3b9083323d	.{0,1000}5f8c475f1a4772644bbae8e3a31e11e78b7f44a1559f5e6bb58b7b3b9083323d.{0,1000}	offensive_tool_keyword	impacket	Impacket is a collection of Python classes for working with network protocols. Impacket is focused on providing low-level programmatic access to the packets and for some protocols (e.g. SMB1-3 and MSRPC) the protocol implementation itself	T1557.001 - T1040 - T1003.001 - T1003.002 - T1003.003 - T1003.004 - T1558.003 - T1569.002 - T1047	TA0001 - TA0003 - TA0004 - TA0005 - TA0006 - TA0008 - TA0011	N/A	Akira - Bassterlord* - BianLian - Dragonfly - FIN8 - HAFNIUM - Hive - LockBit - Magic Hound - RansomHub - Rhysida - Sandworm Team - Scattered Spider* - Threat Group-3390 - Yanluowang - menuPass - Volt Typhoon - Cinnamon Tempest - Magic Hound - DAGGER PANDA - ENERGETIC BEAR - DEV-0270 - COZY BEAR - FANCY BEAR - EMBER BEAR - BERSERK BEAR - Dispossessor - Black Basta	Lateral Movement	https://github.com/fortra/impacket	1	0	#filehash	N/A	10	10	14198	3681	2025-04-22T13:40:55Z	2015-04-15T14:04:07Z	27645
808	6093461c4db41a15fefc85a28e35a9e359d0e9452bbfd36ce1fbe7aa31e1f4f0	.{0,1000}6093461c4db41a15fefc85a28e35a9e359d0e9452bbfd36ce1fbe7aa31e1f4f0.{0,1000}	offensive_tool_keyword	SharpMove	.NET Project for performing Authenticated Remote Execution	T1021 - T1106 - T1218	TA0002 - TA0008	N/A	N/A	Lateral Movement	https://github.com/0xthirteen/SharpMove	1	0	#filehash	N/A	8	4	393	66	2023-02-08T23:48:54Z	2020-01-24T22:21:04Z	27713
809	60f25c8a290ba6185b07da48663cfc4662e2853e324bef2a272aede4c15260d2	.{0,1000}60f25c8a290ba6185b07da48663cfc4662e2853e324bef2a272aede4c15260d2.{0,1000}	offensive_tool_keyword	winexe	Winexe remotely executes commands on Windows systems from GNU/Linux	T1059.004 - T1021.005 - T1078.003	TA0002 - TA0008 - TA0011	N/A	APT28	Lateral Movement	https://www.kali.org/tools/winexe/	1	0	#filehash #linux #windows	N/A	8	8	N/A	N/A	N/A	N/A	27734
810	622f3304b381b2f3a99567be78a668e21c1c6a405320da78a2af32addbc29d88	.{0,1000}622f3304b381b2f3a99567be78a668e21c1c6a405320da78a2af32addbc29d88.{0,1000}	offensive_tool_keyword	SharpRDPHijack	SharpRDPHijack is a proof-of-concept .NET/C# Remote Desktop Protocol (RDP) session hijack utility for disconnected sessions	T1021.001 - T1078.003 - T1059.001	TA0002 - TA0008 - TA0006	N/A	N/A	Lateral Movement	https://github.com/bohops/SharpRDPHijack	1	0	#filehash	N/A	10	5	480	80	2024-11-28T06:08:58Z	2020-07-06T02:59:46Z	27819
811	645524305b8203fddf667329025f7ce531c9bc664f3186d5db5cfa0ff55d53b5	.{0,1000}645524305b8203fddf667329025f7ce531c9bc664f3186d5db5cfa0ff55d53b5.{0,1000}	offensive_tool_keyword	pth-toolkit	A modified version of the passing-the-hash tool collection https://code.google.com/p/passing-the-hash/ designed to be portable and work straight out of the box even on the most 'bare bones' systems	T1550.002 - T1075 - T1078	TA0006 - TA0008	N/A	APT1	Lateral Movement	https://github.com/byt3bl33d3r/pth-toolkit	1	0	#filehash	N/A	10	6	575	131	2015-02-06T15:10:41Z	2015-02-03T10:31:56Z	27975
812	64fc0afc72a37b1071482e9c4725cd35fa2b974c6903cd01124ed7fe9d2c8e27	.{0,1000}64fc0afc72a37b1071482e9c4725cd35fa2b974c6903cd01124ed7fe9d2c8e27.{0,1000}	offensive_tool_keyword	csexec	An implementation of PSExec in C#	T1021.002 - T1059.004 - T1077	TA0008 - TA0009 - TA0011	N/A	N/A	Lateral Movement	https://github.com/malcomvetter/CSExec	1	0	#filehash	N/A	10	4	325	62	2020-12-01T14:52:01Z	2018-08-08T21:09:07Z	28018

The file is too large to be shown. View Raw

1019 KiB Raw Permalink Blame History

1019 KiB

Raw Permalink Blame History