admin/elastic-protections-artifacts
1
0
Fork 0
mirror of https://github.com/elastic/protections-artifacts synced 2026-06-08 14:02:19 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
1aa0f3dc9be2ce8d5f397218dbe754cef1012c38
elastic-protections-artifacts/behavior/rules
T
History
Mika Ayenson 1aa0f3dc9b open protections artifacts
2022-07-29 10:41:48 -04:00
..
command_and_control_connection_to_dynamic_dns_provider_by_a_signed_binary_proxy.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_connection_to_dynamic_dns_provider_by_an_unsigned_binary.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_connection_to_webservice_by_a_signed_binary_proxy.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_connection_to_webservice_by_an_unsigned_binary.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_execution_of_a_file_written_by_a_signed_binary_proxy.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_netwire_rat_registry_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_remcos_rat_registry_or_file_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_shlayer_malware_infection.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
command_and_control_suspicious_netsupport_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_credential_access_via_known_utilities.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_dumping_account_hashes_via_built_in_commands.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_lsa_dump_via_silentprocessexit.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_access_to_kerberos_cached_credentials.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_credential_access_via_mimikatz.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_credential_access_via_rubeus.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_credential_access_via_windows_credential_history.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_credentials_phishing_via_osascript.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_discovery_of_dpapi_master_keys.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_potential_discovery_of_windows_credential_manager_store.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_security_account_manager_(sam)_file_access.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_security_account_manager_(sam)_registry_access.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_sensitive_file_access_cloud_credentials.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_sensitive_file_access_remote_desktop_connection_manager.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_sensitive_file_access_ssh_saved_keys.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_sensitive_file_access_system_admin_utilities.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_sensitive_file_access_unattended_panther.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_suspicious_access_to_active_directory_database_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_suspicious_access_to_lsa_secrets_registry.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_suspicious_access_to_web_browser_credential_stores.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_suspicious_access_to_windows_vault_files.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_system_bootkey_registry_access.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_web_browser_credential_access_via_unsigned_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_web_browser_credential_access_via_unusual_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
credential_access_web_browsers_password_access_via_command_line.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_binary_masquerading_via_untrusted_path.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_binary_proxy_execution_via_rundll32.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_control_panel_process_with_unusual_arguments.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_crashdump_disabled_via_registry_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_execution_via_internet_explorer_exporter.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_execution_via_renamed_signed_binary_proxy.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_managed_.net_code_execution_via_windows_script_interpreter.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_modification_of_safari_settings_via_defaults_command.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_msbuild_with_unusual_arguments.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_network_connection_via_process_with_unusual_arguments.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_operating_system_security_updates_disabled.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_parent_process_pid_spoofing.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_potential_defense_evasion_via_filter_manager_control_program.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_potential_masquerading_as_svchost.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_potential_parent_process_pid_spoofing_via_malseclogon.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_potential_privacy_control_bypass_via_localhost_secure_copy.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_potential_self_deletion_of_a_running_executable.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_process_executable_image_tampering_attempt.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_protected_process_light_bypass_via_dll_tampering.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_regsvr32_scriptlet_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_regsvr32_with_unusual_arguments.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_remote_file_execution_via_msiexec.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_remote_msi_package_installation_via_msiexec.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_renamed_autoit_scripts_interpreter.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_renamed_third_party_administrator_tools.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_renamed_windows_automaton_script_interpreter.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_rundll32_regsvr32_loads_a_dll_downloaded_via_bits.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_rundll32_with_unusual_arguments.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_script_execution_via_microsoft_html_application.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_script_execution_via_msxsl.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_scriptlet_execution_via_cmstp.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_scriptlet_execution_via_rundll32.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_scriptlet_proxy_execution_via_pubprn.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_solarmarker_backdoor_registry_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_bitsadmin_activity.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_execution_from_a_mounted_device.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_imageload_from_an_iso_mounted_device.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_imageload_via_windows_update_auto_update_client.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_windows_defender_exclusions_added_via_powershell.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_windows_lua_script_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_suspicious_wmic_xsl_script_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_unusual_dll_extension_loaded_by_rundll32_or_regsvr32.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_unusual_network_connection_via_rundll32.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_windows_error_manager_reporting_masquerading.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
defense_evasion_windows_firewall_exception_list_modified_via_untrusted_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
discovery_external_ip_address_discovery_via_a_trusted_program.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
discovery_external_ip_address_discovery_via_untrusted_program.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
discovery_potential_security_software_discovery_via_grep.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
discovery_potential_virtual_machine_fingerprinting_via_grep.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_command_shell_activity_started_via_rundll32.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_delayed_execution_via_ping.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_download_and_execution_of_javascript_payload.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_dynwrapx_image_load_via_windows_scripts.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_eggshell_backdoor_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_embedded_executable_via_windows_shortcut_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_empire_stager_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_execution_from_unusual_directory.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_execution_of_a_file_written_by_windows_script_host.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_execution_of_a_windows_script_downloaded_via_a_lolbin.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_execution_of_a_windows_script_with_unusual_file_extension.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_execution_via_electron_child_process_node.js_module.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_execution_via_outlook_application_com_object.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_potential_execution_via_zipexec.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_potential_reverse_shell_activity_via_terminal.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_privilege_escalation_enumeration_via_linpeas.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_shell_execution_via_windows_shortcut_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_apple_script_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_automator_workflows_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_cmd_execution_via_wmi.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_execution_via_windows_management_instrumentation.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_java_execution_via_a_windows_script.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_powershell_downloads.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_powershell_execution_via_windows_scripts.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_windows_script_file_name.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_windows_script_interpreter_child_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_windows_script_process_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_suspicious_windows_shortcut_file_creation_or_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_unusual_powershell_engine_imageload.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
