Threat intelligence / filtered
Tool
11300 objects matching the active filter. Open an object to inspect its relationships and provenance.
Evidence stream
Filtered — Tool
01dnf-model-countingToolNationalSecurityAgency/dnf-model-counting02FoundationFoundation is a repository of formal cryptographic specificationsToolNationalSecurityAgency/Foundation03openflameToolNationalSecurityAgency/openflame04ghidra-lisaToolNationalSecurityAgency/ghidra-lisa05seabeeHardens eBPF tools against privileged attackers via policy-based access controlsToolNationalSecurityAgency/seabee06datawave-accumulo-pluginsA reusable set of plugins implementing Accumulo's SPI for use with DataWaveToolNationalSecurityAgency/datawave-accumulo-plugins07datawave-map-serviceToolNationalSecurityAgency/datawave-map-service08datawave-file-provider-serviceToolNationalSecurityAgency/datawave-file-provider-service09.githubToolNationalSecurityAgency/.github10ghidra-volatilityToolNationalSecurityAgency/ghidra-volatility11ghidra-fridaToolNationalSecurityAgency/ghidra-frida12TraceAnalysisToolNationalSecurityAgency/TraceAnalysis13datawave-helm-chartsToolNationalSecurityAgency/datawave-helm-charts14datawave-stack-docker-imagesToolNationalSecurityAgency/datawave-stack-docker-images15rank-based-linkageToolNationalSecurityAgency/rank-based-linkage16datawave-tablesToolNationalSecurityAgency/datawave-tables17ghidra-extensionsToolNationalSecurityAgency/ghidra-extensions18datawave-spring-boot-starter-cached-resultsToolNationalSecurityAgency/datawave-spring-boot-starter-cached-results19datawave-mapreduce-query-serviceToolNationalSecurityAgency/datawave-mapreduce-query-service20datawave-ingest-servicesToolNationalSecurityAgency/datawave-ingest-services21datawave-modification-serviceToolNationalSecurityAgency/datawave-modification-service22datawave-query-storage-serviceToolNationalSecurityAgency/datawave-query-storage-service23datawave-query-executor-serviceToolNationalSecurityAgency/datawave-query-executor-service24datawave-query-serviceToolNationalSecurityAgency/datawave-query-service25datawave-spring-boot-starter-metadataToolNationalSecurityAgency/datawave-spring-boot-starter-metadata26datawave-spring-boot-starter-query-metricToolNationalSecurityAgency/datawave-spring-boot-starter-query-metric27datawave-spring-boot-starter-queryToolNationalSecurityAgency/datawave-spring-boot-starter-query28datawave-query-metric-serviceToolNationalSecurityAgency/datawave-query-metric-service29call-stack-profilerSkillTreeToolNationalSecurityAgency/call-stack-profiler30skills-stress-testSkillTreeToolNationalSecurityAgency/skills-stress-test31skills-client-examplesSkillTree skills-client-examplesToolNationalSecurityAgency/skills-client-examples32skills-clientSkillTree client libraries facilitate the rapid integration of a gamified tool training approach in conjunction with skills-service.ToolNationalSecurityAgency/skills-client33skills-docsSkillTree documentation, covering client integration, dashboard administration and deployment, and contribution guidelines.ToolNationalSecurityAgency/skills-docs34skills-serviceSkillTree is a micro-learning gamification platform supporting the rapid integration of a gamified tool training approach into new and existing applications.ToolNationalSecurityAgency/skills-service35XORSATFilterA library for building efficient set-membership filters and dictionaries based on the Satisfiability problem.ToolNationalSecurityAgency/XORSATFilter36datawave-type-utilsToolNationalSecurityAgency/datawave-type-utils37datawave-spring-boot-starter-cacheToolNationalSecurityAgency/datawave-spring-boot-starter-cache38datawave-spring-boot-starter-auditToolNationalSecurityAgency/datawave-spring-boot-starter-audit39datawave-spring-boot-starterToolNationalSecurityAgency/datawave-spring-boot-starter40datawave-service-parentToolNationalSecurityAgency/datawave-service-parent41datawave-microservices-rootToolNationalSecurityAgency/datawave-microservices-root42datawave-parentToolNationalSecurityAgency/datawave-parent43datawave-metrics-reporterToolNationalSecurityAgency/datawave-metrics-reporter44datawave-metadata-utilsToolNationalSecurityAgency/datawave-metadata-utils45datawave-hazelcast-serviceToolNationalSecurityAgency/datawave-hazelcast-service46datawave-utilsToolNationalSecurityAgency/datawave-utils47datawave-dictionary-serviceThe