SCYTHE
Setup Campaign
Login to your SCYTHE instance via web browser. Default port is 8443.
Campaign Manager - New Campaign
Select the following options:
Name: unique name for the campaign
Target Operating System: Windows, Linux, or macOS
Restrict Campaign through Execution Guardrails (T1480) by Device, Domain, Start Date, and/or End Date
Communication Module:
HTTPS is default,
DNS, HTTP, and Stego require relays to be installed on redirector
Google Sheet and Twitter require third party account/API
Community Threats (Third Party Adversary Emulation Plans)
Download Community Threats from SCYTHE Github: https://github.com/scythe-io/community-threats
Import into SCYTHE: Threat Manager - Migrate Threats - Choose File - Import
Use a Threat: Threat Manager - Threat Catalog - Click Threat - Create Campaign from Threat
Deploy Payload
User Execution: Malicious File (T1204.002):
Download the binary to the target system and execute by double clicking.
Signed Binary Proxy Execution: Rundll32 (T1218.011):
Download DLL file from SCYTHE and execute below from a cmd.exe:
Command and Scripting Interpreter: PowerShell (T1059.001)
Open a powershell.exe and run:
Emulate TTPs
Load Python Runtime
Download files
Move file to virtual file system
Privilege Escalation (TA0004)
UAC (T1088)
Credential Access (TA0006)
Credential Dumping (T1003)
Persistence (TA0003)
New Service (T1050)
Scheduled Task (T1168)
Clean up
Persistence:
Kill agent:
Last updated