SCShell

SCShell SCShell è uno strumento di movimento laterale senza file che si basa su ChangeServiceConfigA per eseguire comandi. Il bello di questo strumento è che non esegue l'autenticazione tramite SMB. Tutto avviene tramite DCERPC. L'utility può essere usata da remoto SENZA registrare o creare un...

Silent Pivot: Detecting Fileless Lateral Movement via Service Manager with Trellix NDR

Silent Pivot: Detecting Fileless Lateral Movement via Service Manager with Trellix NDR By Maulik Maheta and Lishoy Mathew · September 8, 2025 Executive summary The tactics of cyber adversaries continue to evolve as they attempt to bypass security vendors. Rather than traditional malware, today’s...

SCShell - Fileless Lateral Movement Tool That Relies On ChangeServiceConfigA To Run Command

Fileless lateral movement tool that relies on ChangeServiceConfigA to run command. The beauty of this tool is that it doesn't perform authentication against SMB everything is performed over DCERPC. The utility can be used remotely WITHOUT registering a service or creating a service. It also doesn...