BravoX

Exploit Public-Facing Application

Exploit vulnerabilities in internet-facing applications to gain access.

Valid Accounts

Use legitimate credentials to authenticate and gain access.

External Remote Services

Abuse remote services like VPNs or RDP to gain access to the network.

Spearphishing Attachment

Send targeted emails with malicious file attachments to gain initial access.

Spearphishing Link

Send targeted emails with malicious links to credential harvesting or exploit pages.

Windows Management Instrumentation

Use WMI to execute commands and manage systems remotely.

PowerShell

Use PowerShell commands and scripts for execution and automation.

Windows Command Shell

Use cmd.exe to execute commands and batch scripts.

T1053.005

T1562.001

T1070.004

T1087.002

T1069.002

T1482

T1567.002

T1542.003

T1204.002

Data Encrypted for Impact

Encrypt victim data to disrupt availability, typically for ransom.

Inhibit System Recovery

Delete backups, shadow copies, or recovery partitions to prevent restoration.

Service Stop

Stop critical services to disrupt operations or aid in data destruction.

File and Directory Discovery

Enumerate files and directories to find sensitive data or binaries.

Remote System Discovery

Discover remote systems on the network for lateral movement targets.

Remote Desktop Protocol

Use RDP to connect to and control remote systems.

SMB/Windows Admin Shares

Use SMB and administrative shares (C$, ADMIN$) to access remote systems.

Exfiltration Over C2 Channel

Exfiltrate stolen data over the existing command and control channel.

System Binary Proxy Execution

Use signed system binaries to proxy execution of malicious content.