mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Eric McGinnis
18 KiB
18 KiB
| 1 | service_name | service_path | tool_name | tool_category | tool_type | severity | comment | reference |
|---|---|---|---|---|---|---|---|---|
| 2 | *mimidrv* | mimidrv | Credential Access | offensive_tool | critical | https://github.com/mthcht/awesome-lists | ||
| 3 | *mimikatz* | mimidrv | Credential Access | offensive_tool | critical | https://github.com/mthcht/awesome-lists | ||
| 4 | *sharpsploit* | sharpsploit | Lateral Movement | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/SharpSploit.csv | https://github.com/cobbr/SharpSploit/blob/c16931ddb8cd2335e0bd26feb9aaa35f449d48db/SharpSploit/LateralMovement/SCM.cs#L209 | |
| 5 | 3proxy | 3proxy | Defense Evasion | offensive_tool | medium | https://github.com/3proxy/3proxy/blob/a80bef9ecf0c0ed98ccb1a1a764f6b79a620b78f/src/stringtable.c#L14 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/_Others/3proxy.csv | |
| 6 | AADInternals | AADInternals | Credential Access | greyware_tools | high | A little service to steal the AD FS DKM secret | https://github.com/Gerenios/AADInternals/blob/0fa2edf5676439cd3fe7c92ed8006b63f0be9632/ADFS.ps1#L484C132-L484C144 | |
| 7 | aswSP_ArPot1 | killProcessPOC | Defense Evasion | offensive_tool | high | abused by MONTI ransomware | https://github.com/timwhitez/killProcessPOC - https://github.com/mthcht/ThreatHunting-Keywords/tree/main/tools/I-K/killProcessPOC.csv - https://www.withsecure.com/content/dam/with-secure/en/resources/WS_Professionalisation_of_CyberCrime_EN.pdf | |
| 8 | aswSP_ArPot2 | killProcessPOC | Defense Evasion | offensive_tool | high | abused by MONTI ransomware | https://github.com/timwhitez/killProcessPOC - https://github.com/mthcht/ThreatHunting-Keywords/tree/main/tools/I-K/killProcessPOC.csv - https://www.withsecure.com/content/dam/with-secure/en/resources/WS_Professionalisation_of_CyberCrime_EN.pdf | |
| 9 | aswSP_ArPot3 | killProcessPOC | Defense Evasion | offensive_tool | high | abused by MONTI ransomware | https://github.com/timwhitez/killProcessPOC - https://github.com/mthcht/ThreatHunting-Keywords/tree/main/tools/I-K/killProcessPOC.csv - https://www.withsecure.com/content/dam/with-secure/en/resources/WS_Professionalisation_of_CyberCrime_EN.pdf | |
| 10 | aswSP_ArPots | killProcessPOC | Defense Evasion | offensive_tool | high | abused by MONTI ransomware | https://github.com/timwhitez/killProcessPOC - https://github.com/mthcht/ThreatHunting-Keywords/tree/main/tools/I-K/killProcessPOC.csv - https://www.withsecure.com/content/dam/with-secure/en/resources/WS_Professionalisation_of_CyberCrime_EN.pdf | |
| 11 | SecurityCenterIBM | Clop Ransomware | Defense Evasion | offensive_tool | high | abused by Clop ransomware | https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html | |
| 12 | WinCheckDRVs | Clop Ransomware | Defense Evasion | offensive_tool | high | abused by Clop ransomware | https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html | |
| 13 | BadWindowsService | BadWindowsService | Privilege Escalation | offensive_tool | critical | https://github.com/eladshamir/BadWindowsService/blob/a7057720763fceaa7cbac9088d4c69b43d17a28f/BadWindowsService/ProjectInstaller.Designer.cs#L44 | https://github.com/mthcht/ThreatHunting-Keywords/tree/main/tools/A-C/BadWindowsService.csv | |
| 14 | BlockNewProc | BlockNewProc | Defense Evasion | offensive_tool | critical | PoCs to block new process with Process Notify Callback method - BlockNewProc | https://github.com/daem0nc0re/VectorKernel/blob/main/BlockNewProc/README.md | |
| 15 | BTOBTO | smbExec | Lateral Movement | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/I-K/impacket.csv | ||
