Advanced Persistent Threat Simulation

Acquisition of domains for phishing/C2

Adversary sends targeted email with malicious attachment

Adversary sends email with malicious URL

Abuse of PowerShell for execution and scripting

Compromise of valid credentials for access

Encoding/encryption of payloads to evade detection

AitM attacks to intercept credentials

Lateral movement via RDP sessions

C2 communication over HTTP/HTTPS

Use of proxy to mask C2 traffic origin

Data exfiltration through existing C2 channel

Ransomware encryption of victim data