SCShell

SCShell SCShell 是一种无文件横向移动工具，依赖 ChangeServiceConfigA 来执行命令。该工具的精妙之处在于它无需通过 SMB 进行身份验证——所有操作均在 DCERPC 上完成。 该工具可远程使用，无需注册服务或创建服务。同时，它也不需要在远程系统上放置任何文件（取决于所使用的执行技术）。 工作原理 该工具不创建服务，而是直接远程打开一个现有服务，并通过 ChangeServiceConfigA API 修改其二进制路径名。 随后启动该服务。 执行完成后，服务二进制路径会被恢复为原始路径。原始服务路径通过 QueryServiceConfigA 获取。...

Silent Pivot: Detecting Fileless Lateral Movement via Service Manager with Trellix NDR

Silent Pivot: Detecting Fileless Lateral Movement via Service Manager with Trellix NDR By Maulik Maheta and Lishoy Mathew · September 8, 2025 Executive summary The tactics of cyber adversaries continue to evolve as they attempt to bypass security vendors. Rather than traditional malware, today’s...

SCShell - Fileless Lateral Movement Tool That Relies On ChangeServiceConfigA To Run Command

Fileless lateral movement tool that relies on ChangeServiceConfigA to run command. The beauty of this tool is that it doesn't perform authentication against SMB everything is performed over DCERPC. The utility can be used remotely WITHOUT registering a service or creating a service. It also doesn...