research bot 5caec4b36b updating docs and package bits [ci skip]

2022-04-04 18:15:20 +00:00

..

2017-01-07-spectre_and_meltdown_vulnerable_systems.md

…

2017-09-12-detect_new_login_attempts_to_routers.md

…

2017-09-12-extended_period_without_successful_netbackup_backups.md

…

2017-09-12-identify_new_user_accounts.md

…

2017-09-12-unsuccessful_netbackup_backups.md

…

2017-09-13-detect_unauthorized_assets_by_mac_address.md

…

2017-09-15-no_windows_updates_in_a_time_frame.md

…

2017-09-19-email_attachments_with_lots_of_spaces.md

…

2017-09-19-open_redirect_in_splunk_web.md

…

2017-09-20-large_volume_of_dns_any_queries.md

…

2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md

…

2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md

…

2017-09-23-monitor_dns_for_brand_abuse.md

…

2017-09-23-monitor_web_traffic_for_brand_abuse.md

…

2017-10-13-unusually_long_content-type_length.md

…

2017-11-27-detect_usb_device_insertion.md

…

2018-01-05-monitor_email_for_brand_abuse.md

…

2018-02-23-ec2_instance_started_in_previously_unseen_region.md

…

2018-03-12-ec2_instance_started_with_previously_unseen_ami.md

…

2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md

…

2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md

…

2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md

…

2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md

…

2018-04-16-detect_new_api_calls_from_user_roles.md

…

2018-04-18-detect_spike_in_security_group_activity.md

…

2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md

…

2018-05-17-detect_api_activity_from_users_without_mfa.md

…

2018-05-21-detect_spike_in_network_acl_activity.md

…

2018-06-01-detect_large_outbound_icmp_packets.md

…

2018-06-14-splunk_enterprise_information_disclosure.md

…

2018-06-28-detect_s3_access_from_a_new_ip.md

…

2018-10-08-web_fraud_-_account_harvesting.md

…

2018-10-08-web_fraud_-_anomalous_user_clickspeed.md

…

2018-10-08-web_fraud_-_password_sharing_across_accounts.md

…

2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md

…

2018-10-23-wmi_permanent_event_subscription.md

…

2018-10-23-wmi_temporary_event_subscription.md

…

2018-11-02-windows_hosts_file_modification.md

…

2018-11-27-detect_spike_in_s3_bucket_deletion.md

…

2018-12-03-remote_wmi_command_attempt.md

…

2018-12-03-usn_journal_deletion.md

…

2018-12-06-suspicious_java_classes.md

…

2018-12-14-file_with_samsam_extension.md

…

2018-12-14-samsam_test_file_write.md

…

2019-01-25-processes_tapping_keyboard_events.md

…

2019-01-29-osquery_pack_-_coldroot_detection.md

…

2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md

…

2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md

…

2019-04-01-web_servers_executing_suspicious_processes.md

…

2019-04-25-suspicious_file_write.md

…

2019-05-08-unusually_long_command_line_-_mltk.md

…

2019-10-11-prohibited_software_on_endpoint.md

…

2019-12-03-detect_credential_dumping_through_lsass_access.md

…

2019-12-03-detect_mimikatz_using_loaded_images.md

…

2019-12-06-access_lsass_memory_for_dump_creation.md

…

2019-12-06-create_remote_thread_into_lsass.md

…

2019-12-06-unsigned_image_loaded_by_lsass.md

…

2019-12-10-creation_of_shadow_copy.md

…

2020-01-22-dns_query_length_outliers_-_mltk.md

…

2020-01-28-auto_admin_logon_registry_entry.md

…

2020-01-28-monitor_registry_keys_for_print_monitors.md

…

2020-01-28-registry_keys_for_creating_shim_databases.md

…

2020-01-28-sdclt_uac_bypass.md

…

2020-01-28-silentcleanup_uac_bypass.md

…

2020-01-28-wsreset_uac_bypass.md

…

2020-02-03-creation_of_lsass_dump_with_taskmgr.md

…

2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md

…

2020-02-07-macos_-_re-opened_applications.md

…

2020-02-20-gcp_gcr_container_uploaded.md

…

2020-02-20-new_container_uploaded_to_aws_ecr.md

…

2020-02-21-dump_lsass_via_comsvcs_dll.md

…

2020-03-02-remote_registry_key_modifications.md

…

2020-03-16-child_processes_of_spoolsv_exe.md

…

2020-03-16-detect_rare_executables.md

…

2020-03-16-process_execution_via_wmi.md

…

2020-03-16-script_execution_via_wmi.md

…

2020-03-16-spike_in_file_writes.md

…

2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md

…

2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md

…

2020-04-15-gcp_kubernetes_cluster_scan_detection.md

…

2020-05-19-kubernetes_azure_scan_fingerprint.md

…

2020-05-20-first_time_seen_child_process_of_zoom.md

…

2020-05-20-kubernetes_azure_detect_sensitive_object_access.md

…

2020-05-20-kubernetes_azure_detect_sensitive_role_access.md

…

2020-05-20-kubernetes_azure_detect_service_accounts_forbidden_failure_access.md

…

2020-05-20-kubernetes_azure_pod_scan_fingerprint.md

…

2020-05-26-kubernetes_azure_active_service_accounts_by_pod_namespace.md

…

2020-05-26-kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.md

…

2020-05-26-kubernetes_azure_detect_rbac_authorization_by_account.md

…

2020-05-26-kubernetes_azure_detect_suspicious_kubectl_calls.md

…

2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md

…

2020-05-28-detect_aws_console_login_by_new_user.md

…

2020-06-23-aws_eks_kubernetes_cluster_sensitive_object_access.md

…

2020-06-23-kubernetes_aws_detect_most_active_service_accounts_by_pod.md

…

2020-06-23-kubernetes_aws_detect_rbac_authorization_by_account.md

…

2020-06-23-kubernetes_aws_detect_sensitive_role_access.md

…

2020-06-23-kubernetes_aws_detect_service_accounts_forbidden_failure_access.md

…

2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md

…

2020-06-23-kubernetes_gcp_detect_service_accounts_forbidden_failure_access.md

…

2020-07-03-detect_path_interception_by_creation_of_program_exe.md

…

2020-07-06-short_lived_windows_accounts.md

…

2020-07-06-windows_event_log_cleared.md

…

2020-07-07-remote_desktop_network_traffic.md

…

2020-07-08-detect_new_local_admin_account.md

…

2020-07-10-kubernetes_gcp_detect_most_active_service_accounts_by_pod.md

…

2020-07-11-kubernetes_gcp_detect_rbac_authorizations_by_account.md

…

2020-07-11-kubernetes_gcp_detect_sensitive_object_access.md

…

2020-07-11-kubernetes_gcp_detect_sensitive_role_access.md

…

2020-07-11-kubernetes_gcp_detect_suspicious_kubectl_calls.md

…

2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md

…

2020-07-21-abnormally_high_aws_instances_launched_by_user_-_mltk.md

…

2020-07-21-abnormally_high_aws_instances_launched_by_user.md

…

2020-07-21-abnormally_high_aws_instances_terminated_by_user_-_mltk.md

…

2020-07-21-abnormally_high_aws_instances_terminated_by_user.md

…

2020-07-21-attempt_to_stop_security_service.md

…

2020-07-21-clients_connecting_to_multiple_dns_servers.md

…

2020-07-21-detect_aws_api_activities_from_unapproved_accounts.md

…

2020-07-21-detect_dns_requests_to_phishing_sites_leveraging_evilginx2.md

…

2020-07-21-detect_excessive_user_account_lockouts.md

…

2020-07-21-detect_long_dns_txt_record_response.md

…

2020-07-21-detect_new_user_aws_console_login.md

…

2020-07-21-detect_outbound_smb_traffic.md

