FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
access_lsass_memory_for_dump_creation.test.yml		access_lsass_memory_for_dump_creation.test.yml
attempt_to_add_certificate_to_untrusted_store.test.yml		attempt_to_add_certificate_to_untrusted_store.test.yml
attempted_credential_dump_from_registry_via_reg_exe.test.yml		attempted_credential_dump_from_registry_via_reg_exe.test.yml
attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml		attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml
create_local_admin_accounts_using_net_exe.test.yml		create_local_admin_accounts_using_net_exe.test.yml
create_remote_thread_into_lsass.test.yml		create_remote_thread_into_lsass.test.yml
creation_of_shadow_copy.test.yml		creation_of_shadow_copy.test.yml
creation_of_shadow_copy_with_wmic_and_powershell.test.yml		creation_of_shadow_copy_with_wmic_and_powershell.test.yml
credential_dumping_via_copy_command_from_shadow_copy.test.yml		credential_dumping_via_copy_command_from_shadow_copy.test.yml
credential_dumping_via_symlink_to_shadow_copy.test.yml		credential_dumping_via_symlink_to_shadow_copy.test.yml
detect_activity_related_to_pass_the_hash_attacks.test.yml		detect_activity_related_to_pass_the_hash_attacks.test.yml
detect_credential_dumping_through_lsass_access.test.yml		detect_credential_dumping_through_lsass_access.test.yml
detect_dump_lsass_memory_using_comsvcs___ssa.test.yml		detect_dump_lsass_memory_using_comsvcs___ssa.test.yml
detect_new_local_admin_account.test.yml		detect_new_local_admin_account.test.yml
detect_path_interception_by_creation_of_program_exe.test.yml		detect_path_interception_by_creation_of_program_exe.test.yml
detect_prohibited_applications_spawning_cmd_exe.test.yml		detect_prohibited_applications_spawning_cmd_exe.test.yml
dump_lsass_via_comsvcs_dll.test.yml		dump_lsass_via_comsvcs_dll.test.yml
first_time_seen_cmd_line___ssa.test.yml		first_time_seen_cmd_line___ssa.test.yml
kerberoasting_spn_request_with_rc4_encryption.test.yml		kerberoasting_spn_request_with_rc4_encryption.test.yml
malicious_powershell_process___encoded_command.test.yml		malicious_powershell_process___encoded_command.test.yml
process_execution_via_wmi.test.yml		process_execution_via_wmi.test.yml
prohibited_apps_spawning_cmdprompt___ssa.test.yml		prohibited_apps_spawning_cmdprompt___ssa.test.yml
rare_parent_process_relationship_lolbas___ssa.test.yaml		rare_parent_process_relationship_lolbas___ssa.test.yaml
schtasks_scheduling_job_on_remote_system.test.yml		schtasks_scheduling_job_on_remote_system.test.yml
short_lived_windows_accounts.test.yml		short_lived_windows_accounts.test.yml
ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml		ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml
ssa___applying_stolen_credentials_via_powersploit_modules.test.yml		ssa___applying_stolen_credentials_via_powersploit_modules.test.yml
ssa___credential_extraction_dsinternals_conversion_modules.test.yml		ssa___credential_extraction_dsinternals_conversion_modules.test.yml
ssa___credential_extraction_dsinternals_modules.test.yml		ssa___credential_extraction_dsinternals_modules.test.yml
ssa___credential_extraction_fgdump_cachedump_s_option.test.yml		ssa___credential_extraction_fgdump_cachedump_s_option.test.yml
ssa___credential_extraction_fgdump_cachedump_v_option.test.yml		ssa___credential_extraction_fgdump_cachedump_v_option.test.yml
ssa___credential_extraction_getaddbaccount_from_dump.test.yml		ssa___credential_extraction_getaddbaccount_from_dump.test.yml
ssa___credential_extraction_lazagne_command_options.test.yml		ssa___credential_extraction_lazagne_command_options.test.yml
ssa___credential_extraction_mimikatz_modules.test.yml		ssa___credential_extraction_mimikatz_modules.test.yml
ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml		ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml
ssa___credential_extraction_ms_debuggers_z_option.test.yml		ssa___credential_extraction_ms_debuggers_z_option.test.yml
ssa___credential_extraction_powersploit_modules.test.yml		ssa___credential_extraction_powersploit_modules.test.yml
ssa___setting_credentials_via_dsinternals_modules.test.yml		ssa___setting_credentials_via_dsinternals_modules.test.yml
ssa___setting_credentials_via_mimikatz_modules.test.yml		ssa___setting_credentials_via_mimikatz_modules.test.yml
ssa___setting_credentials_via_powersploit_modules.test.yml		ssa___setting_credentials_via_powersploit_modules.test.yml
suspicious_reg_exe_process.test.yml		suspicious_reg_exe_process.test.yml
system_information_discovery_detection.test.yml		system_information_discovery_detection.test.yml
system_process_running_unexpected_location___ssa.test.yml		system_process_running_unexpected_location___ssa.test.yml
unload_sysmon_filter_driver.test.yml		unload_sysmon_filter_driver.test.yml
unsigned_image_loaded_by_lsass.test.yml		unsigned_image_loaded_by_lsass.test.yml
unusual_lolbas_in_short_period_of_time___ssa.test.yml		unusual_lolbas_in_short_period_of_time___ssa.test.yml
unusually_long_command_line___ssa.test.yml		unusually_long_command_line___ssa.test.yml
windows_event_log_cleared.test.yml		windows_event_log_cleared.test.yml
View all files