execution_windows_shortcut_file_embedded_object_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_bcdedit_safe_mode_command_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_darkradiation_ransomware_infection.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_followed_by_a_suspicious_file_rename.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_via_microsoft_office_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_via_obfuscated_commands.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_via_renamed_utilities.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_via_signed_binary_proxy.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_via_untrusted_parent_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_inhibit_system_recovery_via_windows_command_shell.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_potential_data_wiping_attack_behavior.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
impact_potential_ransomware_note_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_execution_from_a_downloaded_iso_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_execution_of_file_written_or_modified_by_microsoft_equation_editor.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_file_execution_via_microsoft_html_help.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_microsoft_equation_editor_child_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_microsoft_office_file_execution_via_script_interpreter.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_microsoft_office_file_execution_via_wmi.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_microsoft_office_loaded_a_dropped_executable_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_microsoft_office_process_setting_persistence_via_startup.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_potential_remote_file_execution_via_msiexec.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_powershell_obfuscation_spawned_via_microsoft_office.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_registry_modification_via_microsoft_office.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_rundll32_regsvr32_loads_dropped_executable.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_script_file_written_by_microsoft_office_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_signed_binary_execution_via_microsoft_office.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_suspicious_execution_via_a_mounted_image_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_suspicious_execution_via_shellbrowserwindow_shellwindow_com.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_suspicious_microsoft_office_child_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_suspicious_ms_office_execution_via_dcom.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_suspicious_network_connection_from_microsoft_equation_editor.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_untrusted_file_execution_via_microsoft_office.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_windows_command_shell_spawned_via_microsoft_office.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
initial_access_wmi_image_load_via_microsoft_office.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
lateral_movement_imageload_of_a_file_dropped_via_smb.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
lateral_movement_potential_kerberos_attack_via_bifrost.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
lateral_movement_potential_lateral_movement_via_smbexec.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
lateral_movement_suspicious_nullsessionpipe_registry_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
lateral_movement_unexpected_smb_connection_from_user_mode_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
lateral_movement_unusual_remote_desktop_client_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_network_connection_via_startup_item.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_potential_persistence_via_emond.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_registry_persistence_via_microsoft_office_descendant_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_registry_run_key_modified_by_unusual_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_registry_run_key_prefixed_with_asterisk.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_script_file_written_to_startup_folder.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_script_interpreter_process_writing_to_commonly_abused_persistence_locations.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_startup_persistence_via_microsoft_office_descendant_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_startup_persistence_via_unusual_process.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_startup_persistence_via_windows_script_interpreter.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_suspicious_property_list_file_creation_or_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_suspicious_scheduled_task_creation_via_masqueraded_xml_file.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_suspicious_scheduled_task_creation.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_suspicious_string_value_written_to_registry_run_key.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_untrusted_process_writing_to_commonly_abused_persistence_locations.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_unusual_file_written_or_modified_in_startup_folder.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
persistence_unusual_startup_shell_folder_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_elevated_execution_via_shellexecute_runas_administrator.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_potential_privilege_escalation_via_dll_redirection.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_potential_privilege_escalation_via_elevated_ifileoperation.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_potential_privilege_escalation_via_file_redirection.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_potential_privilege_escalation_via_missing_dll.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_potential_privilege_escalation_via_rogue_winrm.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_potential_privilege_escalation_via_root_crontab_file_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_privilege_escalation_via_named_pipe_impersonation.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_privilege_escalation_via_pkexec_exploitation.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_privilege_escalation_via_windir_or_systemroot_environment_variable.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_sudo_heap_based_buffer_overflow_attempt.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_suspicious_windows_service_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_cdssync_scheduled_task_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_consent_dll_search_order_hijacking.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_dccw_dll_search_order_hijacking.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_dismcore_dll_side_loading.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_dll_side_loading_from_windows_media_player_folder.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_elevated_com_internet_explorer_add_on_installer.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_mmc_dll_search_order_hijacking.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_silentcleanup_task_dll_search_order_hijacking.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_windows_directory_masquerading.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_via_wow64_logger_dll_side_loading.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_attempt_with_ieditionupgrademanager_elevated_com_interface.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_computerdefaults_execution_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_control_panel_execution_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_delegateexecute_registry_modification.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_diskcleanup_scheduled_task_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_event_viewer.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_fodhelper_execution_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_icmluautil_elevated_com_interface.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_malicious_mmc_snap_in_execution.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_sdclt.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_windows_activation_execution_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_windows_firewall_snap_in_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_uac_bypass_via_wsreset_execution_hijack.toml
open protections artifacts
2022-07-29 10:41:48 -04:00
privilege_escalation_unusual_child_process_integrity_level.toml
open protections artifacts
2022-07-29 10:41:48 -04:00