Dictionary service provides access to the data dictionary and edge dictionary. These services provide metadata about fields that are stored in Accumulo.ToolNationalSecurityAgency/datawave-dictionary-service48datawave-config-serviceToolNationalSecurityAgency/datawave-config-service49datawave-common-utilsToolNationalSecurityAgency/datawave-common-utils50datawave-base-rest-responsesToolNationalSecurityAgency/datawave-base-rest-responses51datawave-authorization-serviceToolNationalSecurityAgency/datawave-authorization-service52datawave-audit-serviceToolNationalSecurityAgency/datawave-audit-service53datawave-accumulo-utilsToolNationalSecurityAgency/datawave-accumulo-utils54datawave-accumulo-serviceToolNationalSecurityAgency/datawave-accumulo-service55datawave-in-memory-accumuloToolNationalSecurityAgency/datawave-in-memory-accumulo56ghidra-dataSupporting Data Archives for GhidraToolNationalSecurityAgency/ghidra-data57ghidraGhidra is a software reverse engineering (SRE) frameworkToolNationalSecurityAgency/ghidra58enigma-simulatorAn educational demonstration of breaking the Enigma machineToolNationalSecurityAgency/enigma-simulator59nationalsecurityagency.github.ioSite for NSA's Open Source project listingToolNationalSecurityAgency/nationalsecurityagency.github.io60emissaryDistributed P2P Data-driven Workflow FrameworkToolNationalSecurityAgency/emissary61datawave-muchosThis project leverages Ansible to automate DataWave deployments on your clusterToolNationalSecurityAgency/datawave-muchos62fractalrabbitSimulate realistic trajectory data seen through sporadic reportingToolNationalSecurityAgency/fractalrabbit63datawaveDataWave is an ingest/query framework that leverages Apache Accumulo to provide fast, secure data access.ToolNationalSecurityAgency/datawave64qonduitA WebSocket library for use with Apache AccumuloToolNationalSecurityAgency/qonduit65lemongrenadeData-driven automation platformToolNationalSecurityAgency/lemongrenade66lemongraphLog-based transactional graph engineToolNationalSecurityAgency/lemongraph67timelyAccumulo backed time series databaseToolNationalSecurityAgency/timely68PsExec[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS PsExec)ToolS002969Quick Assist[Quick Assist](https://attack.mitre.org/software/S1209) is a remote assistance tool primarily for Microsoft Windows, although a macOS version also exists. [Quick Assist](https://attack.mitre.org/software/S1209) allows for remote screen shar…ToolS120970Havij[Havij](https://attack.mitre.org/software/S0224) is an automatic SQL Injection tool distributed by the Iranian ITSecTeam security company. Havij has been used by penetration testers and adversaries. (Citation: Check Point Havij Analysis)ToolS022471Wevtutil[Wevtutil](https://attack.mitre.org/software/S0645) is a Windows command-line utility that enables administrators to retrieve information about event logs and publishers.(Citation: Wevtutil Microsoft Documentation)ToolS064572AdFind[AdFind](https://attack.mitre.org/software/S0552) is a free command-line query tool that can be used for gathering information from Active Directory.(Citation: Red Canary Hospital Thwarted Ryuk October 2020)(Citation: FireEye FIN6 Apr 2019)…ToolS055273Tor[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-hop proxy network and utilizes multilayer encryption to protect both the message and routin…ToolS018374Rubeus[Rubeus](https://attack.mitre.org/software/S1071) is a C# toolset designed for raw Kerberos interaction that has been used since at least 2020, including in ransomware operations.