…

2020-07-21-detect_outlook_exe_writing_a_zip_file.md

…

2020-07-21-detect_spike_in_aws_api_activity.md

…

2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md

…

2020-07-21-detect_web_traffic_to_dynamic_domain_providers.md

…

2020-07-21-detection_of_tools_built_by_nirsoft.md

…

2020-07-21-dns_query_requests_resolved_by_unauthorized_dns_servers.md

…

2020-07-21-dns_record_changed.md

…

2020-07-21-ec2_instance_modified_with_previously_unseen_user.md

…

2020-07-21-ec2_instance_started_with_previously_unseen_user.md

…

2020-07-21-email_files_written_outside_of_the_outlook_directory.md

…

2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md

…

2020-07-21-excessive_dns_failures.md

…

2020-07-21-first_time_seen_command_line_argument.md

…

2020-07-21-first_time_seen_running_windows_service.md

…

2020-07-21-hiding_files_and_directories_with_attrib_exe.md

…

2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md

…

2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md

…

2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md

…

2020-07-21-okta_account_lockout_events.md

…

2020-07-21-okta_failed_sso_attempts.md

…

2020-07-21-okta_user_logins_from_multiple_cities.md

…

2020-07-21-overwriting_accessibility_binaries.md

…

2020-07-21-prohibited_network_traffic_allowed.md

…

2020-07-21-protocol_or_port_mismatch.md

…

2020-07-21-remote_desktop_network_bruteforce.md

…

2020-07-21-remote_desktop_process_running_on_system.md

…

2020-07-21-sc_exe_manipulating_windows_services.md

…

2020-07-21-scheduled_tasks_used_in_badrabbit_ransomware.md

…

2020-07-21-sql_injection_with_long_urls.md

…

2020-07-22-smb_traffic_spike_-_mltk.md

…

2020-07-22-smb_traffic_spike.md

…

2020-07-22-suspicious_changes_to_file_associations.md

…

2020-07-22-suspicious_email_-_uba_anomaly.md

…

2020-07-22-suspicious_email_attachment_extensions.md

…

2020-07-22-suspicious_reg_exe_process.md

…

2020-07-22-suspicious_writes_to_system_volume_information.md

…

2020-07-22-suspicious_writes_to_windows_recycle_bin.md

…

2020-07-22-tor_traffic.md

…

2020-07-22-uncommon_processes_on_endpoint.md

…

2020-07-22-unload_sysmon_filter_driver.md

…

2020-07-27-aws_detect_attach_to_role_policy.md

…

2020-07-27-aws_detect_permanent_key_creation.md

…

2020-07-27-aws_detect_role_creation.md

…

2020-07-27-aws_detect_sts_assume_role_abuse.md

…

2020-07-27-aws_detect_sts_get_session_token_abuse.md

…

2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md

…

2020-07-28-detect_windows_dns_sigred_via_zeek.md

…

2020-07-29-cloud_instance_modified_by_previously_unseen_user.md

…

2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md

…

2020-08-05-detect_new_open_gcp_storage_buckets.md

…

2020-08-10-detect_gcp_storage_access_from_a_new_ip.md

…

2020-08-11-detect_arp_poisoning.md

…

2020-08-11-detect_rogue_dhcp_server.md

…

2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md

…

2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md

…

2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md

…

2020-08-21-abnormally_high_number_of_cloud_instances_launched.md

…

2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md

…

2020-08-25-system_process_running_from_unexpected_location.md

…

2020-08-25-unusual_lolbas_in_short_period_of_time.md

…

2020-09-01-gcp_detect_oauth_token_abuse.md

…

2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md

…

2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md

…

2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md

…

2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md

…

2020-09-08-cloud_network_access_control_list_deleted.md

…

2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md

…

2020-09-15-detect_zerologon_via_zeek.md

…

2020-09-16-create_or_delete_windows_shares_using_net_exe.md

…

2020-09-18-detect_computer_changed_with_anonymous_account.md

…

2020-10-07-detect_aws_console_login_by_user_from_new_city.md

…

2020-10-07-detect_aws_console_login_by_user_from_new_country.md

…

2020-10-07-detect_aws_console_login_by_user_from_new_region.md

…

2020-10-08-gcp_detect_gcploit_framework.md

…

2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md

…

2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md

…

2020-10-09-gcp_detect_accounts_with_high_risk_roles_by_project.md

…

2020-10-09-gcp_detect_high_risk_permissions_by_resource_and_account.md

…

2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md

…

2020-10-21-detect_kerberoasting.md

…

2020-10-21-detect_snicat_sni_exfiltration.md

…

2020-10-28-detect_ipv6_network_infrastructure_threats.md

…

2020-10-28-detect_port_security_violation.md

…

2020-10-28-detect_software_download_to_network_device.md

…

2020-10-28-detect_traffic_mirroring.md

…

2020-11-06-ryuk_test_files_detected.md

…

2020-11-06-windows_connhost_exe_started_forcefully.md

…

2020-11-06-windows_security_account_manager_stopped.md

…

2020-11-09-common_ransomware_extensions.md

…

2020-11-09-common_ransomware_notes.md

…

2020-11-09-deleting_shadow_copies.md

…

2020-11-09-detect_excessive_account_lockouts_from_endpoint.md

…

2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md

…

2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md

…

2020-11-18-disabling_remote_user_account_control.md

…

2020-11-18-execution_of_file_with_multiple_extensions.md

…

2020-11-19-execution_of_file_with_spaces_before_extension.md

…

2020-11-23-processes_created_by_netsh.md

…

2020-11-23-shim_database_installation_with_suspicious_parameters.md

…

2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md

…

2020-12-07-schtasks_used_for_forcing_a_reboot.md

…

2020-12-08-shim_database_file_creation.md

…

2020-12-08-single_letter_process_on_endpoint.md

…

2020-12-08-system_processes_run_from_unexpected_locations.md

…

2020-12-08-unusually_long_command_line.md

…

2020-12-08-wmi_permanent_event_subscription_-_sysmon.md

…

2020-12-14-sunburst_correlation_dll_and_network_event.md

…

2020-12-15-o365_suspicious_rights_delegation.md

…

2020-12-16-high_number_of_login_failures_from_a_single_source.md

…

2020-12-16-o365_pst_export_alert.md

…

2020-12-16-o365_suspicious_admin_email_forwarding.md

…

2020-12-16-o365_suspicious_user_email_forwarding.md

…

2020-12-21-bcdedit_failure_recovery_modification.md

…

2021-01-06-supernova_webshell.md

…

2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md

…

2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md

…

2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md

…

2021-01-12-aws_network_access_control_list_deleted.md

…

2021-01-12-suspicious_microsoft_workflow_compiler_usage.md

…

2021-01-12-suspicious_msbuild_path.md

…

2021-01-12-suspicious_msbuild_rename.md

…

2021-01-12-suspicious_msbuild_spawn.md

…

2021-01-12-suspicious_mshta_child_process.md

…

2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md

…

2021-01-19-malicious_powershell_process_-_multiple_suspicious_command-line_arguments.md

