d1vious 0ab9fc8cc2 Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

..

2017-09-12-detect_new_login_attempts_to_routers.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-13-detect_unauthorized_assets_by_mac_address.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-15-no_windows_updates_in_a_time_frame.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-19-email_attachments_with_lots_of_spaces.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-20-large_volume_of_dns_any_queries.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-09-23-monitor_web_traffic_for_brand_abuse.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2017-10-13-unusually_long_content-type_length.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-01-05-monitor_email_for_brand_abuse.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-06-01-detect_large_outbound_icmp_packets.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-06-28-detect_s3_access_from_a_new_ip.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-10-23-wmi_permanent_event_subscription.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-10-23-wmi_temporary_event_subscription.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-11-27-detect_spike_in_s3_bucket_deletion.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-12-03-remote_wmi_command_attempt.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-12-03-usn_journal_deletion.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-12-06-suspicious_java_classes.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-12-14-file_with_samsam_extension.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2018-12-14-samsam_test_file_write.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-01-25-processes_tapping_keyboard_events.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-04-01-web_servers_executing_suspicious_processes.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-05-08-unusually_long_command_line_-_mltk.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-12-03-detect_credential_dumping_through_lsass_access.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-12-03-detect_mimikatz_using_loaded_images.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-12-06-access_lsass_memory_for_dump_creation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-12-06-create_remote_thread_into_lsass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2019-12-10-creation_of_shadow_copy.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-6-04-attempted_credential_dump_from_registry_via_reg_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-7-13-detect_prohibited_applications_spawning_cmd_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-01-22-dns_query_length_outliers_-_mltk.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-02-03-creation_of_lsass_dump_with_taskmgr.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-02-07-macos_-_re-opened_applications.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-02-20-new_container_uploaded_to_aws_ecr.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-02-21-dump_lsass_via_comsvcs_dll.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-03-16-child_processes_of_spoolsv_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-03-16-detect_rare_executables.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-03-16-process_execution_via_wmi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-03-16-script_execution_via_wmi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-03-16-spike_in_file_writes.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-04-15-amazon_eks_kubernetes_cluster_scan_detection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-04-15-amazon_eks_kubernetes_pod_scan_detection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-05-20-first_time_seen_child_process_of_zoom.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-05-28-aws_cross_account_activity_from_previously_unseen_account.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-05-28-detect_aws_console_login_by_new_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-06-23-kubernetes_aws_detect_suspicious_kubectl_calls.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-03-detect_path_interception_by_creation_of_program_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-06-short_lived_windows_accounts.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-06-windows_event_log_cleared.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-07-remote_desktop_network_traffic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-08-detect_new_local_admin_account.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-17-gcp_kubernetes_cluster_pod_scan_detection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-attempt_to_stop_security_service.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-detect_excessive_user_account_lockouts.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-detect_outbound_smb_traffic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-detect_outlook_exe_writing_a_zip_file.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-detect_use_of_cmd_exe_to_launch_script_interpreters.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-detection_of_tools_built_by_nirsoft.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-email_files_written_outside_of_the_outlook_directory.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-email_servers_sending_high_volume_traffic_to_hosts.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-excessive_dns_failures.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-first_time_seen_running_windows_service.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-hiding_files_and_directories_with_attrib_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-hosts_receiving_high_volume_of_network_traffic_from_email_server.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-malicious_powershell_process_-_execution_policy_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-multiple_okta_users_with_invalid_credentials_from_the_same_ip.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-okta_account_lockout_events.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-okta_failed_sso_attempts.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-okta_user_logins_from_multiple_cities.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-overwriting_accessibility_binaries.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-prohibited_network_traffic_allowed.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-protocol_or_port_mismatch.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-remote_desktop_network_bruteforce.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-remote_desktop_process_running_on_system.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-sc_exe_manipulating_windows_services.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-schtasks_scheduling_job_on_remote_system.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-21-sql_injection_with_long_urls.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-smb_traffic_spike_-_mltk.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-smb_traffic_spike.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-suspicious_email_attachment_extensions.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-suspicious_reg_exe_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-suspicious_writes_to_windows_recycle_bin.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-tor_traffic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-22-unload_sysmon_filter_driver.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-27-aws_detect_attach_to_role_policy.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-27-aws_detect_permanent_key_creation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-27-aws_detect_role_creation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-27-aws_detect_sts_assume_role_abuse.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-27-aws_detect_sts_get_session_token_abuse.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-28-detect_windows_dns_sigred_via_splunk_stream.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-28-detect_windows_dns_sigred_via_zeek.