| .. |
|
av_exploiting.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
av_password_dumper.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
av_relevant_files.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
av_webshell.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
powershell_downgrade_attack.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
powershell_exe_calling_ps.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
powershell_malicious_commandlets.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
powershell_malicious_keywords.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
powershell_ntfs_ads_access.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
powershell_prompt_credentials.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
powershell_psattack.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
powershell_shellcode_b64.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
powershell_suspicious_download.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
powershell_suspicious_invocation_generic.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
powershell_suspicious_invocation_specific.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
powershell_xor_commandline.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_ads_executable.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_attrib_hiding_files.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_bitsadmin_download.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_bypass_squiblytwo.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_cmdkey_recon.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_cmstp_com_object_access.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
sysmon_cmstp_execution.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_cobaltstrike_process_injection.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_dhcp_calloutdll.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_dns_serverlevelplugindll.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_exploit_cve_2015_1641.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_exploit_cve_2017_0261.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_exploit_cve_2017_8759.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_exploit_cve_2017_11882.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_ghostpack_safetykatz.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_lethalhta.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_mal_namedpipes.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_malware_backconnect_ports.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_malware_notpetya.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_malware_script_dropper.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_malware_verclsid_shellcode.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_malware_wannacry.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_mimikatz_detection_lsass.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_mimikatz_inmemory_detection.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
sysmon_mshta_spawn_shell.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_office_shell.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_outlook_shell.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_password_dumper_lsass.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_plugx_susp_exe_locations.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_powershell_amsi_bypass.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_powershell_dll_execution.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_powershell_download.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_powershell_exploit_scripts.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_powershell_network_connection.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_powershell_suspicious_parameter_variation.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_powersploit_schtasks.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_quarkspw_filedump.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_rundll32_net_connections.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_sdbinst_shim_persistence.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_shell_spawn_susp_program.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_stickykey_like_backdoor.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_susp_certutil_command.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_cmd_http_appdata.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_control_dll_load.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_driver_load.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_exec_folder.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_execution_path_webserver.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_execution_path.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_image_load.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_mmc_source.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_net_execution.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_ping_hex_ip.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_powershell_parent_combo.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_powershell_rundll32.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_prog_location_network_connection.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_recon_activity.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_reg_persist_explorer_run.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_regsvr32_anomalies.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_run_key_img_folder.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_schtask_creation.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
sysmon_susp_script_execution.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_svchost.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_taskmgr_localsystem.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_taskmgr_parent.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_tscon_localsystem.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_susp_tscon_rdp_redirect.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_susp_vssadmin_ntds_activity.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_susp_wmi_execution.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_sysinternals_eula_accepted.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_system_exe_anomaly.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_uac_bypass_eventvwr.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
sysmon_uac_bypass_sdclt.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
sysmon_vul_java_remote_debugging.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_webshell_detection.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
sysmon_webshell_spawn.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
sysmon_win_binary_github_com.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_win_binary_susp_com.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
sysmon_win_reg_persistence.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
sysmon_wmi_persistence_commandline_event_consumer.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_wmi_persistence_script_event_consumer_write.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
sysmon_workflow_compiler.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
win_admin_rdp_login.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_admin_share_access.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_alert_active_directory_user_control.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_alert_ad_user_backdoors.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_alert_enable_weak_encryption.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
win_alert_hacktool_use.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_alert_lsass_access.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_alert_mimikatz_keywords.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_av_relevant_match.md
|
changed directories names
|
2019-02-12 04:55:11 +01:00 |
|
win_dcsync.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_disable_event_logging.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_eventlog_cleared.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_hack_smbexec.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_mal_adwind.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_mal_creddumper.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_mal_service_installs.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_mal_wannacry.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_mal_wceaux_dll.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_multiple_suspicious_cli.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_net_ntlm_downgrade.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_overpass_the_hash.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_pass_the_hash.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_plugx_susp_exe_locations.md
|
rebuided md db with ned DN
|
2019-02-13 20:27:19 +01:00 |
|
win_possible_applocker_bypass.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_powershell_b64_shellcode.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_psexesvc_start.md
|
rebuided md db with ned DN
|
2019-02-13 20:27:19 +01:00 |
|
win_rare_schtask_creation.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_rare_schtasks_creations.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_rare_service_installs.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_susp_add_sid_history.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_susp_backup_delete.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_cli_escape.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_commands_recon_activity.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_dhcp_config_failed.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
win_susp_dhcp_config.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
win_susp_dns_config.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
win_susp_dsrm_password_change.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_susp_eventlog_cleared.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_failed_logon_reasons.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_susp_failed_logons_single_source.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_susp_interactive_logons.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_iss_module_install.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_kerberos_manipulation.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_lsass_dump.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_msiexec_web_install.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_msmpeng_crash.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_net_recon_activity.md
|
rebuided md db with ned DN
|
2019-02-13 20:27:19 +01:00 |
|
win_susp_ntdsutil.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_ntlm_auth.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_powershell_enc_cmd.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_powershell_hidden_b64_cmd.md
|
rebuided md db with ned DN
|
2019-02-13 20:27:19 +01:00 |
|
win_susp_procdump.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_process_creations.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_rasdial_activity.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_rc4_kerberos.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_run_locations.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_rundll32_activity.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_sam_dump.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_samr_pwset.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_sdelete.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_security_eventlog_cleared.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_susp_svchost.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_sysprep_appdata.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_sysvol_access.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_susp_whoami.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_tool_psexec.md
|
fixes for triggers, techniques url for markdown fixed
|
2019-02-13 01:04:13 +01:00 |
|
win_usb_device_plugged.md
|
code de-hardcoding, powershell events groundwork
|
2019-02-11 23:28:16 +01:00 |
|
win_user_added_to_local_administrators.md
|
name of technique presented in trigger name for confluence, templates updates, makefile fixes
|
2019-02-13 18:28:15 +01:00 |
|
win_wmi_persistence_script_event_consumer.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
|
win_wmi_persistence.md
|
1st alpha release
|
2019-02-13 22:14:52 +01:00 |
