Hands-On Red Team Tactics

Session graphs

To see the sessions in a graph view, you can click the button shown in the following screenshot:

Session graphs will show a graphical representation of the systems that have been compromised and injected with the payloads. In the following screenshot, the system displayed on the screen has been compromised. PT is the user, PT-PC is the computer name (hostname), and the numbers just after the @ are the PIDs of the processes that have the payload injected into them:

When you escalate the privileges from a normal user to NT AUTHORITY\SYSTEM ...