📂 02 - ATT&CK Execution
Overview
MITRE ATT&CK: Execution (TA0002) — the adversary is trying to run malicious code.
Notes here revolve around getting attacker-controlled code or commands to run on a target, as any user: command/argument injection, template injection, deserialization, file upload to code execution, interpreter abuse (e.g. xp_cmdshell), and the shells/payloads used once execution is achieved.
🧠 Techniques
📦 Tech Stack
| File | Created |
|---|---|
| (incomplete) Puma | May 30, 2026 |
| (incomplete) Rack | May 30, 2026 |
| JupyterLab | September 06, 2026 |
| Microsoft SQL Server (MSSQL) | July 23, 2026 |
| OliveTin | September 07, 2026 |
| OpenSTAManager | September 07, 2026 |
🛠️ Tools
| File | Created |
|---|---|
| (incomplete) Kubectl | May 21, 2026 |
| (incomplete) Websocat | September 28, 2026 |
| Docker CLI | May 21, 2026 |
| Evil-WinRM | July 21, 2026 |
| kubeletctl | July 27, 2026 |
| Metasploit | July 24, 2026 |
| Netcat | Sunday, March 22nd 2026, 10:47:12 am |
| SQLmap | Tuesday, February 10th 2026, 10:58:13 pm |