GitHub SILENTTRINITY Modules July 2019

SILENTTRINITY can create a memory dump of LSASS via the `MiniDumpWriteDump Win32` API call.

SILENTTRINITY can search for modifiable services that could be used for privilege escalation.

SILENTTRINITY can enumerate the active Window during keylogging through execution of `GetActiveWindowTitle`.

SILENTTRINITY can use the `GetRegValue` function to check Registry keys within `HKCU\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated` and `HKLM\Software\Policies\Microsoft\Windows\Installer\AlwaysInstallElevated`. It also contains additional modules that can check software AutoRun values and use the Win32 namespace to get values from HKCU, HKLM, HKCR, and HKCC hives.

SILENTTRINITY can enumerate and collect the properties of domain computers.

SILENTTRINITY can use `System` namespace methods to execute lateral movement using DCOM.

SILENTTRINITY tracks `TrustedHosts` and can move laterally to these targets via WinRM.

SILENTTRINITY can gather a list of logged on users.

SILENTTRINITY can transfer files from an infected host to the C2 server.

SILENTTRINITY can scan for open ports on a compromised machine.

SILENTTRINITY can use WMI for lateral movement.

SILENTTRINITY can inject shellcode directly into Excel.exe or a specific process.

SILENTTRINITY has a keylogging capability.

SILENTTRINITY's `credphisher.py` module can prompt a current user for their credentials.

SILENTTRINITY can enumerate processes, including properties to determine if they have the Common Language Runtime (CLR) loaded.

SILENTTRINITY can use PowerShell to execute commands.

SILENTTRINITY can use `cmd.exe` to enable lateral movement using DCOM.

SILENTTRINITY is written in Python and can use multiple Python scripts for execution on targeted systems.

SILENTTRINITY can obtain a list of local groups and members.

SILENTTRINITY can use `System.DirectoryServices` namespace to retrieve domain group information.

SILENTTRINITY can remove artifacts from the compromised host, including created Registry keys.

SILENTTRINITY can remove files from the compromised host.

SILENTTRINITY can collect information related to a compromised host, including OS version.

SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.

SILENTTRINITY can use `System.Security.AccessControl` namespaces to retrieve domain user information.

SILENTTRINITY can load additional files and tools, including Mimikatz.

SILENTTRINITY has the ability to leverage API including `GetProcAddress` and `LoadLibrary`.

SILENTTRINITY can modify registry keys, including to enable or disable Remote Desktop Protocol (RDP).

SILENTTRINITY can take a screenshot of the current desktop.

SILENTTRINITY can collect start time information from a compromised host.

SILENTTRINITY can find a process owned by a specific user and impersonate the associated token.

SILENTTRINITY can enumerate shares on a compromised host.

SILENTTRINITY can establish persistence by creating a new service.

SILENTTRINITY can conduct an image hijack of an `.msc` file extension as part of its UAC bypass process.

SILENTTRINITY can create a WMI Event to execute a payload for persistence.

SILENTTRINITY can add a CLSID key for payload execution through `Registry.CurrentUser.CreateSubKey("Software\\Classes\\CLSID\\{" + clsid + "}\\InProcServer32")`.

SILENTTRINITY can establish a LNK file in the startup folder for persistence.

SILENTTRINITY contains a number of modules that can bypass UAC, including through Window's Device Manager, Manage Optional Features, and an image hijack on the `.msc` file extension.

SILENTTRINITY has a module that can extract cached GPP passwords.

SILENTTRINITY can collect clear text web credentials for Internet Explorer/Edge.

SILENTTRINITY can gather Windows Vault credentials.

SILENTTRINITY can create a backdoor in KeePass using a malicious config file and in TortoiseSVN using a registry hook.

SILENTTRINITY contains a module to conduct Kerberoasting.

SILENTTRINITY has the ability to set its window state to hidden.

SILENTTRINITY can collect information related to a compromised host, including a list of drives.

SILENTTRINITY's `amsiPatch.py` module can disable Antimalware Scan Interface (AMSI) functions.

SILENTTRINITY can bypass ScriptBlock logging to execute unmanaged PowerShell code from memory.