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-07-29-cloud_instance_modified_by_previously_unseen_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-02-detect_f5_tmui_rce_cve-2020-5902.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-05-detect_new_open_gcp_storage_buckets.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-10-detect_gcp_storage_access_from_a_new_ip.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-11-detect_arp_poisoning.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-11-detect_rogue_dhcp_server.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-16-cloud_provisioning_activity_from_previously_unseen_ip_address.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-16-cloud_provisioning_activity_from_previously_unseen_region.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-21-abnormally_high_number_of_cloud_instances_destroyed.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-21-abnormally_high_number_of_cloud_instances_launched.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-25-more_than_usual_number_of_lolbas_applications_in_short_time_period.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-25-phishing_email_detection_by_machine_learning_method_-_ssa.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-08-25-system_process_running_from_unexpected_location.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-02-cloud_compute_instance_created_in_previously_unused_region.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-04-cloud_api_calls_from_previously_unseen_user_roles.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-07-abnormally_high_number_of_cloud_infrastructure_api_calls.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-07-abnormally_high_number_of_cloud_security_group_api_calls.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-12-cloud_compute_instance_created_with_previously_unseen_instance_type.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-15-detect_dump_lsass_memory_using_comsvcs.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-15-detect_zerologon_via_zeek.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-16-create_or_delete_windows_shares_using_net_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-09-18-detect_computer_changed_with_anonymous_account.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-06-unusually_long_command_line.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-07-detect_aws_console_login_by_user_from_new_city.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-07-detect_aws_console_login_by_user_from_new_country.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-07-detect_aws_console_login_by_user_from_new_region.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-08-gcp_detect_gcploit_framework.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-09-cloud_provisioning_activity_from_previously_unseen_city.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-09-cloud_provisioning_activity_from_previously_unseen_country.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-15-detect_activity_related_to_pass_the_hash_attacks.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-16-kerberoasting_spn_request_with_rc4_encryption.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-18-credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-18-credential_extraction_indicative_of_lazagne_command_line_options.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-18-credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-18-credential_extraction_native_microsoft_debuggers_via_z_command_line_option.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-18-credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-credential_extraction_indicative_of_use_of_dsinternals_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-credential_extraction_indicative_of_use_of_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-credential_extraction_indicative_of_use_of_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-detect_kerberoasting.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-detect_pass_the_hash.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-21-detect_snicat_sni_exfiltration.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-28-detect_ipv6_network_infrastructure_threats.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-28-detect_port_security_violation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-28-detect_software_download_to_network_device.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-10-28-detect_traffic_mirroring.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-applying_stolen_credentials_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-applying_stolen_credentials_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-assessment_of_credential_strength_via_dsinternals_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-setting_credentials_via_dsinternals_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-setting_credentials_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-03-setting_credentials_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-04-probing_access_with_stolen_credentials_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-05-reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-05-reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-05-reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-05-reconnaissance_of_defensive_tools_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-05-reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-05-reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_computers_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_and_access_to_shared_resources_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-reconnaissance_of_connectivity_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-ryuk_test_files_detected.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-set_default_powershell_execution_policy_to_unrestricted_or_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-06-windows_security_account_manager_stopped.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-common_ransomware_extensions.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-common_ransomware_notes.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-deleting_shadow_copies.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-detect_excessive_account_lockouts_from_endpoint.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_access_to_user_content_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_account_creation_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_deletion_of_logs_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_privilege_elevation_and_persistence_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_privilege_elevation_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_service_and_process_control_via_mimikatz_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-09-illegal_service_and_process_control_via_powersploit_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-10-detect_processes_used_for_system_network_configuration_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-10-detect_prohibited_applications_spawning_cmd_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-18-disabling_remote_user_account_control.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-18-execution_of_file_with_multiple_extensions.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-23-monitor_registry_keys_for_print_monitors.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-23-shim_database_installation_with_suspicious_parameters.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-26-reg_exe_manipulating_windows_services_registry_keys.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-26-registry_keys_for_creating_shim_databases.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-27-registry_keys_used_for_privilege_escalation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-30-remote_process_instantiation_via_wmi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-11-30-rundll_loading_dll_by_ordinal.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-07-schtasks_used_for_forcing_a_reboot.