EvilTtaM

You have to rename mimikatz and all the references to it in the ps1 script, AV is only catching the name. Thats what worked for me.

I attached the Ducky Code I used, If there are any suggestions for changes please let me know. I will add that this code assumes that the executionpolicy is set to bypass, however it could be written in to change that. 15secondhack.txt

use Twin Duck firmware to redirect the output to the duck itself. I actually ended up storing the invoke-mimikatz on the duck itself to keep from needing to download it. I modified the script so most AV will not catch it. I used a command prompt to find the duck drive, then used that to set the variable. Dumped the creds to a text file back on the duck drive. I found all the information between the newest video from Mr. Robot hack and an older video they reference in that video where they show the same execution without upload. After some mods I was able to make it work pretty well.