Application Layer Protocol

§ Where this technique fits

§ Dossiers chaining this technique

• Autodiscover external leak → credential harvest

  Mis-implemented Autodiscover falls back to autodiscover.<TLD>; register that domain externally, harvest plaintext Basic-auth credentials from clients that haven't been patched / configured properly.

  step 2 / 5

• ISO container → LNK → stage from CDN → C2

  Email attaches an ISO. Windows mounts it as a drive, bypassing Mark-of-the-Web. LNK inside runs a hidden binary that pulls the real stager from a CDN — Defender often misses the chain.

  step 4 / 6

• AMSI patch → in-memory .NET / PowerShell stager

  Patch AmsiScanBuffer in amsi.dll → return clean for any content. Subsequent PowerShell / Office VBA / .NET runtime calls emit attacker code without scanning.

  step 5 / 6

• OneNote .one attachment → embedded payload → C2

  OneNote .one file with a friendly 'Double-click to view' overlay hides an embedded HTA / VBS / EXE. Effective initial access vector after Microsoft blocked internet macros in 2022.

  step 5 / 6

• USB drop in parking lot → HID payload → C2

  Drop branded-looking USB sticks near the target site. An employee plugs one in; a Rubber-Ducky-class HID device types a PowerShell payload that connects out to attacker C2.

  step 5 / 6

• Process hollowing → run beacon in svchost shell

  Spawn svchost.exe suspended, unmap its image, write attacker PE into the same address space, resume — the process keeps a legit-looking PEB and command line but executes beacon code.

  step 6 / 6

• Build-system implant → signed supply-chain backdoor (SolarWinds-class)

  Compromise the target vendor's build server. A small implant rewrites a single source file at compile time — every official signed release downstream now ships the backdoor.

  step 6 / 7

• certutil + bitsadmin → AV-friendly stager chain

  Initial access dropped a tiny .bat. It uses certutil to decode a base64 blob and bitsadmin to fetch the real beacon, then schtasks for persistence. Every binary is signed Microsoft.

  step 6 / 6

§ What commonly comes next

1. 01
   Scheduled Task Hijack

   W-SCHEDTASK-HIJACK · Persistence
   seen 2×
2. 02
   Autodiscover Domain Hijack

   EX-AUTODISCOVER-LEAK · Credential Access
   seen 1×
3. 03
   Boot or Logon Autostart Execution

   T1547 · Persistence
   seen 1×
4. 04
   Valid Accounts

   T1078 · Initial Access
   seen 1×
5. 05
   scrcons.exe WMI Event Subscription

   LOL-SCRCONS · Persistence
   seen 1×