…

2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md

…

2021-01-19-suspicious_powershell_command-line_arguments.md

…

2021-01-20-detect_rundll32_inline_hta_execution.md

…

2021-01-20-suspicious_mshta_spawn.md

…

2021-01-22-wbadmin_delete_system_backups.md

…

2021-01-25-nltest_domain_trust_discovery.md

…

2021-01-26-aws_saml_access_by_provider_user_and_principal.md

…

2021-01-26-aws_saml_update_identity_provider.md

…

2021-01-26-certutil_exe_certificate_extraction.md

…

2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md

…

2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md

…

2021-01-26-o365_add_app_role_assignment_grant_user.md

…

2021-01-26-o365_excessive_sso_logon_errors.md

…

2021-01-26-o365_new_federated_domain_added.md

…

2021-01-26-revil_registry_entry.md

…

2021-01-27-detect_baron_samedit_cve-2021-3156.md

…

2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md

…

2021-01-28-detect_regsvr32_application_control_bypass.md

…

2021-01-28-ntdsutil_export_ntds.md

…

2021-01-28-suspicious_regsvr32_register_suspicious_path.md

…

2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md

…

2021-02-01-dump_lsass_via_procdump_rename.md

…

2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md

…

2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md

…

2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md

…

2021-02-04-suspicious_rundll32_startw.md

…

2021-02-09-suspicious_rundll32_dllregisterserver.md

…

2021-02-11-detect_html_help_spawn_child_process.md

…

2021-02-12-detect_regasm_spawning_a_process.md

…

2021-02-12-detect_regsvcs_spawning_a_process.md

…

2021-02-22-aws_create_policy_version_to_allow_all_resources.md

…

2021-02-22-cobalt_strike_named_pipes.md

…

2021-02-22-suspicious_curl_network_connection.md

…

2021-02-22-suspicious_plistbuddy_usage_via_osquery.md

…

2021-02-22-suspicious_plistbuddy_usage.md

…

2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md

…

2021-03-01-any_powershell_downloadfile.md

…

2021-03-01-any_powershell_downloadstring.md

…

2021-03-01-fodhelper_uac_bypass.md

…

2021-03-01-ryuk_wake_on_lan_command.md

…

2021-03-01-suspicious_scheduled_task_from_public_directory.md

…

2021-03-02-aws_setdefaultpolicyversion.md

…

2021-03-02-unified_messaging_service_spawning_a_process.md

…

2021-03-02-windows_disableantispyware_registry.md

…

2021-03-03-nishang_powershelltcponeline.md

…

2021-03-03-w3wp_spawning_shell.md

…

2021-03-12-ransomware_notes_bulk_creation.md

…

2021-03-12-resize_shadowstorage_volume.md

…

2021-03-16-high_process_termination_frequency.md

…

2021-03-16-windows_high_file_deletion_frequency.md

…

2021-03-17-clop_common_exec_parameter.md

…

2021-03-17-clop_ransomware_known_service_name.md

…

2021-03-23-certutil_with_decode_argument.md

…

2021-03-29-powershell_start-bitstransfer.md

…

2021-03-31-aws_iam_successful_group_deletion.md

…

2021-03-31-disabling_firewall_with_netsh.md

…

2021-03-31-dsquery_domain_discovery.md

…

2021-04-01-aws_iam_assume_role_policy_brute_force.md

…

2021-04-01-aws_iam_delete_policy.md

…

2021-04-01-aws_iam_failure_group_deletion.md

…

2021-04-07-malicious_powershell_executed_as_a_service.md

…

2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md

…

2021-04-08-winevent_scheduled_task_created_within_public_path.md

…

2021-04-12-excel_spawning_powershell.md

…

2021-04-12-excel_spawning_windows_script_host.md

…

2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md

…

2021-04-12-winword_spawning_powershell.md

…

2021-04-12-winword_spawning_windows_script_host.md

…

2021-04-13-aws_excessive_security_scanning.md

…

2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md

…

2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md

…

2021-04-13-multiple_users_failing_to_authenticate_from_process.md

…

2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md

…

2021-04-13-office_application_spawn_rundll32_process.md

…

2021-04-13-windows_users_authenticate_using_explicit_credentials.md

…

2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md

…

2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md

…

2021-04-14-office_document_creating_schedule_task.md

…

2021-04-14-office_document_executing_macro_code.md

…

2021-04-14-windows_disabled_users_failing_to_authenticate_kerberos.md

…

2021-04-14-windows_invalid_users_failed_authentication_via_kerberos.md

…

2021-04-15-dns_exfiltration_using_nslookup_app.md

…

2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md

…

2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md

…

2021-04-19-powershell_remote_thread_to_known_windows_process.md

…

2021-04-19-schedule_task_with_http_command_arguments.md

…

2021-04-19-schedule_task_with_rundll32_command_trigger.md

…

2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md

…

2021-04-19-wermgr_process_create_executable_file.md

…

2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md

…

2021-04-21-excessive_usage_of_nslookup_app.md

…

2021-04-21-multiple_archive_files_http_post_traffic.md

…

2021-04-22-anomalous_usage_of_7zip.md

…

2021-04-22-office_product_spawning_rundll32_with_no_dll.md

…

2021-04-22-plain_http_post_exfiltrated_data.md

…

2021-04-22-winword_spawning_cmd.md

…

2021-04-26-office_product_spawning_bitsadmin.md

…

2021-04-26-office_product_spawning_certutil.md

…

2021-04-26-office_product_spawning_mshta.md

…

2021-04-26-trickbot_named_pipe.md

…

2021-04-29-icacls_deny_command.md

…

2021-04-29-suspicious_driver_loaded_path.md

…

2021-04-29-xmrig_driver_loaded.md

…

2021-05-04-deleting_of_net_users.md

…

2021-05-04-disabling_net_user_account.md

…

2021-05-04-excessive_attempt_to_disable_services.md

…

2021-05-04-excessive_service_stop_attempt.md

…

2021-05-04-excessive_usage_of_taskkill.md

…

2021-05-04-icacls_grant_command.md

…

2021-05-04-modify_acl_permission_to_files_or_folder.md

…

2021-05-04-process_kill_base_on_file_path.md

…

2021-05-05-suspicious_process_file_path.md

…

2021-05-06-download_files_using_telegram.md

…

2021-05-06-enumerate_users_local_group_using_telegram.md

…

2021-05-06-excessive_usage_of_net_app.md

…

2021-05-06-executables_or_script_creation_in_suspicious_path.md