(Citation: GitHub Rubeus March 2023)(Citation: FireEye KEGTAP…ToolS107175cipher.exe[cipher.exe](https://attack.mitre.org/software/S1205) is a native Microsoft utility that manages encryption of directories and files on NTFS (New Technology File System) partitions by using the Encrypting File System (EFS).(Citation: cipher…ToolS120576QuasarRAT[QuasarRAT](https://attack.mitre.org/software/S0262) is an open-source, remote access tool that has been publicly available on GitHub since at least 2014. [QuasarRAT](https://attack.mitre.org/software/S0262) is developed in the C# language.…ToolS026277SDelete[SDelete](https://attack.mitre.org/software/S0195) is an application that securely deletes data in a way that makes it unrecoverable. It is part of the Microsoft Sysinternals suite of tools. (Citation: Microsoft SDelete July 2016)ToolS019578HTRAN[HTRAN](https://attack.mitre.org/software/S0040) is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacti…ToolS004079Mythic[Mythic](https://attack.mitre.org/software/S0699) is an open source, cross-platform post-exploitation/command and control platform. [Mythic](https://attack.mitre.org/software/S0699) is designed to "plug-n-play" with various agents and commu…ToolS069980ftp[ftp](https://attack.mitre.org/software/S0095) is a utility commonly available with operating systems to transfer information over the File Transfer Protocol (FTP). Adversaries can use it to transfer other tools onto a system or to exfiltra…ToolS009581Reg[Reg](https://attack.mitre.org/software/S0075) is a Windows utility used to interact with the Windows Registry. It can be used at the command-line interface to query, add, modify, and remove information. (Citation: Microsoft Reg) Utilities …ToolS007582Pupy[Pupy](https://attack.mitre.org/software/S0192) is an open source, cross-platform (Windows, Linux, OSX, Android) remote administration and post-exploitation tool. (Citation: GitHub Pupy) It is written in Python and can be generated as a pay…ToolS019283Expand[Expand](https://attack.mitre.org/software/S0361) is a Windows utility used to expand one or more compressed CAB files.(Citation: Microsoft Expand Utility) It has been used by [BBSRAT](https://attack.mitre.org/software/S0127) to decompress …ToolS036184Cachedump[Cachedump](https://attack.mitre.org/software/S0119) is a publicly-available tool that program extracts cached password hashes from a system’s registry. (Citation: Mandiant APT1)ToolS011985schtasks[schtasks](https://attack.mitre.org/software/S0111) is used to schedule execution of programs or scripts on a Windows system to run at a specific date and time. (Citation: TechNet Schtasks)ToolS011186Koadic[Koadic](https://attack.mitre.org/software/S0250) is a Windows post-exploitation framework and penetration testing tool that is publicly available on GitHub. [Koadic](https://attack.mitre.org/software/S0250) has several options for staging …ToolS025087CrackMapExec[CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active …ToolS048888esentutl[esentutl](https://attack.mitre.org/software/S0404) is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.(Citation: Microsoft Esentutl)ToolS040489route[route](https://attack.mitre.org/software/S0103) can be used to find or change information within the local system IP routing table. (Citation: TechNet Route)ToolS010390cmd[cmd](https://attack.mitre.org/software/S0106) is the Windows command-line interpreter that can be used to interact with systems and execute other processes and utilities. (Citation: TechNet Cmd) Cmd.exe contains native functionality to per…ToolS010691Ping[Ping](https://attack.mitre.org/software/S0097) is an operating system utility commonly used to troubleshoot and verify network connections. (Citation: TechNet Ping)ToolS009792LaZagne[LaZagne](https://attack.mitre.org/software/S0349) is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. [LaZagne](https:…ToolS034993NBTscan[NBTscan](https://attack.mitre.org/software/S0590) is an open source tool that has been used by state groups to conduct internal reconnaissance within a compromised network.