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-08-shim_database_file_creation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-08-single_letter_process_on_endpoint.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-08-system_processes_run_from_unexpected_locations.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-08-unusually_long_command_line.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-08-wmi_permanent_event_subscription_-_sysmon.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-14-sunburst_correlation_dll_and_network_event.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-15-o365_suspicious_rights_delegation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-high_number_of_login_failures_from_a_single_source.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-o365_disable_mfa.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-o365_excessive_authentication_failures_alert.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-o365_pst_export_alert.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-o365_suspicious_admin_email_forwarding.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-o365_suspicious_user_email_forwarding.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-16-windows_adfind_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-17-scheduled_task_deleted_or_created_via_cmd.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2020-12-21-bcdedit_failure_recovery_modification.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-2-1-first_time_seen_command_line_argument.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-06-supernova_webshell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-11-aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-11-aws_detect_users_with_kms_keys_performing_encryption_s3.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-11-aws_network_access_control_list_created_with_all_open_ports.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-12-aws_network_access_control_list_deleted.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-12-suspicious_microsoft_workflow_compiler_usage.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-12-suspicious_msbuild_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-12-suspicious_msbuild_rename.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-12-suspicious_msbuild_spawn.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-12-suspicious_mshta_child_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-14-detect_hosts_connecting_to_dynamic_domain_providers.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-19-malicious_powershell_process_with_obfuscation_techniques.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-20-detect_rundll32_inline_hta_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-20-suspicious_mshta_spawn.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-22-wbadmin_delete_system_backups.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-25-nltest_domain_trust_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-aws_saml_access_by_provider_user_and_principal.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-aws_saml_update_identity_provider.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-certutil_exe_certificate_extraction.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-detect_spike_in_aws_security_hub_alerts_for_ec2_instance.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-detect_spike_in_aws_security_hub_alerts_for_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-o365_add_app_role_assignment_grant_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-o365_added_service_principal.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-o365_excessive_sso_logon_errors.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-26-o365_new_federated_domain_added.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-27-detect_baron_samedit_cve-2021-3156.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-28-detect_baron_samedit_cve-2021-3156_via_osquery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-28-detect_regsvr32_application_control_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-28-ntdsutil_export_ntds.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-28-suspicious_regsvr32_register_suspicious_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-01-29-detect_baron_samedit_cve-2021-3156_segfault.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-04-detect_rundll32_application_control_bypass_-_advpack.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-04-detect_rundll32_application_control_bypass_-_setupapi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-04-detect_rundll32_application_control_bypass_-_syssetup.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-04-suspicious_rundll32_rename.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-04-suspicious_rundll32_startw.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-09-suspicious_rundll32_dllregisterserver.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-11-detect_html_help_spawn_child_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-12-detect_regasm_spawning_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-12-detect_regsvcs_spawning_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-16-detect_regasm_with_network_connection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-16-detect_regsvcs_with_network_connection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-22-aws_create_policy_version_to_allow_all_resources.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-22-cobalt_strike_named_pipes.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-22-suspicious_curl_network_connection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-22-suspicious_plistbuddy_usage_via_osquery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-22-suspicious_plistbuddy_usage.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-02-22-suspicious_sqlite3_lsquarantine_behavior.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-01-any_powershell_downloadfile.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-01-any_powershell_downloadstring.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-01-eventvwr_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-01-fodhelper_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-01-ryuk_wake_on_lan_command.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-01-suspicious_scheduled_task_from_public_directory.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-02-aws_setdefaultpolicyversion.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-02-unified_messaging_service_spawning_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-02-windows_disableantispyware_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-03-nishang_powershelltcponeline.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-03-w3wp_spawning_shell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-12-create_service_in_suspicious_file_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-12-ransomware_notes_bulk_creation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-12-resize_shadowstorage_volume.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-16-high_file_deletion_frequency.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-16-high_process_termination_frequency.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-17-clop_common_exec_parameter.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-17-clop_ransomware_known_service_name.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-17-process_deleting_its_process_file_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-23-certutil_download_with_urlcache_and_split_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-23-certutil_download_with_verifyctl_and_split_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-23-certutil_with_decode_argument.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-29-powershell_start-bitstransfer.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-aws_iam_successful_group_deletion.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disable_registry_tool.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disable_show_hidden_files.