FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
access_lsass_memory_for_dump_creation.test.yml		access_lsass_memory_for_dump_creation.test.yml
any_powershell_downloadfile.test.yml		any_powershell_downloadfile.test.yml
any_powershell_downloadstring.test.yml		any_powershell_downloadstring.test.yml
assertions.py		assertions.py
attempt_to_add_certificate_to_untrusted_store.test.yml		attempt_to_add_certificate_to_untrusted_store.test.yml
attempt_to_stop_security_service.test.yml		attempt_to_stop_security_service.test.yml
attempted_credential_dump_from_registry_via_reg_exe.test.yml		attempted_credential_dump_from_registry_via_reg_exe.test.yml
batch_file_write_to_system32.test.yml		batch_file_write_to_system32.test.yml
bcdedit_failure_recovery_modification.test.yml		bcdedit_failure_recovery_modification.test.yml
bits_job_persistence.test.yml		bits_job_persistence.test.yml
bitsadmin_download_file.test.yml		bitsadmin_download_file.test.yml
certutil_download_with_urlcache_and_split_arguments.test.yml		certutil_download_with_urlcache_and_split_arguments.test.yml
certutil_download_with_verifyctl_and_split_arguments.test.yml		certutil_download_with_verifyctl_and_split_arguments.test.yml
certutil_exe_certificate_extraction.test.yml		certutil_exe_certificate_extraction.test.yml
certutil_with_decode_argument.test.yml		certutil_with_decode_argument.test.yml
clop_common_exec_parameter.test.yml		clop_common_exec_parameter.test.yml
clop_ransomware_known_service_name.test.yml		clop_ransomware_known_service_name.test.yml
cobalt_strike_named_pipes.test.yml		cobalt_strike_named_pipes.test.yml
common_ransomware_extensions.test.yml		common_ransomware_extensions.test.yml
common_ransomware_notes.test.yml		common_ransomware_notes.test.yml
create_local_admin_accounts_using_net_exe.test.yml		create_local_admin_accounts_using_net_exe.test.yml
create_or_delete_windows_shares_using_net_exe.test.yml		create_or_delete_windows_shares_using_net_exe.test.yml
create_remote_thread_into_lsass.test.yml		create_remote_thread_into_lsass.test.yml
create_service_in_suspicious_file_path.test.yml		create_service_in_suspicious_file_path.test.yml
creation_of_lsass_dump_with_taskmgr.test.yml		creation_of_lsass_dump_with_taskmgr.test.yml
creation_of_shadow_copy.test.yml		creation_of_shadow_copy.test.yml
creation_of_shadow_copy_with_wmic_and_powershell.test.yml		creation_of_shadow_copy_with_wmic_and_powershell.test.yml
credential_dumping_via_copy_command_from_shadow_copy.test.yml		credential_dumping_via_copy_command_from_shadow_copy.test.yml
credential_dumping_via_symlink_to_shadow_copy.test.yml		credential_dumping_via_symlink_to_shadow_copy.test.yml
deleting_shadow_copies.test.yml		deleting_shadow_copies.test.yml
detect_activity_related_to_pass_the_hash_attacks.test.yml		detect_activity_related_to_pass_the_hash_attacks.test.yml
detect_credential_dumping_through_lsass_access.test.yml		detect_credential_dumping_through_lsass_access.test.yml
detect_excessive_account_lockouts_from_endpoint.test.yml		detect_excessive_account_lockouts_from_endpoint.test.yml
detect_excessive_user_account_lockouts.test.yml		detect_excessive_user_account_lockouts.test.yml
detect_exchange_web_shell.test.yml		detect_exchange_web_shell.test.yml
detect_html_help_renamed.test.yml		detect_html_help_renamed.test.yml
detect_html_help_spawn_child_process.test.yml		detect_html_help_spawn_child_process.test.yml
detect_html_help_url_in_command_line.test.yml		detect_html_help_url_in_command_line.test.yml
detect_html_help_using_infotech_storage_handlers.test.yml		detect_html_help_using_infotech_storage_handlers.test.yml
detect_mimikatz_using_loaded_images.test.yml		detect_mimikatz_using_loaded_images.test.yml
detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml		detect_mshta_exe_running_scripts_in_command_line_arguments.test.yml
detect_mshta_renamed.test.yml		detect_mshta_renamed.test.yml
detect_mshta_url_in_command_line.test.yml		detect_mshta_url_in_command_line.test.yml
detect_new_local_admin_account.test.yml		detect_new_local_admin_account.test.yml
detect_path_interception_by_creation_of_program_exe.test.yml		detect_path_interception_by_creation_of_program_exe.test.yml
detect_processes_used_for_system_network_configuration_discovery.test.yml		detect_processes_used_for_system_network_configuration_discovery.test.yml
detect_psexec_with_accepteula_flag.test.yml		detect_psexec_with_accepteula_flag.test.yml
detect_regasm_spawning_a_process.test.yml		detect_regasm_spawning_a_process.test.yml
detect_regasm_with_network_connection.test.yml		detect_regasm_with_network_connection.test.yml
detect_regasm_with_no_command_line_arguments.test.yml		detect_regasm_with_no_command_line_arguments.test.yml
