Merge PR #5230 from @nasbench - Archive new rule references and update cache file

Co-authored-by: nasbench <nasbench@users.noreply.github.com>

.github/latest_archiver_output.md

@@ -1,501 +1,489 @@
 # Reference Archiver Results
 
-Last Execution: 2025-03-01 02:09:11
+Last Execution: 2025-03-15 02:04:54
 
 ### Archiver Script Results
 
 
 #### Newly Archived References
 
-- https://web.archive.org/web/20230329155141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html
+- https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
 
 #### Already Archived References
 
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
+- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management
-- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
-- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/
+- https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
-- https://www.agnosticdev.com/content/how-diagnose-app-transport-security-issues-using-nscurl-and-openssl
+- https://learn.microsoft.com/en-us/windows/client-management/manage-recall
-- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking
+- https://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
-- https://twitter.com/1ZRR4H/status/1537501582727778304
+- https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
-- https://trustedsec.com/blog/oops-i-udld-it-again
+- https://asec.ahnlab.com/en/61000/
-- https://tria.ge/240123-rapteaahhr/behavioral1
+- https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
-- https://learn.microsoft.com/en-us/azure/dns/dns-zones-records
+- https://gtfobins.github.io/gtfobins/flock/#shell
-- https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
+- https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
+- https://twitter.com/Kostastsale/status/1646256901506605063?s=20
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure#conditional-access
+- https://adsecurity.org/?p=3513
-- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_ImportKeyPair.html
+- https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
-- https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-microsoft-windows-certificationauthority/
+- https://twitter.com/TheDFIRReport/status/1482078434327244805
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address
+- https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05
-- https://github.com/GhostPack/SharpDPAPI
+- https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
+- https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/
 