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disable_windows_behavior_monitoring.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disable_windows_smartscreen_protection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_cmd_application.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_controlpanel.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_firewall_with_netsh.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_folderoptions_windows_feature.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_norun_windows_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_systemrestore_in_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-disabling_task_manager.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-03-31-dsquery_domain_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-01-aws_iam_assume_role_policy_brute_force.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-01-aws_iam_delete_policy.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-01-aws_iam_failure_group_deletion.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-05-aws_iam_accessdenied_discovery_events.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-07-malicious_powershell_executed_as_a_service.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-08-multiple_users_failing_to_authenticate_from_host_using_kerberos.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-08-winevent_scheduled_task_created_within_public_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-12-excel_spawning_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-12-excel_spawning_windows_script_host.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-12-winevent_scheduled_task_created_to_spawn_shell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-12-winword_spawning_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-12-winword_spawning_windows_script_host.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-13-aws_excessive_security_scanning.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-13-multiple_users_attempting_to_authenticate_using_explicit_credentials.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-13-multiple_users_failing_to_authenticate_from_host_using_ntlm.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-13-multiple_users_failing_to_authenticate_from_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-13-multiple_users_remotely_failing_to_authenticate_from_host.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-13-office_application_spawn_rundll32_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-14-multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-14-multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-14-office_document_creating_schedule_task.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-14-office_document_executing_macro_code.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-15-dns_exfiltration_using_nslookup_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-15-multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-gpupdate_with_no_command_line_arguments_with_network.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-powershell_remote_thread_to_known_windows_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-schedule_task_with_http_command_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-schedule_task_with_rundll32_command_trigger.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-wermgr_process_connecting_to_ip_check_web_services.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-wermgr_process_create_executable_file.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-19-wermgr_process_spawned_cmd_or_powershell_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-21-excessive_usage_of_nslookup_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-21-multiple_archive_files_http_post_traffic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-22-anomalous_usage_of_7zip.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-22-office_product_spawning_rundll32_with_no_dll.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-22-plain_http_post_exfiltrated_data.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-22-winword_spawning_cmd.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-23-write_executable_in_smb_share.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-26-office_product_spawning_bitsadmin.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-26-office_product_spawning_certutil.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-26-office_product_spawning_mshta.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-26-trickbot_named_pipe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-29-icacls_deny_command.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-29-suspicious_driver_loaded_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-04-29-xmrig_driver_loaded.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-deleting_of_net_users.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-disabling_net_user_account.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-excessive_attempt_to_disable_services.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-excessive_service_stop_attempt.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-excessive_usage_of_taskkill.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-icacls_grant_command.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-modify_acl_permission_to_files_or_folder.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-04-process_kill_base_on_file_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-05-disable_windows_app_hotkeys.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-05-hide_user_account_from_sign-in_screen.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-05-suspicious_process_file_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-06-download_files_using_telegram.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-06-enumerate_users_local_group_using_telegram.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-06-excessive_usage_of_net_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-06-executables_or_script_creation_in_suspicious_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-07-excessive_usage_of_cacls_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-07-schtasks_run_task_on_demand.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-12-delete_shadowcopy_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-13-cmlua_or_cmstplua_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-13-detect_rclone_command-line_usage.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-13-slui_runas_elevated.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-13-slui_spawning_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-18-services_escalate_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-19-allow_inbound_traffic_in_firewall_rule.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-19-enable_rdp_in_other_port_number.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-19-mailsniper_invoke_functions.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-20-cmd_echo_pipe_-_escalation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-20-rare_parent-child_process_relationship.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-21-winrm_spawning_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-26-allow_inbound_traffic_by_firewall_rule_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-26-secretdumps_offline_ntds_dumping_tool.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-27-detect_sharphound_file_modifications.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-05-27-detect_sharphound_usage.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-01-detect_azurehound_command-line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-01-detect_azurehound_file_modifications.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-01-detect_sharphound_command-line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-02-conti_common_exec_parameter.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-02-modification_of_wallpaper.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-02-revil_common_exec_parameter.