Purple Team

The Windows Security Center collects and presents information about the status of the antivirus control (Windows Defender or 3rd party).

Text template files can contain C# or Visual Basic code that could be compiled and executed at build time.

The file NTUSER.MAN is a Windows user-profile registry hive used with mandatory profiles.

Windows Provisioning Packages are used by Administrators to deploy configuration scripts on Windows environments by using a container format.

The Antimalware Scan Interface (AMSI) is a Microsoft control that directs PowerShell content to the installed antimalware engine or EDR to conduct a scan and identify malicious indicators.

Windows Services are a common target for adversaries because they provide a reliable mechanism for executing code with elevated privileges, maintaining persistence, and blending malicious activity into normal Windows operations.

In Windows, a Quality of Service (QoS) policy is a rule that handles outbound network traffic.

WinGet also known as Windows Package Manager, is Microsoft’s command-line for discovering, installing, upgrading, configuring, and removing applications on Windows.

The technique of EntryPoint Hijacking introduces a stealthier approach to code injection, as it doesn’t rely on API calls that create a new thread within the process context, and it is independent of the attack chain.

Traditional lateral movement techniques are no longer applicable in the modern era due to developments in the detection capability by most of the EDR vendors.