Pupy

Pupy can bypass Windows UAC through either DLL hijacking, eventvwr, or appPaths.(Citation: GitHub Pupy)

Pupy can obtain a list of SIDs and provide the option for selecting process tokens to impersonate.(Citation: GitHub Pupy)

Pupy uses PowerView and Pywerview to perform discovery commands such as net user, net group, net local group, etc.(Citation: GitHub Pupy)

Pupy can sniff plaintext network credentials and use NBNS Spoofing to poison name services.(Citation: GitHub Pupy)

Pupy can communicate over HTTP for C2.(Citation: GitHub Pupy)

Pupy can compress data with Zip before sending it over C2.(Citation: GitHub Pupy)

Pupy adds itself to the startup folder or adds itself to the Registry key SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.(Citation: GitHub Pupy)

Pupy has a module for loading and executing PowerShell scripts.(Citation: GitHub Pupy)

Pupy can user PowerView to execute “net user” commands and create local system accounts.(Citation: GitHub Pupy)

Pupy can be used to establish persistence using a systemd service.(Citation: GitHub Pupy)

Pupy can use Lazagne for harvesting credentials.(Citation: GitHub Pupy)

Pupy can interact with a victim’s Outlook session and look through folders and emails.(Citation: GitHub Pupy)

Pupy's default encryption for its C2 communication channel is SSL, but it also has transport options for RSA and AES.(Citation: GitHub Pupy)

Pupy has a module to clear event logs with PowerShell.(Citation: GitHub Pupy)

Pupy uses a keylogger to capture keystrokes it then sends back to the server after it is stopped.(Citation: GitHub Pupy)

Pupy can execute Lazagne as well as Mimikatz using PowerShell.(Citation: GitHub Pupy)

Pupy can migrate into another process using reflective DLL injection.(Citation: GitHub Pupy)

Pupy can enable/disable RDP connection and can start a remote desktop session using a browser web socket client.(Citation: GitHub Pupy)

Pupy uses PsExec to execute a payload or commands on a remote host.(Citation: GitHub Pupy)

Pupy can use Lazagne for harvesting credentials.(Citation: GitHub Pupy)

Pupy can also perform pass-the-ticket.(Citation: GitHub Pupy)

Pupy has a module that checks a number of indicators on the system to determine if its running on a virtual machine.(Citation: GitHub Pupy)