T1127.003_jamplus
Adversaries may use `JamPlus` to proxy the execution of a malicious script.
Browse reusable Agent Skills, each with a clear purpose and practical guidance.
Adversaries may use `JamPlus` to proxy the execution of a malicious script.
Adversaries may take advantage of trusted developer utilities to proxy execution of malicious payloads.
Adversaries may execute malicious payloads via loading shared modules.
Adversaries may encode data with a standard data encoding system to make the content of command and control traffic more difficult to detect.
Adversaries may encode data with a non-standard data encoding system to make the content of command and control traffic more difficult to detect.
Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
Adversaries may duplicate then impersonate another user's existing token to escalate privileges and bypass access controls.
Adversaries may create a new process with an existing token to escalate privileges and bypass access controls.
Adversaries may make new tokens and impersonate users to escalate privileges and bypass access controls.
Adversaries may spoof the parent process identifier (PPID) of a new process to evade process-monitoring defenses or to elevate privileges.