Find your next command.

Load a managed DLL in the context of AccCheckConsole.exe. The -window switch value can be set to an arbitrary active window name.

Use Local execution of managed code from assembly DLL.

Active Directory Certifcate Services or ADCS provide an alternative way to authenticate within a AD enviroment that contains a PKI as well as being configured with a Certifcate Authority. References below will provide technical info on ADCS as well as exploitation techniques from spectorops certfied preowned white paper.

The Defender module's Add-MpPreference cmdlet adds entries to the Microsoft Defender Antivirus exclusion list so matching items are no longer scanned in real time or on schedule: -ExclusionPath excludes a folder/file, -ExclusionProcess excludes any files opened by a named process, and -ExclusionExtension excludes an entire file type. Any of the three carves a blind spot for staging and executing tooling.

Use Carve a Defender blind spot by excluding a staging path, an attacker process, or a whole extension before dropping tooling.

AddinUtil is executed from the directory where the 'Addins.Store' payload exists, AddinUtil will execute the 'Addins.Store' payload.

Use Proxy execution of malicious serialized payload

adidnsdump (dirkjanm) abuses the fact that any authenticated domain user can read the AD-integrated DNS zones (stored in the DomainDnsZones/ForestDnsZones partitions), effectively performing a zone transfer without being a DNS admin. Records whose node name is hidden from the anonymous listing are still enumerable and can be resolved by adding -r, which issues a live DNS query for each hidden node. This maps internal hostnames to IPs for target selection; results are written to records.csv. Use --print-zones first to see which zones exist. Command Reference: Username: john Password: password123 Domain: test.local Target DC IP: 10.10.10.1

Creates a memory dump of the lsass process

Use Create memory dump and parse it offline

Execute the specified (local or remote) .wsh/.sct script with scrobj.dll in the .inf file by calling an information file directive (section name specified).

Use Run local or remote script(let) code through INF file specification.

Spawns powershell.exe and executes a provided powershell script with ExecutionPolicy Bypass argument

Use Execute unsigned powershell scripts

The file is displayed in the terminal interface. Other options might be available, for example, by pressing `S` is possible to save the file content elsewhere.

The first line may be leaked as an error message.

The first line only is likely leaked as an error message.

Execute an executable file via the Windows App Certification Kit command-line tool.

Use Performs execution of specified file, can be used as a defense evasion

The ms-appinstaller:// URI is handled by the signed App Installer (AppInstaller.exe), which reaches out to the source URL, attempts to load/install the package, and caches the fetched file in INetCache. The download rides a trusted protocol handler with no obvious downloader on the command line; the same handler underpinned real-world MotW-bypass delivery campaigns.

Use Download a remote file/package through a trusted URI handler rather than an explicit HTTP client.

AppInstaller.exe is spawned by the default handler for the URI, it attempts to load/install a package from the URL and is saved in INetCache.

Use Download file from Internet

Launches a ClickOnce application via `Applaunch.exe`. Bypasses SmartScreen and default AppLocker rules when the application is published as partial trust.

Use Execute ClickOnce applications in environments where `dfsvc.exe` would normally enforce full-trust and SmartScreen checks. Can be abused as an AWL bypass in rare configurations.

Launches an executable via User Experience Virtualization tool.

Use Executes an executable under a trusted, Microsoft signed binary.

The terminal interface expects some choices in order to spawn tha pager.

Executes .bat file through AppVLP.exe

Use Execution of BAT file hosted on Webdav server.

Note that the subprocess is immediately sent to the background.

The `.arj` suffix will be added to `output-file`.

Lines are likely leaked as error messages.

Lines are likely leaked as error messages.

The textual file is displayed in an interactive TUI showing only the parts that contain mispelled words.

Execute C# code with the Build Provider and proper folder structure in place.

Use Execute proxied payload with Microsoft signed binary to bypass application control solutions

A server instance must be already running, otherwise it can be started with `sudo asterisk -F`. Moreover, the invoking user must be able to access the socket.