Red team TTP/Blue team enabler:
SMB blocked by firewall or fileshare logging is turned on, but you want to transfer a file more quietly to a server?
Copy-Item can copy over the WinRM communication channel, no SMB involved.
(@adbertram)https://t.co/31ARy8Q5Z9— SwiftOnSecurity (@SwiftOnSecurity) December 17, 2019
Someone else figured out one of my tricks! Cool. It’s a really great one.
It’s caused more than one person to say to me, “We have SMB completely blocked, as well as all copy and paste functionality. So how did you move those files from that server to the other server?”
But I hope not too many people find out about it because I use it to do things people think I shouldn’t (but need for my job) all the time.