detect_regsvcs_spawning_a_process.test.yml		detect_regsvcs_spawning_a_process.test.yml
detect_regsvcs_with_network_connection.test.yml		detect_regsvcs_with_network_connection.test.yml
detect_regsvcs_with_no_command_line_arguments.test.yml		detect_regsvcs_with_no_command_line_arguments.test.yml
detect_regsvr32_application_control_bypass.test.yml		detect_regsvr32_application_control_bypass.test.yml
detect_rundll32_application_control_bypass___advpack.test.yml		detect_rundll32_application_control_bypass___advpack.test.yml
detect_rundll32_application_control_bypass___setupapi.test.yml		detect_rundll32_application_control_bypass___setupapi.test.yml
detect_rundll32_application_control_bypass___syssetup.test.yml		detect_rundll32_application_control_bypass___syssetup.test.yml
detect_rundll32_inline_hta_execution.test.yml		detect_rundll32_inline_hta_execution.test.yml
detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml		detect_use_of_cmd_exe_to_launch_script_interpreters.test.yml
disable_registry_tool.test.yml		disable_registry_tool.test.yml
disable_show_hidden_files.test.yml		disable_show_hidden_files.test.yml
disable_windows_behavior_monitoring.test.yml		disable_windows_behavior_monitoring.test.yml
disable_windows_smartscreen_protection.test.yml		disable_windows_smartscreen_protection.test.yml
disabling_cmd_application.test.yml		disabling_cmd_application.test.yml
disabling_controlpanel.test.yml		disabling_controlpanel.test.yml
disabling_firewall_with_netsh.test.yml		disabling_firewall_with_netsh.test.yml
disabling_folderoptions_windows_feature.test.yml		disabling_folderoptions_windows_feature.test.yml
disabling_norun_windows_app.test.yml		disabling_norun_windows_app.test.yml
disabling_remote_user_account_control.test.yml		disabling_remote_user_account_control.test.yml
disabling_systemrestore_in_registry.test.yml		disabling_systemrestore_in_registry.test.yml
disabling_task_manager.test.yml		disabling_task_manager.test.yml
dsquery_domain_discovery.test.yml		dsquery_domain_discovery.test.yml
dump_lsass_via_comsvcs_dll.test.yml		dump_lsass_via_comsvcs_dll.test.yml
dump_lsass_via_procdump.test.yml		dump_lsass_via_procdump.test.yml
dump_lsass_via_procdump_rename.test.yml		dump_lsass_via_procdump_rename.test.yml
eventvwr_uac_bypass.test.yml		eventvwr_uac_bypass.test.yml
execution_of_file_with_multiple_extensions.test.yml		execution_of_file_with_multiple_extensions.test.yml
file_with_samsam_extension.test.yml		file_with_samsam_extension.test.yml
fodhelper_uac_bypass.test.yml		fodhelper_uac_bypass.test.yml
hiding_files_and_directories_with_attrib_exe.test.yml		hiding_files_and_directories_with_attrib_exe.test.yml
high_file_deletion_frequency.test.yml		high_file_deletion_frequency.test.yml
high_process_termination_frequency.test.yml		high_process_termination_frequency.test.yml
kerberoasting_spn_request_with_rc4_encryption.test.yml		kerberoasting_spn_request_with_rc4_encryption.test.yml
malicious_powershell_executed_as_a_service.test.yml		malicious_powershell_executed_as_a_service.test.yml
malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml		malicious_powershell_process___connect_to_internet_with_hidden_window.test.yml
malicious_powershell_process___encoded_command.test.yml		malicious_powershell_process___encoded_command.test.yml
malicious_powershell_process___execution_policy_bypass.test.yml		malicious_powershell_process___execution_policy_bypass.test.yml
malicious_powershell_process_with_obfuscation_techniques.test.yml		malicious_powershell_process_with_obfuscation_techniques.test.yml
monitor_registry_keys_for_print_monitors.test.yml		monitor_registry_keys_for_print_monitors.test.yml
nishang_powershelltcponeline.test.yml		nishang_powershelltcponeline.test.yml
nltest_domain_trust_discovery.test.yml		nltest_domain_trust_discovery.test.yml
ntdsutil_export_ntds.test.yml		ntdsutil_export_ntds.test.yml
office_application_spawn_rundll32_process.test.yml		office_application_spawn_rundll32_process.test.yml
office_document_creating_schedule_task.test.yml		office_document_creating_schedule_task.test.yml
office_document_executing_macro_code.test.yml		office_document_executing_macro_code.test.yml
office_document_spawned_child_process_to_download.test.yml		office_document_spawned_child_process_to_download.test.yml
overwriting_accessibility_binaries.test.yml		overwriting_accessibility_binaries.test.yml
powershell_start_bitstransfer.test.yml		powershell_start_bitstransfer.test.yml
process_creating_lnk_file_in_suspicious_location.test.yml		process_creating_lnk_file_in_suspicious_location.test.yml
process_deleting_its_process_file_path.test.yml		process_deleting_its_process_file_path.test.yml
View all files