 #### Error While Archiving References
 
-- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
-- https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
-- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
-- https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
-- https://bazaar.abuse.ch/browse/tag/one/
-- https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
-- https://redcanary.com/blog/threat-detection/process-masquerading/
-- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
-- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
-- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743
-- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
-- https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
-- https://gtfobins.github.io/gtfobins/rsync/#shell
-- https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
-- https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
-- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
-- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management
-- https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
-- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
-- https://www.linkedin.com/feed/update/urn:li:ugcPost:7257437202706493443?commentUrn=urn%3Ali%3Acomment%3A%28ugcPost%3A7257437202706493443%2C7257522819985543168%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287257522819985543168%2Curn%3Ali%3AugcPost%3A7257437202706493443%29
-- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
-- https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf
-- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
-- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
-- https://github.com/grayhatkiller/SharpExShell
-- https://ss64.com/osx/sw_vers.html
-- https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
-- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
-- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
-- https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
-- https://www.tarasco.org/security/pwdump_7/
-- https://github.com/0xthirteen/SharpMove/
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
-- https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
-- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
-- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel
-- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
-- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
-- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
-- https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
-- https://www.loobins.io/binaries/tmutil/
-- https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
-- https://tria.ge/240731-jh4crsycnb/behavioral2
-- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication
 - http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
-- https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
+- https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia
+- https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#impossible-travel
+- https://gtfobins.github.io/gtfobins/git/#shell
+- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
+- https://www.loobins.io/binaries/xattr/
+- https://github.com/varwara/CVE-2024-35250
+- https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/
+- https://asec.ahnlab.com/en/40263/
+- https://intezer.com/wp-content/uploads/2021/09/TeamTNT-Cryptomining-Explosion.pdf
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
+- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
+- https://web.archive.org/web/20220519091349/https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
+- https://github.com/sadshade/veeam-creds/blob/6010eaf31ba41011b58d6af3950cffbf6f5cea32/Veeam-Get-Creds.ps1
+- https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
 - http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
-- https://redcanary.com/blog/msix-installers/
+- https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_22.12.2023.txt
-- https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/
+- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/
-- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
+- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
-- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html
+- https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
-- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
+- https://blog.talosintelligence.com/uat-5647-romcom/
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
+- https://ipurple.team/2024/07/15/sharphound-detection/
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
+- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
-- https://www.loobins.io/binaries/nscurl/
+- https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers
-- https://github.com/ossec/ossec-hids/blob/master/etc/rules/syslog_rules.xml
+- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
-- https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
+- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
-- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+- https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
+- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
-- https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
+- https://x.com/Max_Mal_/status/1826179497084739829
-- https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091
+- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
-- https://github.com/gentilkiwi/mimikatz
+- https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258
-- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
+- https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
-- https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
+- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
-- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
+- https://x.com/_st0pp3r_/status/1742203752361128162?s=20
-- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
+- https://cloud.google.com/access-context-manager/docs/audit-logging
-- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
+- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
-- https://gtfobins.github.io/gtfobins/gcc/#shell
-- https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
-- https://boinc.berkeley.edu/
-- https://www.group-ib.com/resources/threat-research/red-curl-2.html
-- https://www.huntress.com/blog/attacking-mssql-servers
-- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
-- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
-- https://www.loobins.io/binaries/pbpaste/
-- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
-- https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html
-- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
-- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
-- https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
-- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
-- https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns
-- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
-- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
-- https://tria.ge/240521-ynezpagf56/behavioral1
-- https://web.archive.org/web/20231210115125/http://www.xuetr.com/
-- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea
-- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
-- https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32
-- https://github.com/embedi/CVE-2017-11882
-- https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
-- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
-- https://media.defense.gov/2021/Jul/19/2002805003/-1/-1/1/CSA_CHINESE_STATE-SPONSORED_CYBER_TTPS.PDF
-- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
-- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
-- https://megatools.megous.com/
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
-- https://news.ycombinator.com/item?id=29504755
-- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/
-- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
-- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
-- https://paper.seebug.org/1495/
-- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/
-- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
-- https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
-- https://gtfobins.github.io/gtfobins/capsh/#shell
-- https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
-- https://tria.ge/220422-1pw1pscfdl/
-- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
-- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
-- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
-- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
-- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
-- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
-- https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10
-- https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934
-- https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
-- https://learn.microsoft.com/en-us/windows/client-management/manage-recall
-- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
 - https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634
+- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
+- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
-- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
+- https://www.huntress.com/blog/attacking-mssql-servers
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
+- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
+- https://strontic.github.io/xcyclopedia/library/aclui.dll-F883E9CA757B622B032FDCA5BF33D0DF.html
+- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
+- https://gtfobins.github.io/gtfobins/rsync/#shell
+- https://bazaar.abuse.ch/browse/tag/one/
+- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+- https://man.freebsd.org/cgi/man.cgi?pwd_mkdb
+- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
+- https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
+- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+- https://unit42.paloaltonetworks.com/chromeloader-malware/
+- https://www.loobins.io/binaries/pbpaste/
+- https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
+- https://www.cyberciti.biz/faq/how-force-kill-process-linux/
+- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
+- https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
+- https://www.cve.org/CVERecord?id=CVE-2024-1709
+- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
+- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
+- https://learn.microsoft.com/en-us/windows/win32/api/shobjidl_core/nn-shobjidl_core-iexecutecommand
+- https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
 - https://cloud.google.com/logging/docs/audit/understanding-audit-logs
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183
+- https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-proxying-to-kernel-part1-en/
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
+- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
+- https://learn.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
+- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
+- https://ss64.com/mac/chflags.html
+- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
+- https://github.com/ossec/ossec-hids/blob/master/etc/rules/syslog_rules.xml
+- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
+- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
+- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
+- https://x.com/cyb3rops/status/1862406110365245506
+- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
+- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+- https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
+- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators
+- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
+- https://gtfobins.github.io/gtfobins/gcc/#shell
+- https://tria.ge/231023-lpw85she57/behavioral2
+- https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
+- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector
+- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef
+- https://redcanary.com/blog/threat-detection/process-masquerading/
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
+- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
+- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
+- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
+- https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
+- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
+- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
+- https://github.com/grayhatkiller/SharpExShell
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
+- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
+- https://www.linkedin.com/feed/update/urn:li:ugcPost:7257437202706493443?commentUrn=urn%3Ali%3Acomment%3A%28ugcPost%3A7257437202706493443%2C7257522819985543168%29&dashCommentUrn=urn%3Ali%3Afsd_comment%3A%287257522819985543168%2Curn%3Ali%3AugcPost%3A7257437202706493443%29
+- https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
+- https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934
+- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
+- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
+- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
+- https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
+- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
+- https://gist.github.com/Neo23x0/a20436375a1e26524931dd8ea1a3af10
+- https://www.attackiq.com/2023/09/20/emulating-rhysida/
+- https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
+- https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel
+- https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
+- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
+- https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
+- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
+- https://ss64.com/nt/set.html
+- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
+- https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
+- https://github.com/gentilkiwi/mimikatz
+- https://x.com/Threatlabz/status/1879956781360976155
+- https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
+- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
+- https://www.loobins.io/binaries/nscurl/
+- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
+- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
+- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
+- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
+- https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
+- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/rundll32
+- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
+- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
+- https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
+- https://megatools.megous.com/
+- https://twitter.com/th3_protoCOL/status/1536788652889497600
+- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
+- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
+- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup
+- https://www.loobins.io/binaries/tmutil/
+- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
+- https://github.com/0xthirteen/SharpMove/
+- https://learn.microsoft.com/en-us/windows/win32/msi/event-logging
+- https://objective-see.org/blog/blog_0x6D.html
+- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
+- https://www.fortiguard.com/psirt/FG-IR-22-398
+- https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
+- https://learn.microsoft.com/en-us/windows/win32/shell/app-registration
+- https://tria.ge/240521-ynezpagf56/behavioral1
+- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
+- https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
+- https://redcanary.com/blog/msix-installers/
+- https://twitter.com/standa_t/status/1808868985678803222
+- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
+- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token
+- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
+- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
+- https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
+- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
+- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
+- https://www.youtube.com/watch?v=uSYvHUVU8xY
+- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
+- https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
+- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/
 - https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior
 - https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
-- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
+- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
-- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
+- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
-- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/
-- https://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
-- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
-- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
-- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
-- https://twitter.com/TheDFIRReport/status/1482078434327244805
-- https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
-- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
-- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
-- https://www.softperfect.com/products/networkscanner/
-- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
-- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
-- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
-- https://www.trendmicro.com/en_us/research/18/d/new-macos-backdoor-linked-to-oceanlotus-found.html
-- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
-- https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
-- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
-- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector
-- https://linux.die.net/man/1/arecord
-- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
-- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
-- https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
-- https://twitter.com/Kostastsale/status/1480716528421011458
-- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
-- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
-- https://x.com/cyb3rops/status/1862406110365245506
-- https://objective-see.org/blog/blog_0x6D.html
-- https://twitter.com/standa_t/status/1808868985678803222
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
-- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently
-- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
-- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
-- https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response
-- https://ss64.com/nt/set.html
-- https://ss64.com/mac/chflags.html
-- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
-- https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/
-- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
-- https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
-- https://labs.nettitude.com/blog/introducing-sharpwsus/
-- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
-- https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
-- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
-- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
-- https://gtfobins.github.io/gtfobins/find/#shell
-- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
-- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
-- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
-- https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/set-executionpolicy?view=powershell-7.4
-- https://www.sans.org/blog/defending-against-scattered-spider-and-the-com-with-cybercrime-intelligence/
-- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding
-- https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
-- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
-- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
-- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
-- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/
-- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
-- https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
-- https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
-- https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure
-- https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
-- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
