MITRE ATT&CKsoftware (tool)
S0378 PoshC2
- Domain
- enterprise
- Platforms
- Windows, Linux, macOS
- Version
- 1.3
- Created
- 2019-04-23
Description
PoshC2 is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while the implants are written in PowerShell. Although PoshC2 is primarily focused on Windows implantation, it does contain a basic Python dropper for Linux/macOS.
Related
Uses · MITRE ATT&CK (32)
- T1071.001 Web Protocols sub-technique
- T1069.001 Local Groups sub-technique
- T1569.002 Service Execution sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1560.001 Archive via Utility sub-technique
- T1134.002 Create Process with Token sub-technique
- T1003.001 LSASS Memory sub-technique
- T1056.001 Keylogging sub-technique
- T1555 Credentials from Password Stores technique
- T1557.001 Name Resolution Poisoning and SMB Relay sub-technique
- T1552.001 Credentials In Files sub-technique
- T1548.002 Bypass User Account Control sub-technique
- T1550.002 Pass the Hash sub-technique
- T1546.003 Windows Management Instrumentation Event Subscription sub-technique
- T1482 Domain Trust Discovery technique
- T1201 Password Policy Discovery technique
- T1210 Exploitation of Remote Services technique
- T1134 Access Token Manipulation technique
- T1007 System Service Discovery technique
- T1016 System Network Configuration Discovery technique
- T1040 Network Sniffing technique
- T1046 Network Service Discovery technique
- T1047 Windows Management Instrumentation technique
- T1049 System Network Connections Discovery technique
- T1055 Process Injection technique
- T1068 Exploitation for Privilege Escalation technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1090 Proxy technique
References
- https://github.com/nettitude/PoshC2_Python GitHub PoshC2