Skip to content

Updating lookup 5.1.1 #3378

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
patel-bhavin merged 1 commit into from
Mar 4, 2025
Merged

Updating lookup 5.1.1 #3378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion contentctl.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ app:
uid: 3449
title: ES Content Updates
appid: DA-ESS-ContentUpdate
version: 5.1.0
version: 5.1.1
description: Explore the Analytic Stories included with ES Content Updates.
prefix: ESCU
label: ESCU
Expand Down
2 changes: 1 addition & 1 deletion lookups/malicious_powershell_strings.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ command,toolkit,match,description
*Invoke-TokenManipulation*,PowerSploit,Invoke-TokenManipulation,"Lists available logon tokens. Creates processes with other users logon tokens, and impersonates logon tokens in the current thread."
*Invoke-CredentialInjection*,PowerSploit,Invoke-CredentialInjection,Create logons with clear-text credentials without triggering a suspicious Event ID 4648 (Explicit Credential Logon).
*Invoke-NinjaCopy*,PowerSploit,Invoke-NinjaCopy,Copies a file from an NTFS partitioned volume by reading the raw volume and parsing the NTFS structures.
*Invoke-Mimikatz*,PowerSploit,Invoke-Mimikatz,Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to dump credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.
*Invoke-Mimikatz*,PowerSploit,Invoke-Mimikatz,Reflectively loads Mimikatz 2.0 in memory using PowerShell. Can be used to extract sensitive credentials without writing anything to disk. Can be used for any functionality provided with Mimikatz.
*Get-Keystrokes*,PowerSploit,Get-Keystrokes,"Logs keys pressed, time and the active window."
*Get-GPPPassword*,PowerSploit,Get-GPPPassword,Retrieves the plaintext password and other information for accounts pushed through Group Policy Preferences.
*Get-GPPAutologon*,PowerSploit,Get-GPPAutologon,Retrieves autologon username and password from registry.xml if pushed through Group Policy Preferences.
Expand Down
4 changes: 2 additions & 2 deletions lookups/malicious_powershell_strings.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: malicious_powershell_strings
date: 2025-01-20
version: 1
date: 2025-03-03
version: 2
id: d2fcf9eb-c7a4-4b05-9db4-99c6430d0513
author: Steven Dick
lookup_type: csv
Expand Down