FilesExpand file tree

develop

/

endpoint

/

Copy path

Directory actions

More options

More options

Directory actions

More options

More options

Latest commit

 

History

History

History

 

 

develop

/

endpoint

/

Copy path

Top

Folders and files

Name		Name	Last commit message	Last commit date
parent directory ..
7zip_commandline_to_smb_share_path.yml		7zip_commandline_to_smb_share_path.yml
access_lsass_memory_for_dump_creation.yml		access_lsass_memory_for_dump_creation.yml
account_discovery_with_net_app.yml		account_discovery_with_net_app.yml
all_backup_logs_for_host.yml		all_backup_logs_for_host.yml
allow_file_and_printing_sharing_in_firewall.yml		allow_file_and_printing_sharing_in_firewall.yml
allow_inbound_traffic_by_firewall_rule_registry.yml		allow_inbound_traffic_by_firewall_rule_registry.yml
allow_inbound_traffic_in_firewall_rule.yml		allow_inbound_traffic_in_firewall_rule.yml
allow_network_discovery_in_firewall.yml		allow_network_discovery_in_firewall.yml
allow_operation_with_consent_admin.yml		allow_operation_with_consent_admin.yml
anomalous_usage_of_7zip.yml		anomalous_usage_of_7zip.yml
any_powershell_downloadfile.yml		any_powershell_downloadfile.yml
any_powershell_downloadstring.yml		any_powershell_downloadstring.yml
attacker_tools_on_endpoint.yml		attacker_tools_on_endpoint.yml
attempt_to_add_certificate_to_untrusted_store.yml		attempt_to_add_certificate_to_untrusted_store.yml
attempt_to_stop_security_service.yml		attempt_to_stop_security_service.yml
attempted_credential_dump_from_registry_via_reg_exe.yml		attempted_credential_dump_from_registry_via_reg_exe.yml
baseline_of_command_line_length___mltk.yml		baseline_of_command_line_length___mltk.yml
batch_file_write_to_system32.yml		batch_file_write_to_system32.yml
bcdedit_failure_recovery_modification.yml		bcdedit_failure_recovery_modification.yml
bits_job_persistence.yml		bits_job_persistence.yml
bitsadmin_download_file.yml		bitsadmin_download_file.yml
certutil_download_with_urlcache_and_split_arguments.yml		certutil_download_with_urlcache_and_split_arguments.yml
certutil_download_with_verifyctl_and_split_arguments.yml		certutil_download_with_verifyctl_and_split_arguments.yml
certutil_exe_certificate_extraction.yml		certutil_exe_certificate_extraction.yml
certutil_with_decode_argument.yml		certutil_with_decode_argument.yml
chcp_command_execution.yml		chcp_command_execution.yml
clear_unallocated_sector_using_cipher_app.yml		clear_unallocated_sector_using_cipher_app.yml
clop_common_exec_parameter.yml		clop_common_exec_parameter.yml
clop_ransomware_known_service_name.yml		clop_ransomware_known_service_name.yml
cmd_echo_pipe___escalation.yml		cmd_echo_pipe___escalation.yml
cmlua_or_cmstplua_uac_bypass.yml		cmlua_or_cmstplua_uac_bypass.yml
cobalt_strike_named_pipes.yml		cobalt_strike_named_pipes.yml
common_ransomware_extensions.yml		common_ransomware_extensions.yml
common_ransomware_notes.yml		common_ransomware_notes.yml
conti_common_exec_parameter.yml		conti_common_exec_parameter.yml
count_of_assets_by_category.yml		count_of_assets_by_category.yml
create_local_admin_accounts_using_net_exe.yml		create_local_admin_accounts_using_net_exe.yml
create_or_delete_windows_shares_using_net_exe.yml		create_or_delete_windows_shares_using_net_exe.yml
create_remote_thread_in_shell_application.yml		create_remote_thread_in_shell_application.yml
create_remote_thread_into_lsass.yml		create_remote_thread_into_lsass.yml
create_service_in_suspicious_file_path.yml		create_service_in_suspicious_file_path.yml
creation_of_lsass_dump_with_taskmgr.yml		creation_of_lsass_dump_with_taskmgr.yml
creation_of_shadow_copy.yml		creation_of_shadow_copy.yml
creation_of_shadow_copy_with_wmic_and_powershell.yml		creation_of_shadow_copy_with_wmic_and_powershell.yml
credential_dumping_via_copy_command_from_shadow_copy.yml		credential_dumping_via_copy_command_from_shadow_copy.yml
credential_dumping_via_symlink_to_shadow_copy.yml		credential_dumping_via_symlink_to_shadow_copy.yml
delete_shadowcopy_with_powershell.yml		delete_shadowcopy_with_powershell.yml
deleting_of_net_users.yml		deleting_of_net_users.yml
deleting_shadow_copies.yml		deleting_shadow_copies.yml
detect_activity_related_to_pass_the_hash_attacks.yml		detect_activity_related_to_pass_the_hash_attacks.yml