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-02-revil_registry_entry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-02-wbemprox_com_object_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-03-excessive_number_of_distinct_processes_created_in_windows_temp_folder.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-04-known_services_killed_by_ransomware.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-07-excessive_number_of_taskhost_processes.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-08-powershell_fileless_process_injection_via_getprocaddress.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-08-powershell_fileless_script_contains_base64_encoded_content.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-09-detect_empire_with_powershell_script_block_logging.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-09-detect_mimikatz_with_powershell_script_block_logging.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-09-unloading_amsi_via_reflection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-allow_operation_with_consent_admin.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-clear_unallocated_sector_using_cipher_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-disable_logs_using_wevtutil.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-permission_modification_using_takeown_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-powershell_creating_thread_mutex.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-powershell_domain_enumeration.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-powershell_loading_dotnet_into_memory_via_system_reflection_assembly.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-powershell_processing_stream_of_data.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-powershell_using_memory_as_backing_store.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-prevent_automatic_repair_mode_using_bcdedit.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-recon_avproduct_through_pwh_or_wmi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-recon_using_wmi_class.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-10-start_up_during_safe_mode_boot.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-14-deny_permission_using_cacls_utility.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-14-grant_permission_using_cacls_utility.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-14-wmi_recon_running_process_or_services.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-15-modify_acls_permission_of_files_or_folders.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-15-wevtutil_usage_to_clear_logs.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-15-wevtutil_usage_to_disable_logs.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-16-detect_wmi_event_subscription_persistence.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-17-suspicious_event_log_service_behavior.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-18-attempt_to_delete_services.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-18-attempt_to_disable_services.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-21-attacker_tools_on_endpoint.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-21-delete_a_net_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-21-disable_net_user_account.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-21-resize_shadowstorage_volume.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-22-disable_amsi_through_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-22-disable_etw_through_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-22-execute_javascript_with_jscript_com_clsid.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-22-powershell_enable_smb1protocol_feature.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-22-recursive_delete_of_directory_in_batch_cmd.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-23-allow_file_and_printing_sharing_in_firewall.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-23-allow_network_discovery_in_firewall.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-24-excessive_usage_of_sc_service_utility.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-06-25-excessive_number_of_service_control_start_as_disabled.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-print_spooler_adding_a_printer_driver.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-print_spooler_failed_to_load_a_plug-in.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-sdclt_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-silentcleanup_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-spoolsv_spawning_rundll32.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-spoolsv_suspicious_loaded_modules.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-spoolsv_suspicious_process_access.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-spoolsv_writing_a_dll_-_sysmon.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-spoolsv_writing_a_dll.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-01-wsreset_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-05-msmpeng_application_dll_side_loading.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-05-powershell_disable_security_monitoring.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-12-net_profiler_uac_bypass.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-12-uac_bypass_mmc_load_unsigned_dll.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-13-cloud_compute_instance_created_by_previously_unseen_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-aws_createaccesskey.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-aws_createloginprofile.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-aws_updateloginprofile.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-detect_new_open_s3_buckets_over_aws_cli.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-detect_new_open_s3_buckets.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-mshta_spawning_rundll32_or_regsvr32_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-o365_bypass_mfa_via_trusted_ip.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-19-office_product_spawn_cmd_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-20-detect_shared_ec2_snapshot.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-21-detect_copy_of_shadowcopy_with_script_block_logging.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-23-sam_database_file_access_attempt.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-26-rundll32_createremotethread_in_browser.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-26-rundll32_dnsquery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-26-rundll32_process_creating_exe_dll_files.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-26-suspicious_icedid_rundll32_cmdline.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-26-suspicious_rundll32_plugininit.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-27-chcp_command_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-27-suspicious_icedid_regsvr32_cmdline.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-29-rundll32_create_remote_thread_to_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-30-drop_icedid_license_dat.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-30-icedid_exfiltrated_archived_file_creation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-07-30-office_application_spawn_regsvr32_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-03-sqlite_module_in_temp_folder.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-04-create_remote_thread_in_shell_application.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-09-uninstall_app_using_msiexec.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-10-powershell_execute_com_object.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-11-fsutil_zeroing_file.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-13-uac_bypass_with_colorui_com_object.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-16-gsuite_drive_share_in_external_email.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-16-gsuite_email_suspicious_attachment.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-17-7zip_commandline_to_smb_share_path.