FilesExpand file tree

develop

/

detections

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

detections

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
applying_stolen_credentials_via_mimikatz_modules.yml		applying_stolen_credentials_via_mimikatz_modules.yml
applying_stolen_credentials_via_powersploit_modules.yml		applying_stolen_credentials_via_powersploit_modules.yml
assessment_of_credential_strength_via_dsinternals_modules.yml		assessment_of_credential_strength_via_dsinternals_modules.yml
attempt_to_delete_services.yml		attempt_to_delete_services.yml
attempt_to_disable_services.yml		attempt_to_disable_services.yml
attempted_credential_dump_from_registry_via_reg_exe.yml		attempted_credential_dump_from_registry_via_reg_exe.yml
credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml		credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml		credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
credential_extraction_indicative_of_lazagne_command_line_options.yml		credential_extraction_indicative_of_lazagne_command_line_options.yml
credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml		credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
credential_extraction_indicative_of_use_of_dsinternals_modules.yml		credential_extraction_indicative_of_use_of_dsinternals_modules.yml
credential_extraction_indicative_of_use_of_mimikatz_modules.yml		credential_extraction_indicative_of_use_of_mimikatz_modules.yml
credential_extraction_indicative_of_use_of_powersploit_modules.yml		credential_extraction_indicative_of_use_of_powersploit_modules.yml
credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml		credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml		credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml		credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
delete_a_net_user.yml		delete_a_net_user.yml
deny_permission_using_cacls_utility.yml		deny_permission_using_cacls_utility.yml
detect_dump_lsass_memory_using_comsvcs.yml		detect_dump_lsass_memory_using_comsvcs.yml
detect_kerberoasting.yml		detect_kerberoasting.yml
detect_pass_the_hash.yml		detect_pass_the_hash.yml
detect_prohibited_applications_spawning_cmd_exe.yml		detect_prohibited_applications_spawning_cmd_exe.yml
disable_net_user_account.yml		disable_net_user_account.yml
first_time_seen_command_line_argument.yml		first_time_seen_command_line_argument.yml
grant_permission_using_cacls_utility.yml		grant_permission_using_cacls_utility.yml
illegal_access_to_user_content_via_powersploit_modules.yml		illegal_access_to_user_content_via_powersploit_modules.yml
illegal_account_creation_via_powersploit_modules.yml		illegal_account_creation_via_powersploit_modules.yml
illegal_deletion_of_logs_via_mimikatz_modules.yml		illegal_deletion_of_logs_via_mimikatz_modules.yml
illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml		illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml		illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml		illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml		illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
illegal_privilege_elevation_via_mimikatz_modules.yml		illegal_privilege_elevation_via_mimikatz_modules.yml
illegal_service_and_process_control_via_mimikatz_modules.yml		illegal_service_and_process_control_via_mimikatz_modules.yml
illegal_service_and_process_control_via_powersploit_modules.yml		illegal_service_and_process_control_via_powersploit_modules.yml
modify_acls_permission_of_files_or_folders.yml		modify_acls_permission_of_files_or_folders.yml
more_than_usual_number_of_lolbas_applications_in_short_time_period.yml		more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
phishing_email_detection_by_machine_learning_method_-_ssa.yml		phishing_email_detection_by_machine_learning_method_-_ssa.yml
potential_pass_the_token_or_hash_observed_at_the_destination_device.yml		potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml		potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
probing_access_with_stolen_credentials_via_powersploit_modules.yml		probing_access_with_stolen_credentials_via_powersploit_modules.yml
rare_parent-child_process_relationship.yml		rare_parent-child_process_relationship.yml
reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml		reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml		reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml		reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml		reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
reconnaissance_and_access_to_computers_via_mimikatz_modules.yml		reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml		reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml		reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml		reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml		reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml		reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
reconnaissance_of_connectivity_via_powersploit_modules.yml		reconnaissance_of_connectivity_via_powersploit_modules.yml
reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml		reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
reconnaissance_of_defensive_tools_via_powersploit_modules.yml		reconnaissance_of_defensive_tools_via_powersploit_modules.yml
reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml		reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml		reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
resize_shadowstorage_volume.yml		resize_shadowstorage_volume.yml
setting_credentials_via_dsinternals_modules.yml		setting_credentials_via_dsinternals_modules.yml
setting_credentials_via_mimikatz_modules.yml		setting_credentials_via_mimikatz_modules.yml
setting_credentials_via_powersploit_modules.yml		setting_credentials_via_powersploit_modules.yml
system_process_running_from_unexpected_location.yml		system_process_running_from_unexpected_location.yml
unusually_long_command_line.yml		unusually_long_command_line.yml
wevtutil_usage_to_clear_logs.yml		wevtutil_usage_to_clear_logs.yml
wevtutil_usage_to_disable_logs.yml		wevtutil_usage_to_disable_logs.yml
View all files