Hostile ^92% Download

LateralMovement_PassTheHash_ByInvokeWMIExec.md

Pass-the-Hash lateral movement tool

Detects Invoke-WmiExec or Invoke-SmbExec

SHA-256085bcb67600cf28bf3efcaf01c1f0f20e9c25994763e8f6a7643c0c079df32ca

MaleculeTh

Evidence

Detects Invoke-WmiExec or Invoke-SmbExec lines 1–9

1# Invoke-WMIExec Pass-the-Hash
2
3Use known username and NTLM hash to execute payload on target host via WMI.
4
5The module executes WMI in memory using the Invoke-WMIExec method. Compared to "WMI Pass-the-Hash", it does not require file upload.
⋯4 lines