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-17-aws_ecr_container_scanning_findings_high.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-17-aws_ecr_container_scanning_findings_low_informational_unknown.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-17-aws_ecr_container_scanning_findings_medium.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-17-gsuite_outbound_email_with_attachment_to_external_domain.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-18-esentutl_sam_copy.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-18-powershell_4104_hunting.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-19-aws_ecr_container_upload_outside_business_hours.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-19-aws_ecr_container_upload_unknown_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-19-gsuite_email_suspicious_subject_with_attachment.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-19-protocols_passing_authentication_in_cleartext.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-20-github_commit_changes_in_master.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-20-kubernetes_nginx_ingress_lfi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-getlocaluser_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-getlocaluser_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-getwmiobject_user_account_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-getwmiobject_user_account_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-gsuite_email_with_known_abuse_web_service_link.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-gsuite_suspicious_shared_file_name.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-23-kubernetes_nginx_ingress_rfi.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-adsisearcher_account_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-domain_account_discovery_with_dsquery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-domain_account_discovery_with_net_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-domain_account_discovery_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-get_aduser_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-get_aduser_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-get_domainuser_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-get_domainuser_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-get-domaintrust_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-get-domaintrust_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-getwmiobject_ds_user_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-getwmiobject_ds_user_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-24-kubernetes_scanner_image_pulling.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-domain_group_discovery_with_adsisearcher.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-domain_group_discovery_with_net.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-domain_group_discovery_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-elevated_group_discovery_with_net.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-elevated_group_discovery_with_powerview.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-elevated_group_discovery_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-getadgroup_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-getadgroup_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-getdomaingroup_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-getnettcpconnection_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-getwmiobject_ds_group_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-25-getwmiobject_ds_group_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-get_addefaultdomainpasswordpolicy_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-get_aduserresultantpasswordpolicy_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-get_aduserresultantpasswordpolicy_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-get_domainpolicy_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-get_domainpolicy_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-getdomaingroup_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-password_policy_discovery_with_net.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-26-process_creating_lnk_file_in_suspicious_location.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-27-exchange_powershell_abuse_via_ssrf.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-27-exchange_powershell_module_usage.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-30-domain_controller_discovery_with_nltest.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-30-remote_system_discovery_with_net.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-31-petitpotam_network_share_access_request.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-31-petitpotam_suspicious_kerberos_tgt_request.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-08-31-remote_system_discovery_with_dsquery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-circle_ci_disable_security_step.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-domain_controller_discovery_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-domain_group_discovery_with_dsquery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-getadcomputer_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-getwmiobject_ds_computer_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-github_commit_in_develop.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-github_dependabot_alert.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-github_pull_request_from_unknown_user.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-potential_pass_the_token_or_hash_observed_at_the_destination_device.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-remote_system_discovery_with_adsisearcher.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-01-remote_system_discovery_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-02-circle_ci_disable_security_job.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-02-get-foresttrust_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-02-get-foresttrust_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-02-getdomaincomputer_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-02-getdomaincontroller_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-06-add_defaultuser_and_password_in_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-06-auto_admin_logon_registry_entry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-06-bcdedit_command_back_to_normal_mode_boot.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-06-change_to_safe_mode_with_network_config.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-06-correlation_by_repository_and_risk.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-06-correlation_by_user_and_risk.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-getadcomputer_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-getdomaincomputer_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-getdomaincontroller_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-getwmiobject_ds_computer_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-registry_keys_used_for_persistence.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-schcache_change_by_app_connect_and_create_adsi_object.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-07-system_information_discovery_detection.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-08-control_loading_from_world_writable_directory.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-08-create_local_admin_accounts_using_net_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-08-office_spawning_control.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-08-rundll32_control_rundll_hunt.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-08-rundll32_control_rundll_world_writable_directory.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-09-extraction_of_registry_hives.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-09-mshtml_module_load_in_office_product.