(Citation: Debian nbtscan Nov 2019)(Citation: SecTools nbtscan June…ToolS059094Invoke-PSImage[Invoke-PSImage](https://attack.mitre.org/software/S0231) takes a PowerShell script and embeds the bytes of the script into the pixels of a PNG image. It generates a one liner for executing either from a file of from the web. Example of usa…ToolS023195nbtstat[nbtstat](https://attack.mitre.org/software/S0102) is a utility used to troubleshoot NetBIOS name resolution. (Citation: TechNet Nbtstat)ToolS010296IronNetInjector[IronNetInjector](https://attack.mitre.org/software/S0581) is a [Turla](https://attack.mitre.org/groups/G0010) toolchain that utilizes scripts from the open-source IronPython implementation of Python with a .NET injector to drop one or more…ToolS058197gsecdump[gsecdump](https://attack.mitre.org/software/S0008) is a publicly-available credential dumper used to obtain password hashes and LSA secrets from Windows operating systems. (Citation: TrueSec Gsecdump)ToolS000898Mimikatz[Mimikatz](https://attack.mitre.org/software/S0002) is a credential dumper capable of obtaining plaintext Windows account logins and passwords, along with many other features that make it useful for testing the security of networks. (Citati…ToolS000299Donut[Donut](https://attack.mitre.org/software/S0695) is an open source framework used to generate position-independent shellcode.(Citation: Donut Github)(Citation: Introducing Donut) [Donut](https://attack.mitre.org/software/S0695) generated co…ToolS0695100Pass-The-Hash Toolkit[Pass-The-Hash Toolkit](https://attack.mitre.org/software/S0122) is a toolkit that allows an adversary to "pass" a password hash (without knowing the original password) to log in to systems. (Citation: Mandiant APT1)ToolS0122101ResponderResponder is an open source tool used for LLMNR, NBT-NS and MDNS poisoning, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication. (Citation:…ToolS0174102pwdump[pwdump](https://attack.mitre.org/software/S0006) is a credential dumper. (Citation: Wikipedia pwdump)ToolS0006103sqlmap[sqlmap](https://attack.mitre.org/software/S0225) is an open source penetration testing tool that can be used to automate the process of detecting and exploiting SQL injection flaws. (Citation: sqlmap Introduction)ToolS0225104MailSniperMailSniper is a penetration testing tool for searching through email in a Microsoft Exchange environment for specific terms (passwords, insider intel, network architecture information, etc.). It can be used by a non-administrative user to s…ToolS0413105Nltest[Nltest](https://attack.mitre.org/software/S0359) is a Windows command-line utility used to list domain controllers and enumerate domain trusts.(Citation: Nltest Manual)ToolS0359106MCMD[MCMD](https://attack.mitre.org/software/S0500) is a remote access tool that provides remote command shell capability used by [Dragonfly](https://attack.mitre.org/groups/G0035).(Citation: Secureworks MCMD July 2019)ToolS0500107Winexe[Winexe](https://attack.mitre.org/software/S0191) is a lightweight, open source tool similar to [PsExec](https://attack.mitre.org/software/S0029) designed to allow system administrators to execute commands on remote servers. (Citation: Wine…ToolS0191108Forfiles[Forfiles](https://attack.mitre.org/software/S0193) is a Windows utility commonly used in batch jobs to execute commands on one or more selected files or directories (ex: list all directories in a drive, read the first line of all files cre…ToolS0193109Ruler[Ruler](https://attack.mitre.org/software/S0358) is a tool to abuse Microsoft Exchange services. It is publicly available on GitHub and the tool is executed via the command line. The creators of [Ruler](https://attack.mitre.org/software/S03…ToolS0358110Imminent Monitor[Imminent Monitor](https://attack.mitre.org/software/S0434) was a commodity remote access tool (RAT) offered for sale from 2012 until 2019, when an operation was conducted to take down the Imminent Monitor infrastructure. Various cracked ve…ToolS0434111attrib[attrib](https://attack.mitre.org/software/S1176) is a Windows utility used to display, set or remove attributes assigned to files or directories.