| 16 | c3pool_miner | xmrig | Cryptominer | greyware_tool | critical | https://github.com/C3Pool/xmrig_setup/blob/82c4e9bf7ee3c0c9cd925ede6e46e9ed4cc5f195/setup_c3pool_miner.bat#L380 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/X-Z/xmrig.csv | |
| 17 | chopper | TChopper | Lateral Movement | offensive_tool | critical | https://github.com/lawrenceamer/TChopper/blob/f7383a36af813019ebefb70803dc82a842ed9273/chopper.lpr#L237C25-L237C34 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/Tchopper.csv | |
| 18 | CorpVPN | UacMe | Persistence | offensive_tool | critical | https://github.com/r00t-3xp10it/redpill/blob/611d39b8bff717ac84d58550dc04e1b312acb19e/bin/UacMe.ps1#L291 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/redpill.csv | |
| 19 | CreateToken | CreateToken | Privilege Escalation | offensive_tool | critical | PoCs to get full privileged SYSTEM token with `ZwCreateToken()` API - CreateToken | https://github.com/daem0nc0re/VectorKernel/blob/main/CreateToken/README.md | |
| 20 | CreatSvcRpc_* | CreateSvcRpc | Privilege Escalation | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/SspiUacBypass.csv | ||
| 21 | csexecsvc | csexec | Lateral Movement | offensive_tool | critical | https://github.com/malcomvetter/CSExec/blob/d6bd3f97e66dc65ccf64d9102a33379fdb769614/csexecsvc/Program.cs#L13 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/csexec.csv | |
| 22 | CyberGhost 6 Service | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 23 | CyberGhost 7 Service | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 24 | CyberGhost 8 Service | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 25 | CyberGhost Tunnel Client: CyberGhost-WireGuard-1 | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 26 | CyberGhost6Service | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ - command: C:\Program Files\CyberGhost 6\Dashboard.Service.exe | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 27 | CyberGhost7Service | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ - command: C:\Program Files\CyberGhost 7\Dashboard.Service.exe | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 28 | CyberGhost8Service | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ - command: C:\Program Files\CyberGhost 8\Dashboard.Service.exe | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 29 | CyberGhostTunnel$CyberGhost-WireGuard-1 | CyberGhostVPN | VPN | greyware_tool | high | https://www.cyberghostvpn.com/ - command: \Program Files\CyberGhost 8\Applications\VPN\WGHelper.exe /service C:\Windows\system32\config\systemprofile\AppData\Local\CyberGhost\WGSession-1\CyberGhost-WireGuard-1.conf | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/A-C/CyberGhost%20VPN.csv | |
| 30 | dcrypt | DiskCryptor | Impact | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/D-F/DiskCryptor.csv | ||
| 31 | dnsproxy | dns-proxy | Defense Evasion | offensive_tool | critical | dnsproxy service | https://github.com/AdguardTeam/dnsproxy/pull/194/files | |
| 32 | final_seg | TChopper | Lateral Movement | offensive_tool | critical | https://github.com/lawrenceamer/TChopper/blob/f7383a36af813019ebefb70803dc82a842ed9273/chopper.lpr#L237C25-L237C34 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/Tchopper.csv | |
| 33 | GetFullPrivs | GetFullPrivs | Privilege Escalation | offensive_tool | critical | PoCs to get full privileges with DKOM method - GetFullPrivs | https://github.com/daem0nc0re/VectorKernel/blob/main/GetFullPrivs/README.md | |
| 34 | GetProcHandle | GetProcHandle | Privilege Escalation | offensive_tool | critical | PoCs to get full access process handle from kernelmode - GetProcHandle | https://github.com/daem0nc0re/VectorKernel/blob/main/GetProcHandle/README.md | |
