FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
7zip_commandline_to_smb_share_path.yml		7zip_commandline_to_smb_share_path.yml
active_setup_registry_autostart.yml		active_setup_registry_autostart.yml
add_defaultuser_and_password_in_registry.yml		add_defaultuser_and_password_in_registry.yml
add_or_set_windows_defender_exclusion.yml		add_or_set_windows_defender_exclusion.yml
allow_file_and_printing_sharing_in_firewall.yml		allow_file_and_printing_sharing_in_firewall.yml
allow_inbound_traffic_by_firewall_rule_registry.yml		allow_inbound_traffic_by_firewall_rule_registry.yml
allow_network_discovery_in_firewall.yml		allow_network_discovery_in_firewall.yml
allow_operation_with_consent_admin.yml		allow_operation_with_consent_admin.yml
anomalous_usage_of_7zip.yml		anomalous_usage_of_7zip.yml
any_powershell_downloadfile.yml		any_powershell_downloadfile.yml
any_powershell_downloadstring.yml		any_powershell_downloadstring.yml
attacker_tools_on_endpoint.yml		attacker_tools_on_endpoint.yml
attempt_to_add_certificate_to_untrusted_store.yml		attempt_to_add_certificate_to_untrusted_store.yml
attempted_credential_dump_from_registry_via_reg_exe.yml		attempted_credential_dump_from_registry_via_reg_exe.yml
auto_admin_logon_registry_entry.yml		auto_admin_logon_registry_entry.yml
batch_file_write_to_system32.yml		batch_file_write_to_system32.yml
bcdedit_command_back_to_normal_mode_boot.yml		bcdedit_command_back_to_normal_mode_boot.yml
bcdedit_failure_recovery_modification.yml		bcdedit_failure_recovery_modification.yml
bits_job_persistence.yml		bits_job_persistence.yml
bitsadmin_download_file.yml		bitsadmin_download_file.yml
certutil_download_with_urlcache_and_split_arguments.yml		certutil_download_with_urlcache_and_split_arguments.yml
certutil_download_with_verifyctl_and_split_arguments.yml		certutil_download_with_verifyctl_and_split_arguments.yml
certutil_exe_certificate_extraction.yml		certutil_exe_certificate_extraction.yml
certutil_with_decode_argument.yml		certutil_with_decode_argument.yml
change_default_file_association.yml		change_default_file_association.yml
change_to_safe_mode_with_network_config.yml		change_to_safe_mode_with_network_config.yml
chcp_command_execution.yml		chcp_command_execution.yml
check_elevated_cmd_using_whoami.yml		check_elevated_cmd_using_whoami.yml
child_processes_of_spoolsv_exe.yml		child_processes_of_spoolsv_exe.yml
clear_unallocated_sector_using_cipher_app.yml		clear_unallocated_sector_using_cipher_app.yml
cmd_carry_out_string_command_parameter.yml		cmd_carry_out_string_command_parameter.yml
cmd_echo_pipe___escalation.yml		cmd_echo_pipe___escalation.yml
cmdline_tool_not_executed_in_cmd_shell.yml		cmdline_tool_not_executed_in_cmd_shell.yml
conti_common_exec_parameter.yml		conti_common_exec_parameter.yml
control_loading_from_world_writable_directory.yml		control_loading_from_world_writable_directory.yml
create_local_admin_accounts_using_net_exe.yml		create_local_admin_accounts_using_net_exe.yml
create_or_delete_windows_shares_using_net_exe.yml		create_or_delete_windows_shares_using_net_exe.yml
creation_of_shadow_copy.yml		creation_of_shadow_copy.yml
creation_of_shadow_copy_with_wmic_and_powershell.yml		creation_of_shadow_copy_with_wmic_and_powershell.yml
credential_dumping_via_copy_command_from_shadow_copy.yml		credential_dumping_via_copy_command_from_shadow_copy.yml
credential_dumping_via_symlink_to_shadow_copy.yml		credential_dumping_via_symlink_to_shadow_copy.yml
csc_net_on_the_fly_compilation.yml		csc_net_on_the_fly_compilation.yml
curl_download_and_bash_execution.yml		curl_download_and_bash_execution.yml
deleting_shadow_copies.yml		deleting_shadow_copies.yml
detect_azurehound_command_line_arguments.yml		detect_azurehound_command_line_arguments.yml
detect_azurehound_file_modifications.yml		detect_azurehound_file_modifications.yml
detect_exchange_web_shell.yml		detect_exchange_web_shell.yml
detect_html_help_renamed.yml		detect_html_help_renamed.yml
detect_html_help_spawn_child_process.yml		detect_html_help_spawn_child_process.yml