(Citation: Microsoft attrib 2023)ToolS1176112ConnectWise[ConnectWise](https://attack.mitre.org/software/S0591) is a legitimate remote administration tool that has been used since at least 2016 by threat actors including [MuddyWater](https://attack.mitre.org/groups/G0069) and [GOLD SOUTHFIELD](ht…ToolS0591113Out1[Out1](https://attack.mitre.org/software/S0594) is a remote access tool written in python and used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021.(Citation: Trend Micro Muddy Water March 2021)ToolS0594114Systeminfo[Systeminfo](https://attack.mitre.org/software/S0096) is a Windows utility that can be used to gather detailed information about a computer. (Citation: TechNet Systeminfo)ToolS0096115Remcos[Remcos](https://attack.mitre.org/software/S0332) is a closed-source tool that is marketed as a remote control and surveillance software by a company called Breaking Security. [Remcos](https://attack.mitre.org/software/S0332) has been obser…ToolS0332116Peirates[Peirates](https://attack.mitre.org/software/S0683) is a post-exploitation Kubernetes exploitation framework with a focus on gathering service account tokens for lateral movement and privilege escalation. The tool is written in GoLang and p…ToolS0683117TruffleHog[TruffleHog](https://attack.mitre.org/software/S9009) is an open-source secrets-discovery tool that is used to search for credentials, API keys, and encryption keys across a variety of data sources and environments.(Citation: Black Hills In…ToolS9009118Brute Ratel C4[Brute Ratel C4](https://attack.mitre.org/software/S1063) is a commercial red-teaming and adversarial attack simulation tool that first appeared in December 2020. [Brute Ratel C4](https://attack.mitre.org/software/S1063) was specifically de…ToolS1063119ROADTools[ROADTools](https://attack.mitre.org/software/S0684) is a framework for enumerating Azure Active Directory environments. The tool is written in Python and publicly available on GitHub.(Citation: ROADtools Github)ToolS0684120AsyncRAT[AsyncRAT](https://attack.mitre.org/software/S1087) is an open-source remote access tool originally available through the NYANxCAT Github repository that has been used in malicious campaigns.(Citation: Morphisec Snip3 May 2021)(Citation: Ci…ToolS1087121meek[meek](https://attack.mitre.org/software/S0175) is an open-source Tor plugin that tunnels Tor traffic through HTTPS connections.ToolS0175122BITSAdmin[BITSAdmin](https://attack.mitre.org/software/S0190) is a command line tool used to create and manage [BITS Jobs](https://attack.mitre.org/techniques/T1197). (Citation: Microsoft BITSAdmin)ToolS0190123CARROTBALL[CARROTBALL](https://attack.mitre.org/software/S0465) is an FTP downloader utility that has been in use since at least 2019. [CARROTBALL](https://attack.mitre.org/software/S0465) has been used as a downloader to install [SYSCON](https://att…ToolS0465124netsh[netsh](https://attack.mitre.org/software/S0108) is a scripting utility used to interact with networking components on local or remote systems. (Citation: TechNet Netsh)ToolS0108125MimiPenguin[MimiPenguin](https://attack.mitre.org/software/S0179) is a credential dumper, similar to [Mimikatz](https://attack.mitre.org/software/S0002), designed specifically for Linux platforms. (Citation: MimiPenguin GitHub May 2017)ToolS0179126Rclone[Rclone](https://attack.mitre.org/software/S1040) is a command line program for syncing files with cloud storage services such as Dropbox, Google Drive, Amazon S3, and MEGA. [Rclone](https://attack.mitre.org/software/S1040) has been used in…ToolS1040127CSPY Downloader[CSPY Downloader](https://attack.mitre.org/software/S0527) is a tool designed to evade analysis and download additional payloads used by [Kimsuky](https://attack.mitre.org/groups/G0094).