Infostealer Browser Credential Theft
Infostealers systematically harvest credentials, cookies, and autofill data from browser credential databases. This i...
TTPs evolve. Chokepoints don't.
Attack prerequisites that cannot be bypassed regardless of tool choice. High-signal, low-volume detection opportunities for every defender.
Every entry below targets an invariant prerequisite that attackers cannot bypass regardless of tool choice. Detections anchored to these chokepoints survive tool rotation, obfuscation, and variant evolution. Learn the framework →
Infostealers systematically harvest credentials, cookies, and autofill data from browser credential databases. This i...
To extract plaintext credentials, NTLM hashes, or Kerberos tickets from a live Windows system, an attacker must read ...
Adversaries impair or neutralize EDR/AV products before executing their primary payload to prevent detection and resp...
Before encrypting files, ransomware operators stop and delete security tools, backup services, and database engines t...
Adversaries plant web-accessible scripts (web shells) on compromised servers to maintain persistent command execution...
Adversaries bring legitimate, vendor-signed scripting interpreters (Python, PHP, Node.js, Ruby, Perl, AutoHotKey, etc...
User pastes a malicious command from their clipboard into a Run dialog, terminal, or Explorer address bar. The lure p...
Legitimate remote management and monitoring (RMM) tools are renamed or masqueraded to appear as trusted applications ...
Offensive security tools (Impacket, NetExec, CrackMapExec, Evil-WinRM) used for remote code execution across Windows ...
No chokepoints match your search.