| 35 | GoodSync Server | goodync | Data Exfiltration | greyware_tool | high | https://www.goodsync.com/ | ||
| 36 | InjectLibrary | InjectLibrary | Defense Evasion | offensive_tool | critical | PoCs to perform DLL injection with Kernel APC Injection method - InjectLibrary | https://github.com/daem0nc0re/VectorKernel/blob/main/InjectLibrary/README.md | |
| 37 | KrbSCM | KrbRelayUp | Privilege Escalation | offensive_tool | critical | https://github.com/Dec0ne/KrbRelayUp/blob/e919f78afbacdb2c2e86f17267674069a377011c/README.md?plain=1#L90 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/I-K/KrbRelayUp.csv | |
| 38 | MagnetRAMCapture Driver | MAGNET RAM Capture | Credential Access | greyware_tool | critical | https://startupstash.com/tools/magnet-ram-capture/ | ||
| 39 | maint | impacketremoteshell | Lateral Movement | offensive_tool | high | default service name installed https://github.com/trustedsec/The_Shelf/blob/feaece2bf00ba0ff46b39cadbd06803be1114d7a/POC/impacketremoteshell/RemoteMaint/main.cpp#L108 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/impacketremoteshell.csv | |
| 40 | MakeMeAdmin | MakeMeAdmin | Privilege Escalation | offensive_tool | high | Enables users to elevate themselves to administrator-level rights https://github.com/pseymour/MakeMeAdmin/blob/18ea04be3dbc6e7cab8096558a3b02ef8f8682f6/Service/ProjectInstaller.Designer.cs#L63 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/MakeMeAdmin.csv | |
| 41 | Meterpreter | metasploit | C2 | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/metasploit.csv | ||
| 42 | metsvc | metsvc-server.exe | Metasploit server | Exploitation | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/metasploit.csv | |
| 43 | ModHide | ModHide | Defense Evasion | offensive_tool | critical | PoCs to hide loaded kernel drivers with DKOM method - ModHide | https://github.com/daem0nc0re/VectorKernel/blob/main/ModHide/README.md | |
| 44 | Neo_VPN | *\System32\drivers\Neo6_x64_VPN.sys | SoftEtherVPN | Defense Evasion | greyware_tool | medium | https://github.com/SoftEtherVPN/SoftEtherVPN | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/SoftEtherVPN.csv |
| 45 | NoRebootSvc | NoReboot.exe | PSBits NoReboot.c | offensive_tool | high | https://github.com/gtworek/PSBits/blob/master/NoRebootSvc/readme.md | ||
| 46 | Npcap Packet Driver (NPCAP) | NpCap Windows Packet Capture Library & Driver | Collection | greyware_tool | low | https://github.com/nmap/npcap | ||
| 47 | PAExec | paexec | Lateral Movement | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/PAExec.csv | ||
| 48 | PAExec-* | paexec | Lateral Movement | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/PAExec.csv | ||
| 49 | PCHunter* | PCHunter | Defense Evasion | greyware_tool | medium | PCHunter service name installation - https://www.majorgeeks.com/files/details/pc_hunter.html | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/PCHunter.csv | |
| 50 | physmem2profit | physmem2profit | Credential Access | offensive_tool | critical | https://github.com/WithSecureLabs/physmem2profit/blob/2f64133bd9931303b8ae47630835e96347e0f294/server/Plugins/WinPmem.cs#L11 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/physmem2profit.csv | |
| 51 | PowerUpService | PowerSploit Privesc.tests.ps1 | Privilege Escalation | offensive_tool | critical | https://github.com/PowerShellMafia/PowerSploit/blob/master/Tests/Privesc.tests.ps1 | ||
| 52 | PPLBlade | pplblade | Defense Evasion | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/PPLBlade.csv | ||