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-10-getnettcpconnection_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-10-network_connection_discovery_with_arp.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-10-network_connection_discovery_with_net.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-10-network_connection_discovery_with_netstat.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-10-office_product_writing_cab_or_inf.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-getcurrent_user_with_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-getcurrent_user_with_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-jscript_execution_using_cscript_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-ms_scripting_process_loading_ldap_module.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-ms_scripting_process_loading_wmi_module.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-office_application_drop_executable.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-system_user_discovery_with_query.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-system_user_discovery_with_whoami.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-user_discovery_with_env_vars_powershell_script_block.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-user_discovery_with_env_vars_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-13-xsl_script_execution_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-cmdline_tool_not_executed_in_cmd_shell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-get_wmiobject_group_discovery_with_script_block_logging.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-get_wmiobject_group_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-net_localgroup_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-powershell_get_localgroup_discovery_with_script_block_logging.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-powershell_get_localgroup_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-14-wmic_group_discovery.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-15-check_elevated_cmd_using_whoami.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-15-non_chrome_process_accessing_chrome_default_dir.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-15-non_firefox_process_access_firefox_profile_dir.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-account_discovery_with_net_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-attempt_to_add_certificate_to_untrusted_store.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-batch_file_write_to_system32.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-bits_job_persistence.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-bitsadmin_download_file.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-creation_of_shadow_copy_with_wmic_and_powershell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-credential_dumping_via_copy_command_from_shadow_copy.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-credential_dumping_via_symlink_to_shadow_copy.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_html_help_renamed.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_html_help_url_in_command_line.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_html_help_using_infotech_storage_handlers.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_mshta_inline_hta_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_mshta_renamed.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_mshta_url_in_command_line.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_psexec_with_accepteula_flag.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_renamed_7-zip.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_renamed_psexec.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_renamed_rclone.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-detect_renamed_winrar.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-dump_lsass_via_procdump.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-local_account_discovery_with_net.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-local_account_discovery_with_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-office_product_spawning_wmic.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-16-processes_launching_netsh.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-detect_regasm_with_no_command_line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-detect_regsvcs_with_no_command_line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-office_document_spawned_child_process_to_download.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-suspicious_dllhost_no_command_line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-suspicious_gpupdate_no_command_line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-suspicious_microsoft_workflow_compiler_rename.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-suspicious_rundll32_no_command_line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-20-suspicious_searchprotocolhost_no_command_line_arguments.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-21-remcos_rat_file_creation_in_remcos_folder.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-21-suspicious_image_creation_in_appdata_folder.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-21-suspicious_wav_file_in_appdata_folder.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-24-remcos_client_registry_install_entry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-27-change_default_file_association.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-27-logon_script_event_trigger_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-27-screensaver_event_trigger_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-28-active_setup_registry_autostart.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-28-print_processor_registry_autostart.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-29-disable_uac_remote_restriction.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-29-time_provider_persistence_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-09-29-verclsid_clsid_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-01-vbscript_execution_using_wscript_app.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-04-msbuild_suspicious_spawned_by_script_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-04-regsvr32_silent_param_dll_loading.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-detect_exchange_web_shell.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-disable_security_logs_using_minint_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-enable_wdigest_uselogoncredential_registry.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-malicious_inprocserver32_modification.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-malicious_powershell_process_-_connect_to_internet_with_hidden_window.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-malicious_powershell_process_-_encoded_command.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-process_writing_dynamicwrapperx.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-rundll32_shimcache_flush.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-suspicious_copy_on_system32.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-05-winhlp32_spawning_a_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-06-dns_query_length_with_high_standard_deviation.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-06-sdelete_application_execution.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-06-wscript_or_cscript_suspicious_child_process.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-07-etw_registry_disabled.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-11-suspicious_wevtutil_usage.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-13-dllhost_with_no_command_line_arguments_with_network.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-13-rundll32_with_no_command_line_arguments_with_network.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-13-searchprotocolhost_with_no_command_line_with_network.md

Merge branch 'develop' into dudewhereismydoc

2021-10-29 10:46:16 -04:00

2021-10-14-serviceprincipalnames_discovery_with_powershell.md

…

2021-10-14-serviceprincipalnames_discovery_with_setspn.md

…