FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
access_lsass_memory_for_dump_creation.test.yml		access_lsass_memory_for_dump_creation.test.yml
assertions.py		assertions.py
attempt_to_add_certificate_to_untrusted_store.test.yml		attempt_to_add_certificate_to_untrusted_store.test.yml
attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml		attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.test.yml
attempt_to_stop_security_service.test.yml		attempt_to_stop_security_service.test.yml
attempted_credential_dump_from_registry_via_reg_exe.test.yml		attempted_credential_dump_from_registry_via_reg_exe.test.yml
batch_file_write_to_system32.test.yml		batch_file_write_to_system32.test.yml
bcdedit_failure_recovery_modification.test.yml		bcdedit_failure_recovery_modification.test.yml
common_ransomware_extensions.test.yml		common_ransomware_extensions.test.yml
common_ransomware_notes.test.yml		common_ransomware_notes.test.yml
create_local_admin_accounts_using_net_exe.test.yml		create_local_admin_accounts_using_net_exe.test.yml
create_or_delete_windows_shares_using_net_exe.test.yml		create_or_delete_windows_shares_using_net_exe.test.yml
create_remote_thread_into_lsass.test.yml		create_remote_thread_into_lsass.test.yml
creation_of_shadow_copy.test.yml		creation_of_shadow_copy.test.yml
creation_of_shadow_copy_with_wmic_and_powershell.test.yml		creation_of_shadow_copy_with_wmic_and_powershell.test.yml
credential_dumping_via_copy_command_from_shadow_copy.test.yml		credential_dumping_via_copy_command_from_shadow_copy.test.yml
credential_dumping_via_symlink_to_shadow_copy.test.yml		credential_dumping_via_symlink_to_shadow_copy.test.yml
deleting_shadow_copies.test.yml		deleting_shadow_copies.test.yml
detect_activity_related_to_pass_the_hash_attacks.test.yml		detect_activity_related_to_pass_the_hash_attacks.test.yml
detect_credential_dumping_through_lsass_access.test.yml		detect_credential_dumping_through_lsass_access.test.yml
detect_excessive_account_lockouts_from_endpoint.test.yml		detect_excessive_account_lockouts_from_endpoint.test.yml
detect_excessive_user_account_lockouts.test.yml		detect_excessive_user_account_lockouts.test.yml
detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml		detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
detect_new_local_admin_account.test.yml		detect_new_local_admin_account.test.yml
detect_path_interception_by_creation_of_program_exe.test.yml		detect_path_interception_by_creation_of_program_exe.test.yml
detect_processes_used_for_system_network_configuration_discovery.test.yml		detect_processes_used_for_system_network_configuration_discovery.test.yml
detect_psexec_with_accepteula_flag.test.yml		detect_psexec_with_accepteula_flag.test.yml
detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml		detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml
disabling_remote_user_account_control.test.yml		disabling_remote_user_account_control.test.yml
dump_lsass_via_comsvcs_dll.test.yml		dump_lsass_via_comsvcs_dll.test.yml
execution_of_file_with_multiple_extensions.test.yml		execution_of_file_with_multiple_extensions.test.yml
file_with_samsam_extension.test.yml		file_with_samsam_extension.test.yml
first_time_seen_running_windows_service.test.yml		first_time_seen_running_windows_service.test.yml
hiding_files_and_directories_with_attrib_exe.test.yml		hiding_files_and_directories_with_attrib_exe.test.yml
kerberoasting_spn_request_with_rc4_encryption.test.yml		kerberoasting_spn_request_with_rc4_encryption.test.yml
malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml		malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml
malicious_powershell_process___encoded_command.test.yml		malicious_powershell_process___encoded_command.test.yml
malicious_powershell_process___execution_policy_bypass.test.yml		malicious_powershell_process___execution_policy_bypass.test.yml
malicious_powershell_process_with_obfuscation_techniques.test.yml		malicious_powershell_process_with_obfuscation_techniques.test.yml
monitor_registry_keys_for_print_monitors.test.yml		monitor_registry_keys_for_print_monitors.test.yml
overwriting_accessibility_binaries.test.yml		overwriting_accessibility_binaries.test.yml
process_execution_via_wmi.test.yml		process_execution_via_wmi.test.yml
processes_launching_netsh.test.yml		processes_launching_netsh.test.yml
reg_exe_manipulating_windows_services_registry_keys.test.yml		reg_exe_manipulating_windows_services_registry_keys.test.yml
registry_keys_for_creating_shim_databases.test.yml		registry_keys_for_creating_shim_databases.test.yml
registry_keys_used_for_persistence.yml.test.yml		registry_keys_used_for_persistence.yml.test.yml
registry_keys_used_for_privilege_escalation.test.yml		registry_keys_used_for_privilege_escalation.test.yml
remote_process_instantiation_via_wmi.test.yml		remote_process_instantiation_via_wmi.test.yml
rundll_loading_dll_by_ordinal.test.yml		rundll_loading_dll_by_ordinal.test.yml
ryuk_test_files_detected.test.yml		ryuk_test_files_detected.test.yml
samsam_test_file_write.test.yml		samsam_test_file_write.test.yml
sc_exe_manipulating_windows_services.test.yml		sc_exe_manipulating_windows_services.test.yml
scheduled_task_deleted_or_created_via_cmd.test.yml		scheduled_task_deleted_or_created_via_cmd.test.yml
schtasks_scheduling_job_on_remote_system.test.yml		schtasks_scheduling_job_on_remote_system.test.yml