| 53 | ProcExp | DriverDump | Persistence | offensive_tool | critical | This program configures and loads a Windows service to manage a driver https://github.com/trustedsec/The_Shelf/blob/feaece2bf00ba0ff46b39cadbd06803be1114d7a/POC/driverdump/DriverDump/DriverDump.c#L45 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/D-F/DriverDump.csv | |
| 54 | ProcHide | ProcHide | Defense Evasion | offensive_tool | critical | PoCs to hide process with DKOM method - ProcHide | https://github.com/daem0nc0re/VectorKernel/blob/main/ProcHide/README.md | |
| 55 | ProcProtect | ProcProtect | Defense Evasion | offensive_tool | critical | PoCs to manipulate Protected Process - ProcProtect | https://github.com/daem0nc0re/VectorKernel/blob/main/ProcProtect/README.md | |
| 56 | pwdump* | PWDumpX | Credential Access | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/pwdump.csv | ||
| 57 | PWDumpX Service | PWDumpX | Credential Access | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/PWDumpX.csv | ||
| 58 | QueryModule | QueryModule | Collection | offensive_tool | medium | PoCs to perform retrieving kernel driver loaded address information - QueryModule | https://github.com/daem0nc0re/VectorKernel/blob/main/QueryModule/README.md | |
| 59 | RandomService | Invoke-SMBRemoting | Lateral Movement | offensive_tool | critical | Invoke-SMBRemoting service example | https://github.com/Leo4j/Amnesiac/blob/216ba3a280bf49ea3f5b1afab80f843bbde3548d/Tools/Invoke-SMBRemoting.ps1#L33C99-L33C113 | |
| 60 | RemCom Service | RemCom.exe | Lateral movement | offensive_tool | critical | https://github.com/kavika13/RemCom | ||
| 61 | REPLACE_ME_DummyServiceName | netexec | Credential Access | offensive_tool | critical | https://github.com/Pennyw0rth/NetExec/blob/b855dac2b696ea1b744f10a0573c6b394670a5cb/nxc/data/keepass_trigger_module/RestartKeePass.ps1#L4 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/NetExec.csv | |
| 62 | Ring0NamedPipeFilter | NamedPipeMaster | Privilege Escalation | offensive_tool | critical | https://github.com/gavz/NamedPipeMaster | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/NamedPipeMaster.csv | |
| 63 | Service_* | PsMapExec | Lateral Movement | offensive_tool | critical | PsMapExec creating services regex detection: Service_[A-Za-z]{16} | https://github.com/The-Viper-One/PsMapExec/blob/0ae7a6967c07bf3ebf555e665d4c43ce86c6addf/PsMapExec.ps1#L1488 | |
| 64 | sesshijack | atomic-red-team test T1563.002 | Persistence | offensive_tool | high | https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1563.002/T1563.002.md?plain=1 | ||
| 65 | SEVPNCLIENTDEV | *\Program Files\SoftEther VPN Client Developer Edition\vpnclient.exe* | SoftEtherVPN | Defense Evasion | greyware_tool | medium | https://github.com/SoftEtherVPN/SoftEtherVPN | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/SoftEtherVPN.csv |
| 66 | Shadowsocks Local Service | Shadowsocks | C2 | greyware_tool | high | https://github.com/shadowsocks/shadowsocks-rust/blob/846752866e0b52c3d93efa2036204eadc36cc696/README.md?plain=1#L458 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/shadowsocks.csv | |
| 67 | shadowsocks-local-service | Shadowsocks | C2 | greyware_tool | high | https://github.com/shadowsocks/shadowsocks-rust/blob/846752866e0b52c3d93efa2036204eadc36cc696/README.md?plain=1#L458 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/shadowsocks.csv | |
| 68 | SilkService | SilkETW | Discovery | greyware_tool | low | C# wrappers for ETW - meant to abstract away the complexities of ETW and give people a simple interface to perform research and introspection | https://github.com/mandiant/SilkETW | |
