diff --git a/Offensive.md b/Offensive.md index 908665c..34a74ff 100644 --- a/Offensive.md +++ b/Offensive.md @@ -535,6 +535,10 @@ Some tools can be categorized in more than one category. But because the current airzero24/PortMonitorPersist PoC for Port Monitor Persistence + + ben0xa/doucme + This leverages the NetUserAdd Win32 API to create a new computer account. This is done by setting the usri1_priv of the USER_INFO_1 type to 0x1000. The primary goal is to avoid the normal detection of new user created events (4720). + fireeye/SharPersist Windows persistence toolkit written in C#.