Dump registry SAM Hive via Microsoft Word Add-in
Tactic: Persistence
'This TTP will stage a UPX packed .wll file in the Microsoft\Word\STARTUP directory and then start Word to execute the Word Add-in and dump SAM registry hive into c:\temp\folder.'
View Command
To view this TTPs command, you must be logged in with a professional or enterprise license.
LoginTest this TTP
Download Operator (1.7.1)
Test this TTP using one of our Operator chainsStage and execute malicious Microsoft Office add-in.
Is my host protected against Microsoft Office add-ins?
2023-01-11
Follow @preludeorg on Twitter for new chains and more.
Join the Prelude Discord to discuss chains and more.
Keep up to date with code changes and community activity on Github