P4T12ICK 15a3dfed60 detection tests

2020-11-03 17:04:53 +01:00

..

access_lsass_memory_for_dump_creation.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

attempt_to_add_certificate_to_untrusted_store.test.yml

detection tests

2020-11-03 17:04:53 +01:00

attempted_credential_dump_from_registry_via_reg_exe___ssa.test.yml

multiple tests supported + output validation

2020-10-22 12:47:15 -07:00

attempted_credential_dump_from_registry_via_reg_exe.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

create_local_admin_accounts_using_net_exe.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

create_remote_thread_into_lsass.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

creation_of_shadow_copy_with_wmic_and_powershell.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

creation_of_shadow_copy.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

credential_dumping_via_copy_command_from_shadow_copy.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

credential_dumping_via_symlink_to_shadow_copy.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

detect_activity_related_to_pass_the_hash_attacks.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

detect_credential_dumping_through_lsass_access.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

detect_dump_lsass_memory_using_comsvcs___ssa.test.yml

multiple tests supported + output validation

2020-10-22 12:47:15 -07:00

detect_new_local_admin_account.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

detect_path_interception_by_creation_of_program_exe.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

detect_prohibited_applications_spawning_cmd_exe.test.yml

fixed tests

2020-10-22 14:30:14 -07:00

dump_lsass_via_comsvcs_dll.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

first_time_seen_cmd_line___ssa.test.yml

fixed tests

2020-10-22 14:30:14 -07:00

kerberoasting_spn_request_with_rc4_encryption.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

malicious_powershell_process___encoded_command.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

process_execution_via_wmi.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

prohibited_apps_spawning_cmdprompt___ssa.test.yml

fixed tests

2020-10-22 14:30:14 -07:00

rare_parent_process_relationship_lolbas___ssa.test.yaml

fixed pass condition

2020-10-22 16:30:17 -07:00

schtasks_scheduling_job_on_remote_system.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

short_lived_windows_accounts.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

suspicious_reg_exe_process.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

system_information_discovery_detection.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

unload_sysmon_filter_driver.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

unsigned_image_loaded_by_lsass.test.yml

new format for test files

2020-10-30 09:11:41 +01:00

unusual_lolbas_in_short_period_of_time___ssa.test.yml

fixed tests

2020-10-22 14:30:14 -07:00

unusually_long_command_line___ssa.test.yml

fixed tests

2020-10-22 14:30:14 -07:00

windows_event_log_cleared.test.yml

new format for test files

2020-10-30 09:11:41 +01:00