…

2021-05-07-excessive_usage_of_cacls_app.md

…

2021-05-07-schtasks_run_task_on_demand.md

…

2021-05-12-delete_shadowcopy_with_powershell.md

…

2021-05-13-cmlua_or_cmstplua_uac_bypass.md

…

2021-05-13-slui_runas_elevated.md

…

2021-05-13-slui_spawning_a_process.md

…

2021-05-18-services_escalate_exe.md

…

2021-05-19-allow_inbound_traffic_in_firewall_rule.md

…

2021-05-19-mailsniper_invoke_functions.md

…

2021-05-20-cmd_echo_pipe_-_escalation.md

…

2021-05-21-winrm_spawning_a_process.md

…

2021-05-26-secretdumps_offline_ntds_dumping_tool.md

…

2021-05-27-detect_sharphound_file_modifications.md

…

2021-05-27-detect_sharphound_usage.md

…

2021-06-01-detect_azurehound_command-line_arguments.md

…

2021-06-01-detect_azurehound_file_modifications.md

…

2021-06-01-detect_sharphound_command-line_arguments.md

…

2021-06-02-conti_common_exec_parameter.md

…

2021-06-02-modification_of_wallpaper.md

…

2021-06-02-revil_common_exec_parameter.md

…

2021-06-02-wbemprox_com_object_execution.md

…

2021-06-04-known_services_killed_by_ransomware.md

…

2021-06-07-excessive_number_of_taskhost_processes.md

…

2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md

…

2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md

…

2021-06-09-detect_empire_with_powershell_script_block_logging.md

…

2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md

…

2021-06-09-unloading_amsi_via_reflection.md

…

2021-06-10-clear_unallocated_sector_using_cipher_app.md

…

2021-06-10-disable_logs_using_wevtutil.md

…

2021-06-10-permission_modification_using_takeown_app.md

…

2021-06-10-powershell_creating_thread_mutex.md

…

2021-06-10-powershell_domain_enumeration.md

…

2021-06-10-powershell_loading_dotnet_into_memory_via_reflection.md

…

2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md

…

2021-06-10-powershell_processing_stream_of_data.md

…

2021-06-10-powershell_using_memory_as_backing_store.md

…

2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md

…

2021-06-10-recon_avproduct_through_pwh_or_wmi.md

…

2021-06-10-recon_using_wmi_class.md

…

2021-06-14-wmi_recon_running_process_or_services.md

…

2021-06-15-wevtutil_usage_to_clear_logs.md

…

2021-06-15-wevtutil_usage_to_disable_logs.md

…

2021-06-16-detect_wmi_event_subscription_persistence.md

…

2021-06-17-suspicious_event_log_service_behavior.md

…

2021-06-22-execute_javascript_with_jscript_com_clsid.md

…

2021-06-22-powershell_enable_smb1protocol_feature.md

…

2021-06-22-recursive_delete_of_directory_in_batch_cmd.md

…

2021-06-23-allow_file_and_printing_sharing_in_firewall.md

…

2021-06-23-allow_network_discovery_in_firewall.md

…

2021-06-24-excessive_usage_of_sc_service_utility.md

…

2021-06-25-excessive_number_of_service_control_start_as_disabled.md

…

2021-07-01-print_spooler_adding_a_printer_driver.md

…

2021-07-01-print_spooler_failed_to_load_a_plug-in.md

…

2021-07-01-spoolsv_spawning_rundll32.md

…

2021-07-01-spoolsv_suspicious_loaded_modules.md

…

2021-07-01-spoolsv_suspicious_process_access.md

…

2021-07-01-spoolsv_writing_a_dll_-_sysmon.md

…

2021-07-01-spoolsv_writing_a_dll.md

…

2021-07-05-msmpeng_application_dll_side_loading.md

…

2021-07-05-powershell_disable_security_monitoring.md

…

2021-07-12-uac_bypass_mmc_load_unsigned_dll.md

…

2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md

…

2021-07-19-aws_createaccesskey.md

…

2021-07-19-aws_createloginprofile.md

…

2021-07-19-aws_updateloginprofile.md

…

2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md

…

2021-07-19-detect_new_open_s3_buckets.md

…

2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md

…

2021-07-19-office_product_spawn_cmd_process.md

…

2021-07-20-detect_shared_ec2_snapshot.md

…

2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md

…

2021-07-23-sam_database_file_access_attempt.md

…

2021-07-26-rundll32_createremotethread_in_browser.md

…

2021-07-26-rundll32_process_creating_exe_dll_files.md

…

2021-07-26-suspicious_icedid_rundll32_cmdline.md

…

2021-07-26-suspicious_rundll32_plugininit.md

…

2021-07-27-chcp_command_execution.md

…

2021-07-27-regsvr32_with_known_silent_switch_cmdline.md

…

2021-07-29-rundll32_create_remote_thread_to_a_process.md

…

2021-07-30-drop_icedid_license_dat.md

…

2021-07-30-icedid_exfiltrated_archived_file_creation.md

…

2021-07-30-office_application_spawn_regsvr32_process.md

…

2021-08-03-sqlite_module_in_temp_folder.md

…

2021-08-04-create_remote_thread_in_shell_application.md

…

2021-08-09-uninstall_app_using_msiexec.md

…

2021-08-10-powershell_execute_com_object.md

…

2021-08-11-fsutil_zeroing_file.md

…

2021-08-13-uac_bypass_with_colorui_com_object.md

…

2021-08-16-gsuite_drive_share_in_external_email.md

…

2021-08-16-gsuite_email_suspicious_attachment.md

…

2021-08-17-7zip_commandline_to_smb_share_path.md

…

2021-08-17-aws_ecr_container_scanning_findings_high.md

…

2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md

…

2021-08-17-aws_ecr_container_scanning_findings_medium.md

…

2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md

…

2021-08-18-esentutl_sam_copy.md

…

2021-08-18-powershell_4104_hunting.md

…

2021-08-19-aws_ecr_container_upload_outside_business_hours.md

…

2021-08-19-aws_ecr_container_upload_unknown_user.md

…

2021-08-19-gsuite_email_suspicious_subject_with_attachment.md

…

2021-08-19-protocols_passing_authentication_in_cleartext.md

…

2021-08-20-github_commit_changes_in_master.md

…

2021-08-20-kubernetes_nginx_ingress_lfi.md

…

2021-08-23-getlocaluser_with_powershell_script_block.md

…

2021-08-23-getlocaluser_with_powershell.md

…

2021-08-23-getwmiobject_user_account_with_powershell_script_block.md

…

2021-08-23-getwmiobject_user_account_with_powershell.md

…

2021-08-23-gsuite_email_with_known_abuse_web_service_link.md

…

2021-08-23-gsuite_suspicious_shared_file_name.md

…

2021-08-23-kubernetes_nginx_ingress_rfi.md

…

2021-08-24-adsisearcher_account_discovery.md

…

2021-08-24-domain_account_discovery_with_dsquery.md

…

2021-08-24-domain_account_discovery_with_net_app.md

…

2021-08-24-domain_account_discovery_with_wmic.md

…

2021-08-24-get_aduser_with_powershell_script_block.md

…