schtasks_used_for_forcing_a_reboot.yml.test.yml		schtasks_used_for_forcing_a_reboot.yml.test.yml
script_execution_via_wmi.test.yml		script_execution_via_wmi.test.yml
shim_database_file_creation.test.yml		shim_database_file_creation.test.yml
shim_database_installation_with_suspicious_parameters.test.yml		shim_database_installation_with_suspicious_parameters.test.yml
short_lived_windows_accounts.test.yml		short_lived_windows_accounts.test.yml
single_letter_process_on_endpoint.test.yml		single_letter_process_on_endpoint.test.yml
ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml		ssa___applying_stolen_credentials_via_mimikatz_modules.test.yml
ssa___applying_stolen_credentials_via_powersploit_modules.test.yml		ssa___applying_stolen_credentials_via_powersploit_modules.test.yml
ssa___assess_credential_strength_via_dsinternals_modules.test.yml		ssa___assess_credential_strength_via_dsinternals_modules.test.yml
ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml		ssa___attempted_credential_dump_from_registry_via_reg_exe.test.yml
ssa___credential_extraction_dsinternals_conversion_modules.test.yml		ssa___credential_extraction_dsinternals_conversion_modules.test.yml
ssa___credential_extraction_dsinternals_modules.test.yml		ssa___credential_extraction_dsinternals_modules.test.yml
ssa___credential_extraction_fgdump_cachedump_s_option.test.yml		ssa___credential_extraction_fgdump_cachedump_s_option.test.yml
ssa___credential_extraction_fgdump_cachedump_v_option.test.yml		ssa___credential_extraction_fgdump_cachedump_v_option.test.yml
ssa___credential_extraction_getaddbaccount_from_dump.test.yml		ssa___credential_extraction_getaddbaccount_from_dump.test.yml
ssa___credential_extraction_lazagne_command_options.test.yml		ssa___credential_extraction_lazagne_command_options.test.yml
ssa___credential_extraction_mimikatz_modules.test.yml		ssa___credential_extraction_mimikatz_modules.test.yml
ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml		ssa___credential_extraction_ms_debuggers_kernel_peek.test.yml
ssa___credential_extraction_ms_debuggers_z_option.test.yml		ssa___credential_extraction_ms_debuggers_z_option.test.yml
ssa___credential_extraction_powersploit_modules.test.yml		ssa___credential_extraction_powersploit_modules.test.yml
ssa___detect_dump_lsass_memory_using_comsvcs.test.yml		ssa___detect_dump_lsass_memory_using_comsvcs.test.yml
ssa___detect_kerberoasting.test.yml		ssa___detect_kerberoasting.test.yml
ssa___detect_pass_hash.test.yml		ssa___detect_pass_hash.test.yml
ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml		ssa___detect_prohibited_applications_spawning_cmd_exe.test.yml
ssa___first_time_seen_cmd_line.test.yml		ssa___first_time_seen_cmd_line.test.yml
ssa___illegal_access_user_content_via_powersploit_modules.test.yml		ssa___illegal_access_user_content_via_powersploit_modules.test.yml
ssa___illegal_account_creation_via_powersploit_modules.test.yml		ssa___illegal_account_creation_via_powersploit_modules.test.yml
ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml		ssa___illegal_account_enable_disable_via_dsinternals_modules.test.yml
ssa___illegal_log_deletion_via_mimikatz_modules.test.yml		ssa___illegal_log_deletion_via_mimikatz_modules.test.yml
ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml		ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.test.yml
ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml		ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.test.yml
ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml		ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.test.yml
ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml		ssa___illegal_privilege_elevation_via_mimikatz_modules.test.yml
ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml		ssa___illegal_service_and_process_control_via_mimikatz_modules.test.yml
ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml		ssa___illegal_service_and_process_control_via_powersploit_modules.test.yml
ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml		ssa___probing_access_with_stolen_credentials_via_powersploit_modules.test.yml
ssa___prohibited_apps_spawning_cmdprompt.test.yml		ssa___prohibited_apps_spawning_cmdprompt.test.yml
ssa___rare_parent_process_relationship_lolbas.test.yaml		ssa___rare_parent_process_relationship_lolbas.test.yaml
ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml		ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.test.yml
ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml		ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.test.yml
ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml		ssa___recon_and_use_accounts_groups_via_mimikatz_modules.test.yml
ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml		ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.test.yml
ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml		ssa___recon_and_use_computers_domains_via_powersploit_modules.test.yml
ssa___recon_and_use_computers_via_mimikatz_modules.test.yml		ssa___recon_and_use_computers_via_mimikatz_modules.test.yml
ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml		ssa___recon_and_use_operating_system_elements_via_powersploit_modules.test.yml
ssa___recon_and_use_shares_via_mimikatz_modules.test.yml		ssa___recon_and_use_shares_via_mimikatz_modules.test.yml
View all files