Patrick Bareiss 8e1338d6dd draft

2020-02-17 13:34:26 +01:00

..

access_lsass_memory_for_dump_creation.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

activity_related_to_pass_the_hash.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

attempted_credential_dump_from_registry_via_reg.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

aws_activity_in_new_region.yml

draft

2020-02-17 13:34:26 +01:00

create_remote_thread_into_lsass.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

creation_of_shadow_copy_with_wmic_and_powershell.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

creation_of_shadow_copy.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

cred_dump_via_copy_from_shadowcopy.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

cred_dump_via_symlink_shadowcopy.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

detect_credential_dumping_through_LSASS_access.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

detect_mimikatz_using_loaded_images.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00

unsigned_image_loaded_by_LSASS.yml

WIP: spec 3_0 POC

2020-02-07 13:36:50 +01:00