2021-08-24-get_aduser_with_powershell.md

…

2021-08-24-get_domainuser_with_powershell_script_block.md

…

2021-08-24-get_domainuser_with_powershell.md

…

2021-08-24-get-domaintrust_with_powershell_script_block.md

…

2021-08-24-get-domaintrust_with_powershell.md

…

2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md

…

2021-08-24-getwmiobject_ds_user_with_powershell.md

…

2021-08-24-kubernetes_scanner_image_pulling.md

…

2021-08-25-domain_group_discovery_with_adsisearcher.md

…

2021-08-25-domain_group_discovery_with_net.md

…

2021-08-25-domain_group_discovery_with_wmic.md

…

2021-08-25-elevated_group_discovery_with_net.md

…

2021-08-25-elevated_group_discovery_with_powerview.md

…

2021-08-25-elevated_group_discovery_with_wmic.md

…

2021-08-25-getadgroup_with_powershell_script_block.md

…

2021-08-25-getadgroup_with_powershell.md

…

2021-08-25-getdomaingroup_with_powershell.md

…

2021-08-25-getnettcpconnection_with_powershell.md

…

2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md

…

2021-08-25-getwmiobject_ds_group_with_powershell.md

…

2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md

…

2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md

…

2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md

…

2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md

…

2021-08-26-get_domainpolicy_with_powershell_script_block.md

…

2021-08-26-get_domainpolicy_with_powershell.md

…

2021-08-26-getdomaingroup_with_powershell_script_block.md

…

2021-08-26-password_policy_discovery_with_net.md

…

2021-08-26-process_creating_lnk_file_in_suspicious_location.md

…

2021-08-27-exchange_powershell_abuse_via_ssrf.md

…

2021-08-27-exchange_powershell_module_usage.md

…

2021-08-30-domain_controller_discovery_with_nltest.md

…

2021-08-30-remote_system_discovery_with_net.md

…

2021-08-31-petitpotam_network_share_access_request.md

…

2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md

…

2021-08-31-remote_system_discovery_with_dsquery.md

…

2021-09-01-circle_ci_disable_security_step.md

…

2021-09-01-domain_controller_discovery_with_wmic.md

…

2021-09-01-domain_group_discovery_with_dsquery.md

…

2021-09-01-getadcomputer_with_powershell_script_block.md

…

2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md

…

2021-09-01-github_commit_in_develop.md

…

2021-09-01-github_dependabot_alert.md

…

2021-09-01-github_pull_request_from_unknown_user.md

…

2021-09-01-remote_system_discovery_with_adsisearcher.md

…

2021-09-01-remote_system_discovery_with_wmic.md

…

2021-09-02-circle_ci_disable_security_job.md

…

2021-09-02-get-foresttrust_with_powershell_script_block.md

…

2021-09-02-get-foresttrust_with_powershell.md

…

2021-09-02-getdomaincomputer_with_powershell_script_block.md

…

2021-09-02-getdomaincontroller_with_powershell_script_block.md

…

2021-09-06-bcdedit_command_back_to_normal_mode_boot.md

…

2021-09-06-change_to_safe_mode_with_network_config.md

…

2021-09-06-correlation_by_repository_and_risk.md

…

2021-09-06-correlation_by_user_and_risk.md

…

2021-09-07-getadcomputer_with_powershell.md

…

2021-09-07-getdomaincomputer_with_powershell.md

…

2021-09-07-getdomaincontroller_with_powershell.md

…

2021-09-07-getwmiobject_ds_computer_with_powershell.md

…

2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md

…

2021-09-07-system_information_discovery_detection.md

…

2021-09-08-control_loading_from_world_writable_directory.md

…

2021-09-08-create_local_admin_accounts_using_net_exe.md

…

2021-09-08-office_spawning_control.md

…

2021-09-08-rundll32_control_rundll_hunt.md

…

2021-09-08-rundll32_control_rundll_world_writable_directory.md

…

2021-09-09-extraction_of_registry_hives.md

…

2021-09-09-mshtml_module_load_in_office_product.md

…

2021-09-10-getnettcpconnection_with_powershell_script_block.md

…

2021-09-10-network_connection_discovery_with_arp.md

…

2021-09-10-network_connection_discovery_with_net.md

…

2021-09-10-network_connection_discovery_with_netstat.md

…

2021-09-10-office_product_writing_cab_or_inf.md

…

2021-09-13-getcurrent_user_with_powershell_script_block.md

…

2021-09-13-getcurrent_user_with_powershell.md

…

2021-09-13-jscript_execution_using_cscript_app.md

…

2021-09-13-ms_scripting_process_loading_ldap_module.md

…

2021-09-13-ms_scripting_process_loading_wmi_module.md

…

2021-09-13-office_application_drop_executable.md

…

2021-09-13-system_user_discovery_with_query.md

…

2021-09-13-system_user_discovery_with_whoami.md

…

2021-09-13-user_discovery_with_env_vars_powershell_script_block.md

…

2021-09-13-user_discovery_with_env_vars_powershell.md

…

2021-09-13-xsl_script_execution_with_wmic.md

…

2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md

…

2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md

…

2021-09-14-get_wmiobject_group_discovery.md

…

2021-09-14-net_localgroup_discovery.md

…

2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md

…

2021-09-14-powershell_get_localgroup_discovery.md

…

2021-09-14-wmic_group_discovery.md

…

2021-09-15-check_elevated_cmd_using_whoami.md

…

2021-09-15-non_chrome_process_accessing_chrome_default_dir.md

…

2021-09-15-non_firefox_process_access_firefox_profile_dir.md

…

2021-09-16-account_discovery_with_net_app.md

…

2021-09-16-attempt_to_add_certificate_to_untrusted_store.md

…

2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md

…

2021-09-16-batch_file_write_to_system32.md

…

2021-09-16-bits_job_persistence.md

…

2021-09-16-bitsadmin_download_file.md

…

2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md

…

2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md

…

2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md

…

2021-09-16-detect_html_help_renamed.md

…

2021-09-16-detect_html_help_url_in_command_line.md

…

2021-09-16-detect_html_help_using_infotech_storage_handlers.md

…

2021-09-16-detect_mshta_inline_hta_execution.md

…

2021-09-16-detect_mshta_renamed.md

…

2021-09-16-detect_mshta_url_in_command_line.md

…

2021-09-16-detect_psexec_with_accepteula_flag.md

…

2021-09-16-detect_renamed_7-zip.md

…

2021-09-16-detect_renamed_psexec.md

…

2021-09-16-detect_renamed_rclone.md

…

