9f73e636b4
Added Defender for Endpoint processes
...
Added Defender for Endpoint processes based on https://medium.com/csis-techblog/silencing-microsoft-defender-for-endpoint-using-firewall-rules-3839a8bf8d18
Signed-off-by: Alexander Georgiev <alexander.georgiev@daloo.de >
2023-01-24 14:16:44 +01:00
d13e3fc61e
Fix terminate to support beacons
2022-11-04 15:27:57 -07:00
170c2bc462
Use nodes vs branches when it makes sense.
2022-11-02 15:24:37 -07:00
ac56a98671
Safely delete nodes
2022-11-02 15:18:57 -07:00
6c7814ce4f
Fix pstree
2022-11-02 14:24:10 -07:00
418b061c14
Add support for ps tree
2022-11-01 22:42:38 -07:00
95ea7d8390
Fix indentation
2022-11-01 15:47:06 -07:00
88abea26a7
Add sysmon + sysmon64
...
As Sysmon is more commonly used for logging I assume we should flag it also as known security tool.
Signed-off-by: cmprmsd <73472903+cmprmsd@users.noreply.github.com >
2022-09-08 10:46:53 +02:00
120d537044
Merge pull request #855 from faisalfs10x/faisalfs10x-patch-1
...
Add trend micro processes
2022-09-07 19:12:07 -05:00
59781d4328
Update ps.go
...
Signed-off-by: Faisal Fs <51811615+faisalfs10x@users.noreply.github.com >
2022-09-08 06:36:05 +08:00
e4793cf616
Add trend micro processes
...
Add known Trend Micro processes
reference: https://success.trendmicro.com/dcx/s/solution/1122160-monitoring-deep-security-services?language=en_US&sfdcIFrameOrigin=null
Signed-off-by: Faisal Fs <51811615+faisalfs10x@users.noreply.github.com >
2022-09-08 06:08:43 +08:00
b68f4bffd3
Add additional known security tools
...
Few more SentinelOne processes. Cylance and Tanium processes.
2022-09-07 17:00:33 -04:00
fd1b873f75
Add carbon black cloud sensor
...
This adds known Carbon Black processes
Signed-off-by: cmprmsd <73472903+cmprmsd@users.noreply.github.com >
2022-09-06 12:16:09 +02:00
44578c32ed
add recognition of SentinelOne security product to the ps cmd
2022-08-01 13:04:07 +02:00
ac262a3620
fix #714 , Add process Architecture to the ps command
2022-07-19 00:08:49 +07:00
a7c0a2a667
Harmonizing UX for loot across commands that support it with refactoring along the way
2022-05-04 14:48:53 -04:00
34738d2337
check rpc err on terminate cmd
2022-02-12 18:25:56 -06:00
fb72322065
Added stylized sec product names
2022-01-20 14:02:55 -06:00
a1e51d64d4
fix variable name
2022-01-20 08:52:03 -06:00
97d3da75b6
Merge master
2022-01-20 08:22:39 -06:00
f21242ca2c
Added Crowdstrike Falcon EDR
2022-01-05 08:17:23 -08:00
aab7143708
Add CmdLine to Windows process list
2021-11-29 19:19:14 +09:00
886ab348f4
Merge pull request #548 from cmprmsd/patch-1
...
Add Bitdefender Process Names
2021-11-28 15:07:49 -06:00
8211f8f0e4
Add Bitdefender Process Names
...
Feel free to remove the source that I added to find out about "Bitdefender redline update"
2021-11-28 11:46:47 +01:00
56f339c8a3
Fix Sprintf statement
2021-10-21 15:13:29 +02:00
a60cc86c9a
Implemented beacon screenshot
2021-09-26 18:12:32 -07:00
0099e06cc6
Implemented beacon proc cmds
2021-09-26 17:41:18 -07:00
93b1e3a7b4
Fix use context switch
2021-09-23 20:37:06 -05:00
90f799a6f2
UX improvements
2021-09-23 19:23:13 -05:00
1a632f48ff
Initial refactor of client code to support beacons and sessions
2021-09-07 17:43:35 -05:00
084faf44ca
Implemented event reaction command
2021-07-05 12:09:40 -05:00
53d6d14c72
Various golint fixes
2021-07-04 14:04:29 -05:00
9a5d6948fe
Added export comments to client/command
2021-07-04 13:08:15 -05:00
8e215c2bd0
Refactored privilege, updated loot
2021-07-03 15:14:44 -05:00
Alexander Georgiev