FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
7zip_commandline_to_smb_share_path.test.yml		7zip_commandline_to_smb_share_path.test.yml
access_lsass_memory_for_dump_creation.test.yml		access_lsass_memory_for_dump_creation.test.yml
account_discovery_with_net_app.test.yml		account_discovery_with_net_app.test.yml
active_setup_registry_autostart.test.yml		active_setup_registry_autostart.test.yml
add_defaultuser_and_password_in_registry.test.yml		add_defaultuser_and_password_in_registry.test.yml
add_or_set_windows_defender_exclusion.test.yml		add_or_set_windows_defender_exclusion.test.yml
adsisearcher_account_discovery.test.yml		adsisearcher_account_discovery.test.yml
allow_file_and_printing_sharing_in_firewall.test.yml		allow_file_and_printing_sharing_in_firewall.test.yml
allow_inbound_traffic_by_firewall_rule_registry.test.yml		allow_inbound_traffic_by_firewall_rule_registry.test.yml
allow_inbound_traffic_in_firewall_rule.test.yml		allow_inbound_traffic_in_firewall_rule.test.yml
allow_network_discovery_in_firewall.test.yml		allow_network_discovery_in_firewall.test.yml
allow_operation_with_consent_admin.test.yml		allow_operation_with_consent_admin.test.yml
anomalous_usage_of_7zip.test.yml		anomalous_usage_of_7zip.test.yml
any_powershell_downloadfile.test.yml		any_powershell_downloadfile.test.yml
any_powershell_downloadstring.test.yml		any_powershell_downloadstring.test.yml
attacker_tools_on_endpoint.test.yml		attacker_tools_on_endpoint.test.yml
attempt_to_add_certificate_to_untrusted_store.test.yml		attempt_to_add_certificate_to_untrusted_store.test.yml
attempt_to_stop_security_service.test.yml		attempt_to_stop_security_service.test.yml
attempted_credential_dump_from_registry_via_reg_exe.test.yml		attempted_credential_dump_from_registry_via_reg_exe.test.yml
auto_admin_logon_registry_entry.test.yml		auto_admin_logon_registry_entry.test.yml
batch_file_write_to_system32.test.yml		batch_file_write_to_system32.test.yml
bcdedit_command_back_to_normal_mode_boot.test.yml		bcdedit_command_back_to_normal_mode_boot.test.yml
bcdedit_failure_recovery_modification.test.yml		bcdedit_failure_recovery_modification.test.yml
bits_job_persistence.test.yml		bits_job_persistence.test.yml
bitsadmin_download_file.test.yml		bitsadmin_download_file.test.yml
certutil_download_with_urlcache_and_split_arguments.test.yml		certutil_download_with_urlcache_and_split_arguments.test.yml
certutil_download_with_verifyctl_and_split_arguments.test.yml		certutil_download_with_verifyctl_and_split_arguments.test.yml
certutil_exe_certificate_extraction.test.yml		certutil_exe_certificate_extraction.test.yml
certutil_with_decode_argument.test.yml		certutil_with_decode_argument.test.yml
change_default_file_association.test.yml		change_default_file_association.test.yml
change_to_safe_mode_with_network_config.test.yml		change_to_safe_mode_with_network_config.test.yml
chcp_command_execution.test.yml		chcp_command_execution.test.yml
check_elevated_cmd_using_whoami.test.yml		check_elevated_cmd_using_whoami.test.yml
clear_unallocated_sector_using_cipher_app.test.yml		clear_unallocated_sector_using_cipher_app.test.yml
clop_common_exec_parameter.test.yml		clop_common_exec_parameter.test.yml
clop_ransomware_known_service_name.test.yml		clop_ransomware_known_service_name.test.yml
cmd_carry_out_string_command_parameter.test.yml		cmd_carry_out_string_command_parameter.test.yml
cmd_echo_pipe___escalation.test.yml		cmd_echo_pipe___escalation.test.yml
cmdline_tool_not_executed_in_cmd_shell.test.yml		cmdline_tool_not_executed_in_cmd_shell.test.yml
cmlua_or_cmstplua_uac_bypass.test.yml		cmlua_or_cmstplua_uac_bypass.test.yml
cobalt_strike_named_pipes.test.yml		cobalt_strike_named_pipes.test.yml
common_ransomware_extensions.test.yml		common_ransomware_extensions.test.yml
common_ransomware_notes.test.yml		common_ransomware_notes.test.yml
conti_common_exec_parameter.test.yml		conti_common_exec_parameter.test.yml
control_loading_from_world_writable_directory.test.yml		control_loading_from_world_writable_directory.test.yml
create_local_admin_accounts_using_net_exe.test.yml		create_local_admin_accounts_using_net_exe.test.yml
create_or_delete_windows_shares_using_net_exe.test.yml		create_or_delete_windows_shares_using_net_exe.test.yml
create_remote_thread_in_shell_application.test.yml		create_remote_thread_in_shell_application.test.yml
create_remote_thread_into_lsass.test.yml		create_remote_thread_into_lsass.test.yml
creation_of_lsass_dump_with_taskmgr.test.yml		creation_of_lsass_dump_with_taskmgr.test.yml
creation_of_shadow_copy.test.yml		creation_of_shadow_copy.test.yml
creation_of_shadow_copy_with_wmic_and_powershell.test.yml		creation_of_shadow_copy_with_wmic_and_powershell.test.yml