2021-09-16-detect_renamed_winrar.md

…

2021-09-16-dump_lsass_via_procdump.md

…

2021-09-16-local_account_discovery_with_net.md

…

2021-09-16-local_account_discovery_with_wmic.md

…

2021-09-16-office_product_spawning_wmic.md

…

2021-09-16-processes_launching_netsh.md

…

2021-09-20-detect_regasm_with_no_command_line_arguments.md

…

2021-09-20-detect_regsvcs_with_no_command_line_arguments.md

…

2021-09-20-office_document_spawned_child_process_to_download.md

…

2021-09-20-suspicious_dllhost_no_command_line_arguments.md

…

2021-09-20-suspicious_gpupdate_no_command_line_arguments.md

…

2021-09-20-suspicious_microsoft_workflow_compiler_rename.md

…

2021-09-20-suspicious_rundll32_no_command_line_arguments.md

…

2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md

…

2021-09-21-remcos_rat_file_creation_in_remcos_folder.md

…

2021-09-21-suspicious_image_creation_in_appdata_folder.md

…

2021-09-21-suspicious_wav_file_in_appdata_folder.md

…

2021-09-27-change_default_file_association.md

…

2021-09-27-logon_script_event_trigger_execution.md

…

2021-09-27-screensaver_event_trigger_execution.md

…

2021-09-28-print_processor_registry_autostart.md

…

2021-09-29-verclsid_clsid_execution.md

…

2021-10-01-vbscript_execution_using_wscript_app.md

…

2021-10-04-msbuild_suspicious_spawned_by_script_process.md

…

2021-10-04-regsvr32_silent_and_install_param_dll_loading.md

…

2021-10-05-detect_exchange_web_shell.md

…

2021-10-05-malicious_inprocserver32_modification.md

…

2021-10-05-process_writing_dynamicwrapperx.md

…

2021-10-05-rundll32_shimcache_flush.md

…

2021-10-05-suspicious_copy_on_system32.md

…

2021-10-05-winhlp32_spawning_a_process.md

…

2021-10-06-dns_query_length_with_high_standard_deviation.md

…

2021-10-06-sdelete_application_execution.md

…

2021-10-06-wscript_or_cscript_suspicious_child_process.md

…

2021-10-11-suspicious_wevtutil_usage.md

…

2021-10-13-dllhost_with_no_command_line_arguments_with_network.md

…

2021-10-13-rundll32_with_no_command_line_arguments_with_network.md

…

2021-10-13-searchprotocolhost_with_no_command_line_with_network.md

…

2021-10-14-serviceprincipalnames_discovery_with_powershell.md

…

2021-10-14-serviceprincipalnames_discovery_with_setspn.md

…

2021-10-18-disable_schedule_task.md

…

2021-10-19-windows_curl_download_to_suspicious_path.md

…

2021-10-19-winevent_windows_task_scheduler_event_action_started.md

…

2021-10-20-wmic_noninteractive_app_uninstallation.md

…

2021-10-24-gdrive_suspicious_file_sharing.md

…

2021-10-24-gsuite_suspicious_calendar_invite.md

…

2021-11-03-windows_adfind_exe.md

…

2021-11-04-attacker_tools_on_endpoint.md

…

2021-11-05-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md

…

2021-11-10-windows_curl_upload_to_remote_destination.md

…

2021-11-10-windows_service_creation_on_remote_endpoint.md

…

2021-11-10-windows_service_initiation_on_remote_endpoint.md

…

2021-11-11-remote_process_instantiation_via_winrm_and_winrs.md

…

2021-11-11-scheduled_task_creation_on_remote_endpoint_using_at.md

…

2021-11-11-scheduled_task_initiation_on_remote_endpoint.md

…

2021-11-11-schtasks_scheduling_job_on_remote_system.md

…

2021-11-11-wmic_xsl_execution_via_url.md

…

2021-11-12-aws_iam_accessdenied_discovery_events.md

…

2021-11-12-csc_net_on_the_fly_compilation.md

…

2021-11-12-firewall_allowed_program_enable.md

…

2021-11-12-network_discovery_using_route_windows_app.md

…

2021-11-12-remote_process_instantiation_via_wmi.md

…

2021-11-12-runas_execution_in_commandline.md

…

2021-11-12-windows_installutil_credential_theft.md

…

2021-11-12-windows_installutil_remote_network_connection.md

…

2021-11-12-windows_installutil_uninstall_option_with_network.md

…

2021-11-12-windows_installutil_uninstall_option.md

…

2021-11-12-windows_installutil_url_in_command_line.md

…

2021-11-15-remote_process_instantiation_via_dcom_and_powershell_script_block.md

…

2021-11-15-remote_process_instantiation_via_dcom_and_powershell.md

…

2021-11-15-remote_process_instantiation_via_wmi_and_powershell_script_block.md

…

2021-11-15-remote_process_instantiation_via_wmi_and_powershell.md

…

2021-11-15-sdelete_application_execution.md

…

2021-11-15-windows_diskcryptor_usage.md

…

2021-11-16-high_frequency_copy_of_files_in_network_share.md

…

2021-11-16-remote_process_instantiation_via_winrm_and_powershell_script_block.md

…

2021-11-16-remote_process_instantiation_via_winrm_and_powershell.md

…

2021-11-17-windows_dism_remove_defender.md

…

2021-11-18-executable_file_written_in_administrative_smb_share.md

…

2021-11-18-loading_of_dynwrapx_module.md

…

2021-11-19-system_info_gathering_using_dxdiag_application.md

…

2021-11-22-anomalous_usage_of_archive_tools.md

…

2021-11-22-possible_browser_pass_view_parameter.md

…

2021-11-22-services_lolbas_execution_process_spawn.md

…

2021-11-22-svchost_lolbas_execution_process_spawn.md

…

2021-11-22-windows_service_created_with_suspicious_service_path.md

…

2021-11-22-windows_service_created_within_public_path.md

…

2021-11-22-wmiprsve_lolbas_execution_process_spawn.md

…

2021-11-22-wsmprovhost_lolbas_execution_process_spawn.md

…

2021-11-23-mmc_lolbas_execution_process_spawn.md

…

2021-11-24-attempt_to_delete_services.md

…

2021-11-24-attempt_to_disable_services.md

…

2021-11-25-add_or_set_windows_defender_exclusion.md

…

2021-11-25-powershell_windows_defender_exclusion_commands.md

…

2021-11-25-windows_defender_exclusion_registry_entry.md

…

2021-11-29-attempted_credential_dump_from_registry_via_reg_exe.md

…

2021-11-29-deny_permission_using_cacls_utility.md

…

2021-11-29-detect_dump_lsass_memory_using_comsvcs.md

…

2021-11-29-detect_rclone_command-line_usage.md

…

2021-11-29-possible_lateral_movement_powershell_spawn.md

…

2021-11-29-randomly_generated_scheduled_task_name.md

…

2021-11-29-randomly_generated_windows_service_name.md

…

2021-11-30-delete_a_net_user.md

…

2021-11-30-disable_net_user_account.md

…

2021-11-30-first_time_seen_command_line_argument.md

…

2021-11-30-grant_permission_using_cacls_utility.md

…

2021-11-30-modify_acls_permission_of_files_or_folders.md

…

2021-11-30-potential_pass_the_token_or_hash_observed_at_the_destination_device.md