(Citation: Cybereason Kimsuky November 2020)ToolS0527128xCmd[xCmd](https://attack.mitre.org/software/S0123) is an open source tool that is similar to [PsExec](https://attack.mitre.org/software/S0029) and allows the user to execute applications on remote systems. (Citation: xCmd)ToolS0123129Fgdump[Fgdump](https://attack.mitre.org/software/S0120) is a Windows password hash dumper. (Citation: Mandiant APT1)ToolS0120130PoshC2[PoshC2](https://attack.mitre.org/software/S0378) is an open source remote administration and post-exploitation framework that is publicly available on GitHub. The server-side components of the tool are primarily written in Python, while th…ToolS0378131netstat[netstat](https://attack.mitre.org/software/S0104) is an operating system utility that displays active TCP connections, listening ports, and network statistics. (Citation: TechNet Netstat)ToolS0104132RawDisk[RawDisk](https://attack.mitre.org/software/S0364) is a legitimate commercial driver from the EldoS Corporation that is used for interacting with files, disks, and partitions. The driver allows for direct modification of data on a local com…ToolS0364133PcShare[PcShare](https://attack.mitre.org/software/S1050) is an open source remote access tool that has been modified and used by Chinese threat actors, most notably during the FunnyDream campaign since late 2018.(Citation: Bitdefender FunnyDream …ToolS1050134dsquery[dsquery](https://attack.mitre.org/software/S0105) is a command-line utility that can be used to query Active Directory for information from a system within a domain. (Citation: TechNet Dsquery) It is typically installed only on Windows Ser…ToolS0105135FRP[FRP](https://attack.mitre.org/software/S1144), which stands for Fast Reverse Proxy, is an openly available tool that is capable of exposing a server located behind a firewall or Network Address Translation (NAT) to the Internet. [FRP](http…ToolS1144136ifconfig[ifconfig](https://attack.mitre.org/software/S0101) is a Unix-based utility used to gather information about and interact with the TCP/IP settings on a system. (Citation: Wikipedia Ifconfig)ToolS0101137Empire[Empire](https://attack.mitre.org/software/S0363) is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-e…ToolS0363138spwebmember[spwebmember](https://attack.mitre.org/software/S0227) is a Microsoft SharePoint enumeration and data dumping tool written in .NET. (Citation: NCC Group APT15 Alive and Strong)ToolS0227139Arp[Arp](https://attack.mitre.org/software/S0099) displays and modifies information about a system's Address Resolution Protocol (ARP) cache. (Citation: TechNet Arp)ToolS0099140Lslsass[Lslsass](https://attack.mitre.org/software/S0121) is a publicly-available tool that can dump active logon session password hashes from the lsass process. (Citation: Mandiant APT1)ToolS0121141ngrok[ngrok](https://attack.mitre.org/software/S0508) is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. [ngrok](https://attack.mitre.org/soft…ToolS0508142DCRAT[DCRAT](https://attack.mitre.org/software/S9017) is a variant of the open-source [AsyncRAT](https://attack.mitre.org/software/S1087) developed in C# with additional capabilities such as patching Microsoft’s Antimalware Scan Interface (AMSI)…ToolS9017143TasklistThe [Tasklist](https://attack.mitre.org/software/S0057) utility displays a list of applications and services with their Process IDs (PID) for all tasks running on either a local or a remote computer. It is packaged with Windows operating sy…ToolS0057144AADInternals[AADInternals](https://attack.mitre.org/software/S0677) is a PowerShell-based framework for administering, enumerating, and exploiting Azure Active Directory. The tool is publicly available on GitHub.