| 69 | sliver* | sliver | C2 | offensive_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/sliver.csv | ||
| 70 | SoftEther VPN* | SoftEtherVPN | Defense Evasion | greyware_tool | medium | https://github.com/SoftEtherVPN/SoftEtherVPN | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/SoftEtherVPN.csv | |
| 71 | StealToken | StealToken | Credential Access | offensive_tool | critical | PoCs to perform token stealing from kernelmode - StealToken | https://github.com/daem0nc0re/VectorKernel/blob/main/CreateToken/README.md | |
| 72 | svcEasySystem | p0wnedShell | Privilege Escalation | offensive_tool | critical | https://github.com/Cn33liz/p0wnedShell/blob/35853bcc2a184f0e0fa7b18b0e54d4ad7a985ed6/p0wnedShell/Modules/PrivEsc/p0wnedEasySystem.cs#L582C33-L582C46 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/O-Q/p0wnedShell.csv | |
| 73 | svcHighPriv | EasySystem | Privilege Escalation | offensive_tool | critical | https://github.com/S3cur3Th1sSh1t/Creds/blob/f71e780c51fdc2fdabe4e51831fa6289b1bede96/Csharp/NamedPipeSystem.cs#L28 | https://github.com/mthcht/awesome-lists | |
| 74 | TestService | SharpyStay default | Persistence | offensive_tool | critical | https://github.com/antonioCoco/SharPyShell/blob/29718225791f11fd3d66dd03df4c05c414256630/modules/ps_modules/Get-System.ps1#L89 | ||
| 75 | TestSVC | SharpyShell - Get-System.ps1 default service name | Privilege Escalation | offensive_tool | critical | https://github.com/antonioCoco/SharPyShell/blob/29718225791f11fd3d66dd03df4c05c414256630/modules/ps_modules/Get-System.ps1#L89 | ||
| 76 | UACBypassedService | S4UTomato & KRBUACBypass | Privilege Escalation | offensive_tool | critical | https://github.com/wh0amitz/S4UTomato/blob/c709a2997efb1b30375c5134ff57eb49ec177918/S4UTomato/lib/KrbSCM.cs#L10 - https://github.com/wh0amitz/KRBUACBypass/blob/e2ad3ff8b5810dda0b2d75442f1c67aef7e3c4c1/KRBUACBypass/lib/KrbSCM.cs#L10 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/S4UTomato.csv | |
| 77 | VPN Client Device Driver - VPN | SoftEtherVPN | Defense Evasion | greyware_tool | medium | https://github.com/SoftEtherVPN/SoftEtherVPN | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/SoftEtherVPN.csv | |
| 78 | WCESERVICE | wce | Lateral Movement | greyware_tool | high | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/U-W/wce.csv | ||
| 79 | windows_monitoring | social-engineer-toolkit persistence payload | Persistence | offensive_tool | high | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/R-T/social-engineer-toolkit.csv | ||
| 80 | winexesvc | winexe | Lateral Movement | greyware_tool | low | https://www.kali.org/tools/winexe | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/U-W/winexe.csv | |
| 81 | WinPwnage | WinPwnage | Persistence | offensive_tool | critical | https://github.com/rootm0s/WinPwnage/blob/aed0389b4d20b61e3c6de611a3386d3e3fbcae01/winpwnage/functions/persist/persistMethod12.py#L24 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/U-W/WinPwnage.csv | |
| 82 | WinPwnageVPN | WinPwnage | Persistence | offensive_tool | critical | https://github.com/rootm0s/WinPwnage/blob/aed0389b4d20b61e3c6de611a3386d3e3fbcae01/winpwnage/functions/uac/uacMethod13.py#L54 | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/U-W/WinPwnage.csv | |
| 83 | WinRing0_* | xmrig | Cryptomining | greyware_tool | critical | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/X-Z/xmrig.csv | ||
| 84 | wsc_proxy | no_defender | Defense Evasion | offensive_tool | low | technique observed with the tool no_defender https://github.com/es3n1n/no-defender - subject to false positives if avast is installed | https://github.com/mthcht/ThreatHunting-Keywords/blob/main/tools/L-N/no_defender.csv |