…

2021-11-30-rare_parent-child_process_relationship.md

…

2021-11-30-resize_shadowstorage_volume.md

…

2021-12-01-unusual_number_of_computer_service_tickets_requested.md

…

2021-12-01-unusual_number_of_remote_endpoint_authentication_events.md

…

2021-12-03-detect_rclone_command-line_usage.md

…

2021-12-03-short_lived_scheduled_task.md

…

2021-12-03-windows_curl_upload_to_remote_destination.md

…

2021-12-06-suspicious_linux_discovery_commands.md

…

2021-12-07-anomalous_usage_of_account_credentials.md

…

2021-12-07-bcdedit_failure_recovery_modification.md

…

2021-12-07-dns_exfiltration_using_nslookup_app.md

…

2021-12-07-excessive_number_of_office_files_copied.md

…

2021-12-07-fsutil_zeroing_file.md

…

2021-12-07-high_file_deletion_frequency.md

…

2021-12-07-microsoft_exchange_mailbox_replication_service_writing_active_server_pages.md

…

2021-12-07-ms_exchange_mailbox_replication_service_writing_active_server_pages.md

…

2021-12-07-wbadmin_delete_system_backups.md

…

2021-12-07-windows_raccine_scheduled_task_deletion.md

…

2021-12-08-disable_defender_antivirus_registry.md

…

2021-12-08-msi_module_loaded_by_non-system_binary.md

…

2021-12-10-curl_download_and_bash_execution.md

…

2021-12-11-wget_download_and_bash_execution.md

…

2021-12-13-detect_outbound_ldap_traffic.md

…

2021-12-13-java_class_file_download_by_java_user_agent.md

…

2021-12-13-linux_java_spawning_shell.md

…

2021-12-13-log4shell_jndi_payload_injection_attempt.md

…

2021-12-13-log4shell_jndi_payload_injection_with_outbound_connection.md

…

2021-12-13-outbound_network_connection_from_java_using_default_ports.md

…

2021-12-13-windows_java_spawning_shells.md

…

2021-12-14-hunting_for_log4shell.md

…

2021-12-17-linux_add_files_in_known_crontab_directories.md

…

2021-12-17-linux_at_allow_config_file_creation.md

…

2021-12-17-linux_at_application_execution.md

…

2021-12-17-linux_edit_cron_table_parameter.md

…

2021-12-17-linux_possible_append_command_to_at_allow_config_file.md

…

2021-12-17-linux_possible_append_cronjob_entry_on_existing_cronjob_file.md

…

2021-12-17-linux_possible_cronjob_modification_with_editor.md

…

2021-12-20-clear_unallocated_sector_using_cipher_app.md

…

2021-12-20-hiding_files_and_directories_with_attrib_exe.md

…

2021-12-20-linux_file_creation_in_init_boot_directory.md

…

2021-12-20-linux_file_creation_in_profile_directory.md

…

2021-12-20-linux_possible_append_command_to_profile_config_file.md

…

2021-12-20-linux_service_file_created_in_systemd_directory.md

…

2021-12-20-linux_service_restarted.md

…

2021-12-20-linux_service_started_or_enabled.md

…

2021-12-20-suspicious_computer_account_name_change.md

…

2021-12-20-suspicious_kerberos_service_ticket_request.md

…

2021-12-21-linux_add_user_account.md

…

2021-12-21-linux_change_file_owner_to_root.md

…

2021-12-21-linux_nopasswd_entry_in_sudoers_file.md

…

2021-12-21-linux_setuid_using_chmod_utility.md

…

2021-12-21-linux_setuid_using_setcap_utility.md

…

2021-12-21-linux_visudo_utility_execution.md

…

2021-12-21-suspicious_ticket_granting_ticket_request.md

…

2021-12-22-linux_file_created_in_kernel_driver_directory.md

…

2021-12-22-linux_insert_kernel_module_using_insmod_utility.md

…

2021-12-22-linux_install_kernel_module_using_modprobe_utility.md

…

2021-12-22-linux_preload_hijack_library_calls.md

…

2021-12-23-linux_common_process_for_elevation_control.md

…

2021-12-23-linux_sudoers_tmp_file_creation.md

…

2022-01-04-linux_sudo_or_su_execution.md

…

2022-01-05-linux_doas_conf_file_creation.md

…

2022-01-05-linux_doas_tool_execution.md

…

2022-01-10-linux_possible_access_to_credential_files.md

…

2022-01-10-linux_possible_access_to_sudoers_file.md

…

2022-01-11-linux_possible_access_or_modification_of_sshd_config_file.md

…

2022-01-11-linux_possible_ssh_key_file_creation.md

…

2022-01-12-powershell_-_connect_to_internet_with_hidden_window.md

…

2022-01-12-windows_hunting_system_account_targeting_lsass.md

…

2022-01-12-windows_non-system_account_targeting_lsass.md

…

2022-01-14-potentially_malicious_code_on_commandline.md

…

2022-01-17-unusual_volume_of_data_download_from_internal_server_per_entity.md

…

2022-01-18-cmd_carry_out_string_command_parameter.md

…

2022-01-18-impacket_lateral_movement_commandline_parameters.md

…

2022-01-18-malicious_powershell_process_-_encoded_command.md

…

2022-01-18-powershell_remove_windows_defender_directory.md

…

2022-01-18-suspicious_process_dns_query_known_abuse_web_services.md

…

2022-01-19-suspicious_process_with_discord_dns_query.md

…

2022-01-19-windows_dotnet_binary_in_non_standard_path.md

…

2022-01-19-windows_installutil_in_non_standard_path.md

…

2022-01-20-excessive_file_deletion_in_windefender_folder.md

…

2022-01-20-ping_sleep_batch_command.md

…

2022-01-21-windows_nirsoft_advancedrun.md

…

2022-01-24-windows_nirsoft_utilities.md

…

2022-01-26-active_setup_registry_autostart.md

…

2022-01-26-add_defaultuser_and_password_in_registry.md

…

2022-01-26-allow_inbound_traffic_by_firewall_rule_registry.md

…

2022-01-26-allow_operation_with_consent_admin.md

…

2022-01-26-disable_amsi_through_registry.md

…

2022-01-26-disable_defender_antivirus_registry.md

…

2022-01-26-disable_defender_blockatfirstseen_feature.md

…

2022-01-26-disable_defender_enhanced_notification.md

…

2022-01-26-disable_defender_mpengine_registry.md

…

2022-01-26-disable_defender_spynet_reporting.md

…

2022-01-26-disable_defender_submit_samples_consent_feature.md

…

2022-01-26-log4shell_cve-2021-44228_exploitation.md

…

2022-01-26-registry_keys_used_for_persistence.md

…

2022-01-26-registry_keys_used_for_privilege_escalation.md

…

2022-01-26-remcos_client_registry_install_entry.md

…

2022-01-26-start_up_during_safe_mode_boot.md

…

2022-01-26-time_provider_persistence_registry.md

…

2022-01-27-disable_etw_through_registry.md

…

2022-01-27-disable_registry_tool.md

…

2022-01-27-disable_security_logs_using_minint_registry.md

…

2022-01-27-disable_show_hidden_files.md

…

2022-01-27-disable_uac_remote_restriction.md

…

2022-01-27-disable_windows_app_hotkeys.md

…

