OSEP key terms

A delivery technique that embeds a payload inside a benign-looking HTML page and uses JavaScript Blob or URL objects so the browser reconstructs and downloads the file, evading email and network filters that do not inspect browser-generated content.

An NTFS alternate data stream named Zone.Identifier that Windows attaches to files downloaded from the internet, causing Office and other applications to open them in Protected View or block macros.

A Windows shortcut file that stores a target executable and arguments; attackers craft shortcuts that launch PowerShell or cmd to fetch and run a payload when the victim double-clicks.

An HTML Application file executed by mshta.exe that runs HTML with VBScript or JScript outside the browser sandbox, giving user-level code execution when opened.

A disk image file that Windows mounts natively; files extracted from it do not inherit Mark-of-the-Web, so running a payload from a mounted image can bypass macro blocking.

An XML-based Windows library or search connector file that can point to a remote WebDAV or UNC path, causing Explorer to authenticate to an attacker server and leak NetNTLM hashes.

Running a rogue SMB, HTTP, or LLMNR service that answers broadcast name-resolution requests so victims authenticate to it, allowing capture of NetNTLM challenge-response hashes for cracking or relay.

Forwarding captured NetNTLM authentication to another host to authenticate as the victim without cracking the hash; it succeeds when SMB signing is disabled on the target.

Trying a single common password against many domain accounts in one attempt to avoid lockout, looking for users with weak or default credentials.

The Antimalware Scan Interface is a Windows API that lets applications submit scripts and memory buffers to the installed antivirus for scanning before execution.

Patching or modifying AMSI functions such as AmsiScanBuffer inside the current process so that malicious PowerShell or .NET content is no longer scanned.

Modifying Event Tracing for Windows functions such as EtwEventWrite in a process so that EDR telemetry about process, network, and .NET activity is suppressed.

A PowerShell mode that restricts .NET type usage and blocks many offensive cmdlets, commonly enforced when AppLocker or WDAC is active.

A Windows application whitelisting feature that allows or blocks executables, scripts, DLLs, and installers based on path, publisher, or hash rules.

Windows Defender Application Control is a kernel-enforced whitelisting mechanism that restricts which drivers and binaries may run; it is stricter and harder to bypass than AppLocker.

A living-off-the-land binary is a legitimate, often signed, system executable abused to run attacker code or download payloads while blending in with normal activity.

Running code through a trusted signed Microsoft binary such as rundll32, regsvr32, or msbuild so execution appears legitimate and satisfies application whitelisting.

Requesting Kerberos service tickets for accounts that have service principal names, then cracking the encrypted ticket material offline to recover the service account password.

Requesting an AS-REP for accounts that have Kerberos pre-authentication disabled, then cracking the encrypted portion offline to recover their passwords.

Impersonating a domain controller by using directory replication rights to request password hashes for Active Directory accounts without touching LSASS on a domain controller.

Extracting plaintext passwords, hashes, or Kerberos tickets from a compromised host's memory, registry, or files such as the LSASS process or SAM database.

Authenticating to a remote system using a captured NTLM hash instead of the plaintext password, which works because NTLM authentication does not require the original password.

A forged Kerberos ticket-granting ticket signed with the krbtgt account hash, allowing the attacker to impersonate any user and access any resource in the domain.

A forged Kerberos service ticket for one specific service, signed with that service account hash, granting access to that service without contacting the domain controller.

A Kerberos delegation setting that lets a service impersonate users to any other service; compromising that host allows capture of TGTs from users who authenticate to it.

Resource-Based Constrained Delegation lets a resource owner decide which accounts may impersonate users to it; attackers with write access to a computer object can set this and impersonate privileged users.

Exploiting misconfigured Active Directory object permissions such as GenericAll or WriteDACL to reset passwords, grant rights, or take over accounts and groups.

Abusing the SeImpersonatePrivilege held by service accounts to coerce a SYSTEM token from a privileged process and escalate to local administrator.

A service configuration whose binary path contains spaces but no quotation marks, allowing an attacker to place a malicious executable in a directory Windows searches first.

A graph-analysis tool that ingests Active Directory data and reveals attack paths such as ACL relationships, delegation, and session data.

A curated list of legitimate Unix binaries that can be abused to read files, spawn shells, or escalate privileges when executed with elevated rights or sudo access.

Running a binary with the setuid bit set so it executes as its owner, usually root; it becomes exploitable when the binary can spawn a shell or read protected files.

Sudo rules that allow NOPASSWD, wildcards, environment variables, or dangerous commands, letting a low-privileged user run arbitrary commands as root.

Fine-grained privileges such as cap_setuid or cap_dac_read_search assigned to binaries; they can be abused to escalate when granted to a program an attacker can control.

Exploiting writable cron scripts, directories, or PATH variables in jobs that run as root to execute attacker code with root privileges.

An environment variable that loads a shared library before others; if sudo preserves it or a privileged program honors it, an attacker can inject a malicious library into a root process.

Adding an attacker-controlled public key to a user's authorized_keys file so the attacker can log in later without a password, maintaining access.

Using a compromised host as a jump point to reach systems on otherwise inaccessible internal networks, usually through local, remote, or dynamic port forwarding.

A tunneling tool that carries SOCKS or port-forward traffic over HTTP or WebSocket through a compromised host, creating a reverse tunnel into a segmented network.