(Citation: AADInternals Github)(Citation…ToolS0677145ipconfig[ipconfig](https://attack.mitre.org/software/S0100) is a Windows utility that can be used to find information about a system's TCP/IP, DNS, DHCP, and adapter configuration. (Citation: TechNet Ipconfig)ToolS0100146Impacket[Impacket](https://attack.mitre.org/software/S0357) is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. [Impacket](https://attack.mitre.org/software/S0357) contains…ToolS0357147Windows Credential Editor[Windows Credential Editor](https://attack.mitre.org/software/S0005) is a password dumping tool. (Citation: Amplia WCE)ToolS0005148evilginx2[evilginx2](https://attack.mitre.org/software/S9003) is an open-source adversary-in-the-middle (AiTM) attack framework based on the open-source nginx web server. [evilginx2](https://attack.mitre.org/software/S9003) can be used as a reverse …ToolS9003149PacuPacu is an open-source AWS exploitation framework. The tool is written in Python and publicly available on GitHub.(Citation: GitHub Pacu)ToolS1091150PowerSploit[PowerSploit](https://attack.mitre.org/software/S0194) is an open source, offensive security framework comprised of [PowerShell](https://attack.mitre.org/techniques/T1059/001) modules and scripts that perform a wide range of tasks related t…ToolS0194151SILENTTRINITY[SILENTTRINITY](https://attack.mitre.org/software/S0692) is an open source remote administration and post-exploitation framework primarily written in Python that includes stagers written in Powershell, C, and Boo. [SILENTTRINITY](https://at…ToolS0692152Sliver[Sliver](https://attack.mitre.org/software/S0633) is an open source, cross-platform, red team command and control (C2) framework written in Golang. [Sliver](https://attack.mitre.org/software/S0633) includes its own package manager, "armory,…ToolS0633153ShimRatReporter[ShimRatReporter](https://attack.mitre.org/software/S0445) is a tool used by suspected Chinese adversary [Mofang](https://attack.mitre.org/groups/G0103) to automatically conduct initial discovery. The details from this discovery are used to…ToolS0445154UACMe[UACMe](https://attack.mitre.org/software/S0116) is an open source assessment tool that contains many methods for bypassing Windows User Account Control on multiple versions of the operating system. (Citation: Github UACMe)ToolS0116155at[at](https://attack.mitre.org/software/S0110) is used to schedule tasks on a system to run at a specified date or time.(Citation: TechNet At)(Citation: Linux at)ToolS0110156certutil[certutil](https://attack.mitre.org/software/S0160) is a command-line utility that can be used to obtain certificate authority information and configure Certificate Services. (Citation: TechNet Certutil)ToolS0160157Diskpart[Diskpart](https://attack.mitre.org/software/S9002) is a Windows command-line utility that is used to manage the computer’s drives, which includes disks, partitions, volumes and virtual hard disks.(Citation: Microsoft_diskpart_Feb2023) Adve…ToolS9002158BloodHound[BloodHound](https://attack.mitre.org/software/S0521) is an Active Directory (AD) reconnaissance tool that can reveal hidden relationships and identify attack paths within an AD environment.(Citation: GitHub Bloodhound)(Citation: CrowdStrik…ToolS0521159NPPSPYNPPSPY is an implementation of a theoretical mechanism first presented in 2004 for capturing credentials submitted to a Windows system via a rogue Network Provider API item. NPPSPY captures credentials following submission and writes them t…ToolS1131160Covenant[Covenant](https://attack.mitre.org/software/S1155) is a multi-platform command and control framework written in .NET. While designed for penetration testing and security research, the tool has also been used by threat actors such as [HAFNI…ToolS1155161RemoteUtilities[RemoteUtilities](https://attack.mitre.org/software/S0592) is a legitimate remote administration tool that has been used by [MuddyWater](https://attack.mitre.org/groups/G0069) since at least 2021 for execution on target machines.(Citation: …ToolS0592162NetThe [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utili…ToolS0039