Skip to main content

262COS-CTE-AID-003 - ATT&CK Techniques - Windows LOL

Operator reference for Living Off the Land (LOL) cyber threat emulation techniques on Windows - persistence, privilege escalation, credential access, lateral movement, defense evasion, discovery, collection, and C2 using only signed Windows built-in binaries.

📄️ Introduction

---

📄️ Operational Workflow

This page maps a common CTE kill chain - from initial shell to cleanup - with branch points that route to the appropriate technique based on what you find. It is one way to work through an engagement, not the only way. Adapt it to your operational context.

🗃️ Persistence

15 items

🗃️ Privilege Escalation

5 items

🗃️ Credential Access

2 items

🗃️ Lateral Movement

1 item

🗃️ Defense Evasion

4 items

🗃️ Discovery

1 item

🗃️ Collection

1 item

🗃️ Command and Control

1 item

🗃️ Appendix

2 items