2022-01-27-disable_windows_behavior_monitoring.md

…

2022-01-27-disable_windows_smartscreen_protection.md

…

2022-01-27-disabling_cmd_application.md

…

2022-01-27-disabling_controlpanel.md

…

2022-01-27-windows_possible_credential_dumping.md

…

2022-01-28-disabling_defender_services.md

…

2022-01-28-disabling_folderoptions_windows_feature.md

…

2022-01-28-disabling_norun_windows_app.md

…

2022-01-28-disabling_systemrestore_in_registry.md

…

2022-01-28-disabling_task_manager.md

…

2022-01-28-enable_rdp_in_other_port_number.md

…

2022-01-28-enable_wdigest_uselogoncredential_registry.md

…

2022-01-28-etw_registry_disabled.md

…

2022-01-28-eventvwr_uac_bypass.md

…

2022-01-28-hide_user_account_from_sign-in_screen.md

…

2022-01-28-linux_pkexec_privilege_escalation.md

…

2022-02-01-mimikatz_passtheticket_commandline_parameters.md

…

2022-02-01-rubeus_command_line_parameters.md

…

2022-02-01-suspicious_rundll32_rename.md

…

2022-02-03-certutil_download_with_urlcache_and_split_arguments.md

…

2022-02-03-certutil_download_with_verifyctl_and_split_arguments.md

…

2022-02-03-o365_added_service_principal.md

…

2022-02-03-o365_bypass_mfa_via_trusted_ip.md

…

2022-02-03-o365_disable_mfa.md

…

2022-02-07-rubeus_kerberos_ticket_exports_through_winlogon_access.md

…

2022-02-07-windows_remote_assistance_spawning_process.md

…

2022-02-07-windows_schtasks_create_run_as_system.md

…

2022-02-08-rundll_loading_dll_by_ordinal.md

…

2022-02-08-unusual_number_of_kerberos_service_tickets_requested.md

…

2022-02-09-kerberoasting_spn_request_with_rc4_encryption.md

…

2022-02-11-linux_system_network_discovery.md

…

2022-02-11-windows_powershell_connect_to_internet_with_hidden_window.md

…

2022-02-11-windows_powershell_downloadfile.md

…

2022-02-14-linux_dd_file_overwrite.md

…

2022-02-15-detection_of_dns_tunnels.md

…

2022-02-15-windows_bits_job_persistence.md

…

2022-02-15-windows_diskshadow_proxy_execution.md

…

2022-02-15-windows_rasautou_dll_execution.md

…

2022-02-16-windows_bitsadmin_download_file.md

…

2022-02-16-windows_certutil_decode_file.md

…

2022-02-16-windows_certutil_urlcache_download.md

…

2022-02-16-windows_certutil_verifyctl_download.md

…

2022-02-16-windows_powershell_start-bitstransfer.md

…

2022-02-17-tcp_command_and_scripting_interpreter_outbound_ldap_traffic.md

…

2022-02-17-windows_disable_notification_center.md

…

2022-02-17-windows_diskshadow_proxy_execution.md

…

2022-02-17-windows_raw_access_to_master_boot_record_drive.md

…

2022-02-18-detect_regasm_with_network_connection.md

…

2022-02-18-detect_regsvcs_with_network_connection.md

…

2022-02-18-disabled_kerberos_pre-authentication_discovery_with_powerview.md

…

2022-02-18-interactive_session_on_remote_endpoint_with_powershell.md

…

2022-02-18-net_profiler_uac_bypass.md

…

2022-02-18-o365_excessive_authentication_failures_alert.md

…

2022-02-18-process_deleting_its_process_file_path.md

…

2022-02-18-rundll32_dnsquery.md

…

2022-02-18-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md

…

2022-02-18-windows_eventvwr_uac_bypass.md

…

2022-02-18-windows_wsreset_uac_bypass.md

…

2022-02-22-disabled_kerberos_pre-authentication_discovery_with_get-aduser.md

…

2022-02-22-kerberos_pre-authentication_flag_disabled_in_useraccountcontrol.md

…

2022-02-22-scheduled_task_deleted_or_created_via_cmd.md

…

2022-02-22-windows_wmi_process_call_create.md

…

2022-02-23-kerberos_pre-authentication_flag_disabled_with_powershell.md

…

2022-02-23-windows_event_for_service_disabled.md

…

2022-02-23-windows_excessive_disabled_services_event.md

…

2022-02-23-windows_mshta_child_process.md

…

2022-02-23-windows_mshta_command-line_url.md

…

2022-02-23-windows_mshta_inline_hta_execution.md

…

2022-02-23-windows_process_with_namedpipe_commandline.md

…

2022-02-23-windows_rundll32_inline_hta_execution.md

…

2022-02-23-windows_service_creation_using_registry_entry.md

…

2022-02-24-aws_lambda_updatefunctioncode.md

…

2022-02-25-windows_disable_memory_crash_dump.md

…

2022-02-25-windows_file_without_extension_in_critical_folder.md

…

2022-02-25-windows_raw_access_to_disk_volume_partition.md

…

2022-02-28-excessive_distinct_processes_from_windows_temp.md

…

2022-02-28-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md

…

2022-03-02-windows_modify_show_compress_color_and_info_tip_registry.md

…

2022-03-03-aws_createaccesskey.md

…

2022-03-03-aws_updateloginprofile.md

…

2022-03-04-macos_lolbin.md

…

2022-03-08-suspicious_msbuild_path.md

…

2022-03-08-windows_disable_change_password_through_registry.md

…

2022-03-08-windows_disable_lock_workstation_feature_through_registry.md

…

2022-03-08-windows_disable_logoff_button_through_registry.md

…

2022-03-08-windows_disable_shutdown_button_through_registry.md

…

2022-03-08-windows_disable_windows_group_policy_features_through_registry.md

…

2022-03-08-windows_hide_notification_features_through_registry.md

…

2022-03-15-detect_regasm_with_no_command_line_arguments.md

…

2022-03-15-detect_regsvcs_with_no_command_line_arguments.md

…

2022-03-15-dllhost_with_no_command_line_arguments_with_network.md

…

2022-03-15-gpupdate_with_no_command_line_arguments_with_network.md

…

2022-03-15-rundll32_with_no_command_line_arguments_with_network.md

…

2022-03-15-searchprotocolhost_with_no_command_line_with_network.md

…

2022-03-15-suspicious_dllhost_no_command_line_arguments.md

…

2022-03-15-suspicious_gpupdate_no_command_line_arguments.md

…

2022-03-15-suspicious_rundll32_no_command_line_arguments.md

…

2022-03-15-suspicious_searchprotocolhost_no_command_line_arguments.md

…

2022-03-16-windows_installutil_remote_network_connection.md

…

2022-03-16-windows_installutil_uninstall_option_with_network.md

…

2022-03-17-modify_acl_permission_to_files_or_folder.md

…

2022-03-24-splunk_dos_via_malformed_s2s_request.md

…

2022-03-28-sql_injection_with_long_urls.md

…

2022-03-28-windows_deleted_registry_by_a_non_critical_process_file_path.md

…

2022-03-28-windows_terminating_lsass_process.md

…

2022-04-04-github_actions_disable_security_workflow.md

…

2022-04-04-windows_event_for_service_disabled.md

…