SOFTWARE
SOFTWARE
A-B
C-D
E-F
G-H
I-J
K-L
M-N
O-P
Q-R
S-T
U-V
W-X
esentutl
esentutl is a command-line tool that provides database utilities for the Windows Extensible Storage Engine.[1]
ID: S0404
Associated Software: esentutl.exe
Type: TOOL
Platforms: Windows
Contributors: Matthew Demaske, Adaptforward
Version: 1.0
Techniques Used
| Domain | ID | Name | Use |
|---|---|---|---|
| Enterprise | T1003 | Credential Dumping |
esentutl can use Volume Shadow Copy to copy locked files such as ntds.dit.[2][3] |
| Enterprise | T1096 | NTFS File Attributes |
esentutl can be used to read and write alternate data streams.[2] |
| Enterprise | T1105 | Remote File Copy |
esentutl can be used to copy files from a remote host or download files from a given URL.[2] |
Groups That Use This Software
| ID | Name | References |
|---|---|---|
| G0045 | menuPass | [4] |