detect_html_help_url_in_command_line.yml		detect_html_help_url_in_command_line.yml
detect_html_help_using_infotech_storage_handlers.yml		detect_html_help_using_infotech_storage_handlers.yml
detect_mshta_inline_hta_execution.yml		detect_mshta_inline_hta_execution.yml
detect_mshta_renamed.yml		detect_mshta_renamed.yml
detect_mshta_url_in_command_line.yml		detect_mshta_url_in_command_line.yml
detect_outlook_exe_writing_a_zip_file.yml		detect_outlook_exe_writing_a_zip_file.yml
detect_path_interception_by_creation_of_program_exe.yml		detect_path_interception_by_creation_of_program_exe.yml
detect_prohibited_applications_spawning_cmd_exe.yml		detect_prohibited_applications_spawning_cmd_exe.yml
detect_rclone_command_line_usage.yml		detect_rclone_command_line_usage.yml
detect_regasm_spawning_a_process.yml		detect_regasm_spawning_a_process.yml
detect_regasm_with_no_command_line_arguments.yml		detect_regasm_with_no_command_line_arguments.yml
detect_regsvcs_spawning_a_process.yml		detect_regsvcs_spawning_a_process.yml
detect_regsvcs_with_no_command_line_arguments.yml		detect_regsvcs_with_no_command_line_arguments.yml
detect_renamed_7_zip.yml		detect_renamed_7_zip.yml
detect_renamed_psexec.yml		detect_renamed_psexec.yml
detect_renamed_rclone.yml		detect_renamed_rclone.yml
detect_renamed_winrar.yml		detect_renamed_winrar.yml
detect_sharphound_command_line_arguments.yml		detect_sharphound_command_line_arguments.yml
detect_sharphound_file_modifications.yml		detect_sharphound_file_modifications.yml
detect_sharphound_usage.yml		detect_sharphound_usage.yml
detect_use_of_cmd_exe_to_launch_script_interpreters.yml		detect_use_of_cmd_exe_to_launch_script_interpreters.yml
detection_of_tools_built_by_nirsoft.yml		detection_of_tools_built_by_nirsoft.yml
disable_amsi_through_registry.yml		disable_amsi_through_registry.yml
disable_defender_blockatfirstseen_feature.yml		disable_defender_blockatfirstseen_feature.yml
disable_defender_enhanced_notification.yml		disable_defender_enhanced_notification.yml
disable_defender_mpengine_registry.yml		disable_defender_mpengine_registry.yml
disable_defender_spynet_reporting.yml		disable_defender_spynet_reporting.yml
disable_defender_submit_samples_consent_feature.yml		disable_defender_submit_samples_consent_feature.yml
disable_etw_through_registry.yml		disable_etw_through_registry.yml
disable_logs_using_wevtutil.yml		disable_logs_using_wevtutil.yml
disable_registry_tool.yml		disable_registry_tool.yml
disable_schedule_task.yml		disable_schedule_task.yml
disable_security_logs_using_minint_registry.yml		disable_security_logs_using_minint_registry.yml
disable_show_hidden_files.yml		disable_show_hidden_files.yml
disable_uac_remote_restriction.yml		disable_uac_remote_restriction.yml
disable_windows_app_hotkeys.yml		disable_windows_app_hotkeys.yml
disable_windows_behavior_monitoring.yml		disable_windows_behavior_monitoring.yml
disable_windows_smartscreen_protection.yml		disable_windows_smartscreen_protection.yml
disabling_cmd_application.yml		disabling_cmd_application.yml
disabling_controlpanel.yml		disabling_controlpanel.yml
disabling_defender_services.yml		disabling_defender_services.yml
disabling_firewall_with_netsh.yml		disabling_firewall_with_netsh.yml
disabling_folderoptions_windows_feature.yml		disabling_folderoptions_windows_feature.yml
disabling_norun_windows_app.yml		disabling_norun_windows_app.yml
disabling_remote_user_account_control.yml		disabling_remote_user_account_control.yml
disabling_systemrestore_in_registry.yml		disabling_systemrestore_in_registry.yml
disabling_task_manager.yml		disabling_task_manager.yml
dllhost_with_no_command_line_arguments_with_network.yml		dllhost_with_no_command_line_arguments_with_network.yml
domain_account_discovery_with_dsquery.yml		domain_account_discovery_with_dsquery.yml
domain_account_discovery_with_net_app.yml		domain_account_discovery_with_net_app.yml
domain_account_discovery_with_wmic.yml		domain_account_discovery_with_wmic.yml
View all files