-- https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
-- https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
-- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
-- https://twitter.com/th3_protoCOL/status/1480621526764322817
-- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
-- https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
-- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
-- https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
-- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities
-- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
-- https://blog.talosintelligence.com/uat-5647-romcom/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
-- https://www.attackiq.com/2023/09/20/emulating-rhysida/
-- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
-- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
-- https://www.loobins.io/binaries/xattr/
-- https://twitter.com/th3_protoCOL/status/1536788652889497600
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
-- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script
-- https://tria.ge/231212-r1bpgaefar/behavioral2
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
-- https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
-- https://learn.microsoft.com/en-us/defender-cloud-apps/policy-template-reference
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
-- https://www.elastic.co/guide/en/security/current/linux-restricted-shell-breakout-via-linux-binary-s.html
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anomalous-token
-- https://github.com/elddy/NimScan
-- https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details
-- https://gtfobins.github.io/gtfobins/git/#shell
-- https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
-- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
-- https://twitter.com/Kostastsale/status/1646256901506605063?s=20
-- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
-- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
-- https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
-- https://github.com/Ylianst/MeshAgent
-- https://ipurple.team/2024/07/15/sharphound-detection/
-- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
-- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
 - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-drsr/f977faaa-673e-4f66-b9bf-48c640241d47?redirectedfrom=MSDN
-- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
-- https://gtfobins.github.io/gtfobins/nawk/#shell
-- https://x.com/_st0pp3r_/status/1742203752361128162?s=20
-- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts
-- https://github.com/nasbench/Misc-Research/blob/8ee690e43a379cbce8c9d61107442c36bd9be3d3/Other/Undocumented-Flags-Sdbinst.md
-- https://github.com/ricardojoserf/NativeDump/blob/01d8cd17f31f51f5955a38e85cd3c83a17596175/NativeDump/Program.cs#L258
-- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
-- https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
-- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
-- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
-- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
-- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
-- https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05
-- https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage
-- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
-- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef
-- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malicious-ip-address
-- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
-- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
-- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
-- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
-- https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/
-- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
-- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
-- https://objective-see.org/blog/blog_0x1E.html
-- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
-- https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/
-- https://unit42.paloaltonetworks.com/chromeloader-malware/
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
-- https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
-- https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
-- https://strontic.github.io/xcyclopedia/library/aclui.dll-F883E9CA757B622B032FDCA5BF33D0DF.html
-- https://x.com/cyberfeeddigest/status/1887041526397587859
-- https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038
-- https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
-- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
-- https://www.cisco.com/c/en/us/td/docs/ios/12_2sr/12_2sra/feature/guide/srmgtint.html#wp1127609
-- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
-- https://blog.sekoia.io/scattered-spider-laying-new-eggs/
-- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
-- https://www.group-ib.com/blog/apt41-world-tour-2021/
-- https://twitter.com/DTCERT/status/1712785421845790799
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
-- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wmic
-- https://gtfobins.github.io/gtfobins/gawk/#shell
-- https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/
-- https://tria.ge/240307-1hlldsfe7t/behavioral2/analog?main_event=Registry&op=SetValueKeyInt
-- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-backup
-- https://www.cyberciti.biz/faq/how-force-kill-process-linux/
-- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist#disable-quick-assist-within-your-organization
-- https://symantec-enterprise-blogs.security.com/threat-intelligence/harvester-new-apt-attacks-asia
-- https://tria.ge/231023-lpw85she57/behavioral2
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-start-recovery
-- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
-- https://www.qemu.org/docs/master/system/invocation.html#hxtool-5
-- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
-- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
-- https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
-- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
-- https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
-- https://x.com/Threatlabz/status/1879956781360976155
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
-- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
-- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
-- https://docs.aws.amazon.com/lambda/latest/dg/API_CreateFunctionUrlConfig.html
-- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4
-- https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm
-- https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
-- https://github.com/CICADA8-Research/RemoteKrbRelay
-- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
-- https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
-- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
-- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
-- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
-- https://web.archive.org/web/20230420013146/http://security-research.dyndns.org/pub/slides/FIRST2017/FIRST-2017_Tom-Ueltschi_Sysmon_FINAL_notes.pdf
-- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
-- https://strontic.github.io/xcyclopedia/library/mode.com-59D1ED51ACB8C3D50F1306FD75F20E99.html
-- https://asec.ahnlab.com/en/61000/
-- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
-- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
-- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
-- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/
-- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
-- https://twitter.com/NathanMcNulty/status/1785051227568632263
-- https://man.freebsd.org/cgi/man.cgi?pwd_mkdb
-- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
-- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
-- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
-- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
-- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
-- https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
-- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin-delete-systemstatebackup
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
-- https://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
-- https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
-- https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade
-- https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
-- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
-- https://ngrok.com/blog-post/new-ngrok-domains
-- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
-- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
-- https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
-- https://asec.ahnlab.com/en/40263/
-- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794
-- https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
-- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
-- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
-- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
-- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
-- https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38
-- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
-- https://intel.thedfirreport.com/eventReports/view/70
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials
-- https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
-- https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_22.12.2023.txt
-- https://ssd-disclosure.com/ssd-advisory-common-log-file-system-clfs-driver-pe/
-- https://twitter.com/Cryptolaemus1/status/1517634855940632576
-- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
-- https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
-- https://adsecurity.org/?p=1785
-- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
-- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
-- https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
-- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
-- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
-- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