detect_azurehound_command_line_arguments.yml		detect_azurehound_command_line_arguments.yml
detect_azurehound_file_modifications.yml		detect_azurehound_file_modifications.yml
detect_computer_changed_with_anonymous_account.yml		detect_computer_changed_with_anonymous_account.yml
detect_copy_of_shadowcopy_with_script_block_logging.yml		detect_copy_of_shadowcopy_with_script_block_logging.yml
detect_credential_dumping_through_lsass_access.yml		detect_credential_dumping_through_lsass_access.yml
detect_empire_with_powershell_script_block_logging.yml		detect_empire_with_powershell_script_block_logging.yml
detect_excessive_account_lockouts_from_endpoint.yml		detect_excessive_account_lockouts_from_endpoint.yml
detect_excessive_user_account_lockouts.yml		detect_excessive_user_account_lockouts.yml
detect_exchange_web_shell.yml		detect_exchange_web_shell.yml
detect_html_help_renamed.yml		detect_html_help_renamed.yml
detect_html_help_spawn_child_process.yml		detect_html_help_spawn_child_process.yml
detect_html_help_url_in_command_line.yml		detect_html_help_url_in_command_line.yml
detect_html_help_using_infotech_storage_handlers.yml		detect_html_help_using_infotech_storage_handlers.yml
detect_mimikatz_using_loaded_images.yml		detect_mimikatz_using_loaded_images.yml
detect_mimikatz_with_powershell_script_block_logging.yml		detect_mimikatz_with_powershell_script_block_logging.yml
detect_mshta_inline_hta_execution.yml		detect_mshta_inline_hta_execution.yml
detect_mshta_renamed.yml		detect_mshta_renamed.yml
detect_mshta_url_in_command_line.yml		detect_mshta_url_in_command_line.yml
detect_new_local_admin_account.yml		detect_new_local_admin_account.yml
detect_path_interception_by_creation_of_program_exe.yml		detect_path_interception_by_creation_of_program_exe.yml
detect_processes_used_for_system_network_configuration_discovery.yml		detect_processes_used_for_system_network_configuration_discovery.yml
detect_prohibited_applications_spawning_cmd_exe.yml		detect_prohibited_applications_spawning_cmd_exe.yml
detect_psexec_with_accepteula_flag.yml		detect_psexec_with_accepteula_flag.yml
detect_rclone_command_line_usage.yml		detect_rclone_command_line_usage.yml
detect_regasm_spawning_a_process.yml		detect_regasm_spawning_a_process.yml
detect_regasm_with_network_connection.yml		detect_regasm_with_network_connection.yml
detect_regasm_with_no_command_line_arguments.yml		detect_regasm_with_no_command_line_arguments.yml
detect_regsvcs_spawning_a_process.yml		detect_regsvcs_spawning_a_process.yml
detect_regsvcs_with_network_connection.yml		detect_regsvcs_with_network_connection.yml
detect_regsvcs_with_no_command_line_arguments.yml		detect_regsvcs_with_no_command_line_arguments.yml
detect_regsvr32_application_control_bypass.yml		detect_regsvr32_application_control_bypass.yml
detect_renamed_7_zip.yml		detect_renamed_7_zip.yml
detect_renamed_psexec.yml		detect_renamed_psexec.yml
detect_renamed_rclone.yml		detect_renamed_rclone.yml
detect_renamed_winrar.yml		detect_renamed_winrar.yml
detect_rundll32_application_control_bypass___advpack.yml		detect_rundll32_application_control_bypass___advpack.yml
detect_rundll32_application_control_bypass___setupapi.yml		detect_rundll32_application_control_bypass___setupapi.yml
detect_rundll32_application_control_bypass___syssetup.yml		detect_rundll32_application_control_bypass___syssetup.yml
detect_rundll32_inline_hta_execution.yml		detect_rundll32_inline_hta_execution.yml
detect_sharphound_command_line_arguments.yml		detect_sharphound_command_line_arguments.yml
detect_sharphound_file_modifications.yml		detect_sharphound_file_modifications.yml
detect_sharphound_usage.yml		detect_sharphound_usage.yml
detect_use_of_cmd_exe_to_launch_script_interpreters.yml		detect_use_of_cmd_exe_to_launch_script_interpreters.yml
detect_wmi_event_subscription_persistence.yml		detect_wmi_event_subscription_persistence.yml
disable_amsi_through_registry.yml		disable_amsi_through_registry.yml
disable_etw_through_registry.yml		disable_etw_through_registry.yml
disable_logs_using_wevtutil.yml		disable_logs_using_wevtutil.yml
disable_registry_tool.yml		disable_registry_tool.yml
disable_show_hidden_files.yml		disable_show_hidden_files.yml
disable_windows_app_hotkeys.yml		disable_windows_app_hotkeys.yml
View all files