Search For Content

Search Result

2 item(s) found so far for this keyword.

Valid Accounts: Domain Accounts

Defense Evasion [Mitre]

Adversaries may obtain and abuse credentials of a domain account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Domain accounts are those managed by Active Directory Domain Services where access and permissions are configured across systems and services that are part of that domain. Domain accounts can cover users, administrators, and services.

Adversaries may …

Defense Evasion [Mitre]

Adversaries may use PubPrn to proxy execution of malicious remote files. PubPrn.vbs is a Visual Basic script that publishes a printer to Active Directory Domain Services. The script may be signed by Microsoft and is commonly executed through the Windows Command Shell via Cscript.exe. For example, the following code publishes a printer within the specified domain: cscript pubprn Printer1 LDAP://CN=Container1,DC=Domain1,DC=Com.

Search For Content

Search Result

Valid Accounts: Domain Accounts

Defense Evasion [Mitre]

System Script Proxy Execution: PubPrn

Defense Evasion [Mitre]