credential_dumping_via_copy_command_from_shadow_copy.test.yml		credential_dumping_via_copy_command_from_shadow_copy.test.yml
credential_dumping_via_symlink_to_shadow_copy.test.yml		credential_dumping_via_symlink_to_shadow_copy.test.yml
csc_net_on_the_fly_compilation.test.yml		csc_net_on_the_fly_compilation.test.yml
curl_download_and_bash_execution.test.yml		curl_download_and_bash_execution.test.yml
delete_shadowcopy_with_powershell.test.yml		delete_shadowcopy_with_powershell.test.yml
deleting_of_net_users.test.yml		deleting_of_net_users.test.yml
deleting_shadow_copies.test.yml		deleting_shadow_copies.test.yml
detect_activity_related_to_pass_the_hash_attacks.test.yml		detect_activity_related_to_pass_the_hash_attacks.test.yml
detect_azurehound_command_line_arguments.test.yml		detect_azurehound_command_line_arguments.test.yml
detect_azurehound_file_modifications.test.yml		detect_azurehound_file_modifications.test.yml
detect_copy_of_shadowcopy_with_script_block_logging.test.yml		detect_copy_of_shadowcopy_with_script_block_logging.test.yml
detect_credential_dumping_through_lsass_access.test.yml		detect_credential_dumping_through_lsass_access.test.yml
detect_empire_with_powershell_script_block_logging.test.yml		detect_empire_with_powershell_script_block_logging.test.yml
detect_excessive_account_lockouts_from_endpoint.test.yml		detect_excessive_account_lockouts_from_endpoint.test.yml
detect_excessive_user_account_lockouts.test.yml		detect_excessive_user_account_lockouts.test.yml
detect_exchange_web_shell.test.yml		detect_exchange_web_shell.test.yml
detect_html_help_renamed.test.yml		detect_html_help_renamed.test.yml
detect_html_help_spawn_child_process.test.yml		detect_html_help_spawn_child_process.test.yml
detect_html_help_url_in_command_line.test.yml		detect_html_help_url_in_command_line.test.yml
detect_html_help_using_infotech_storage_handlers.test.yml		detect_html_help_using_infotech_storage_handlers.test.yml
detect_mimikatz_using_loaded_images.test.yml		detect_mimikatz_using_loaded_images.test.yml
detect_mimikatz_with_powershell_script_block_logging.test.yml		detect_mimikatz_with_powershell_script_block_logging.test.yml
detect_mshta_inline_hta_execution.test.yml		detect_mshta_inline_hta_execution.test.yml
detect_mshta_renamed.test.yml		detect_mshta_renamed.test.yml
detect_mshta_url_in_command_line.test.yml		detect_mshta_url_in_command_line.test.yml
detect_new_local_admin_account.test.yml		detect_new_local_admin_account.test.yml
detect_path_interception_by_creation_of_program_exe.test.yml		detect_path_interception_by_creation_of_program_exe.test.yml
detect_processes_used_for_system_network_configuration_discovery.test.yml		detect_processes_used_for_system_network_configuration_discovery.test.yml
detect_prohibited_applications_spawning_cmd_exe.test.yml		detect_prohibited_applications_spawning_cmd_exe.test.yml
detect_psexec_with_accepteula_flag.test.yml		detect_psexec_with_accepteula_flag.test.yml
detect_rclone_command_line_usage.test.yml		detect_rclone_command_line_usage.test.yml
detect_regasm_spawning_a_process.test.yml		detect_regasm_spawning_a_process.test.yml
detect_regasm_with_network_connection.test.yml		detect_regasm_with_network_connection.test.yml
detect_regasm_with_no_command_line_arguments.test.yml		detect_regasm_with_no_command_line_arguments.test.yml
detect_regsvcs_spawning_a_process.test.yml		detect_regsvcs_spawning_a_process.test.yml
detect_regsvcs_with_network_connection.test.yml		detect_regsvcs_with_network_connection.test.yml
detect_regsvcs_with_no_command_line_arguments.test.yml		detect_regsvcs_with_no_command_line_arguments.test.yml
detect_regsvr32_application_control_bypass.test.yml		detect_regsvr32_application_control_bypass.test.yml
detect_renamed_7_zip.test.yml		detect_renamed_7_zip.test.yml
detect_renamed_psexec.test.yml		detect_renamed_psexec.test.yml
detect_renamed_rclone.test.yml		detect_renamed_rclone.test.yml
detect_renamed_winrar.test.yml		detect_renamed_winrar.test.yml
detect_rundll32_application_control_bypass___advpack.test.yml		detect_rundll32_application_control_bypass___advpack.test.yml
detect_rundll32_application_control_bypass___setupapi.test.yml		detect_rundll32_application_control_bypass___setupapi.test.yml
detect_rundll32_application_control_bypass___syssetup.test.yml		detect_rundll32_application_control_bypass___syssetup.test.yml
detect_rundll32_inline_hta_execution.test.yml		detect_rundll32_inline_hta_execution.test.yml
detect_sharphound_command_line_arguments.test.yml		detect_sharphound_command_line_arguments.test.yml
detect_sharphound_file_modifications.test.yml		detect_sharphound_file_modifications.test.yml
View all files