-- https://cloud.google.com/access-context-manager/docs/audit-logging
-- https://www.cyberciti.biz/faq/linux-remove-user-command/
-- https://gtfobins.github.io/gtfobins/flock/#shell
-- https://github.com/rapid7/metasploit-framework/issues/11337
-- https://www.youtube.com/watch?v=uSYvHUVU8xY
-- https://www.anyviewer.com/help/remote-technical-support.html
-- https://www.fortiguard.com/psirt/FG-IR-22-398
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183
-- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
-- https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/
-- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
-- https://x.com/Max_Mal_/status/1826179497084739829
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
-- https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
-- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
-- https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
-- https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
-- https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
-- https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user
-- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit
-- https://github.com/logangoins/Krueger/tree/main
-- https://tria.ge/240226-fhbe7sdc39/behavioral1
-- https://github.com/xephora/Threat-Remediation-Scripts/tree/main/Threat-Track/CS_INSTALLER
-- https://www.ultimatewindowssecurity.com/wiki/page.aspx?spid=NSrpcservers
-- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
-- https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
-- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
-- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
-- https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
-- https://docs.microsoft.com/en-us/sql/tools/bcp-utility
-- https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
-- https://localtonet.com/documents/supported-tunnels
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
-- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
-- https://www.loobins.io/binaries/launchctl/
-- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
-- https://github.com/varwara/CVE-2024-35250
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7.4
-- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
-- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel
-- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
-- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
-- https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
 - https://trustedsec.com/blog/specula-turning-outlook-into-a-c2-with-one-registry-change
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706
+- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
-- https://www.cve.org/CVERecord?id=CVE-2024-1709
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
-- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#there-are-too-many-global-administrators
+- https://app.any.run/tasks/fa99cedc-9d2f-4115-a08e-291429ce3692
-- https://adsecurity.org/?p=3513
+- https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
-- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
+- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
-- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012
+- https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
-- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
+- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
+- https://intezer.com/blog/research/how-we-escaped-docker-in-azure-functions/
+- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
+- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
+- https://twitter.com/NathanMcNulty/status/1785051227568632263
+- https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
+- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
+- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
+- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
+- https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
+- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
+- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
+- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#malware-linked-ip-address-deprecated
+- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
+- https://unit42.paloaltonetworks.com/snipbot-romcom-malware-variant/
 - https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_IncludeUnspecifiedLocalSites
+- https://blog.eclecticiq.com/sandworm-apt-targets-ukrainian-users-with-trojanized-microsoft-kms-activation-tools-in-cyber-espionage-campaigns
+- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage
+- https://x.com/cyberfeeddigest/status/1887041526397587859
+- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
+- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
 - https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
+- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-lambda-privesc
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
+- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634
+- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
+- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
+- https://tria.ge/240731-jh4crsycnb/behavioral2
+- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
+- https://github.com/Ylianst/MeshAgent
+- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
+- https://www.virustotal.com/gui/file/ded20df574b843aaa3c8e977c2040e1498ae17c12924a19868df5b12dee6dfdd
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4743
+- https://learn.microsoft.com/en-us/windows/win32/amsi/how-amsi-helps
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
+- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
+- https://web.archive.org/web/20231230220738/https://www.lunasec.io/docs/blog/log4j-zero-day/
+- https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
+- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
+- https://ngrok.com/blog-post/new-ngrok-domains
+- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
 - https://learn.microsoft.com/en-us/windows/win32/shell/launch
-- https://intel.thedfirreport.com/events/view/30032
+- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
+- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
+- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
+- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038
+- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
+- https://github.com/CICADA8-Research/RemoteKrbRelay
+- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
+- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
+- https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
+- https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
+- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
+- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
+- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/
+- https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
+- https://www.tarasco.org/security/pwdump_7/
+- https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fundamentals-part-two-windows-processes-759fe15965e2
+- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#azure-ad-threat-intelligence-user
+- https://web.archive.org/web/20230726144748/https://blog.thickmints.dev/mintsights/detecting-rogue-rdp/
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#suspicious-inbox-forwarding
+- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/send-mailmessage?view=powershell-7.4
+- https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
+- https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade
+- https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
+- https://learn.microsoft.com/en-us/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-process-creations-originating-from-psexec-and-wmi-commands
+- https://learn.microsoft.com/en-us/windows/win32/adschema/attributes-all
+- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
+- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
+- https://www.cyberciti.biz/faq/linux-remove-user-command/
+- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
+- https://twitter.com/DTCERT/status/1712785421845790799
+- https://twitter.com/Kostastsale/status/1480716528421011458
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
+- https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
+- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
+- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
+- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
+- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
+- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
+- https://thehackernews.com/2024/03/github-rolls-out-default-secret.html
+- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
+- https://decoded.avast.io/janvojtesek/raspberry-robins-roshtyak-a-little-lesson-in-trickery/
+- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
+- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
+- https://tria.ge/240225-jlylpafb24/behavioral1/analog?main_event=Registry&op=SetValueKeyInt
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
+- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
+- https://blog.morphisec.com/vmware-identity-manager-attack-backdoor
+- https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage
+- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
+- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
+- https://www.group-ib.com/blog/apt41-world-tour-2021/
+- https://gtfobins.github.io/gtfobins/capsh/#shell
+- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
+- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
+- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4706
+- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist#disable-quick-assist-within-your-organization
+- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
+- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
+- https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
+- https://research.splunk.com/endpoint/07921114-6db4-4e2e-ae58-3ea8a52ae93f/
+- https://www.virustotal.com/gui/file/91e405e8a527023fb8696624e70498ae83660fe6757cef4871ce9bcc659264d3/details
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
+- https://web.archive.org/web/20230329172447/https://blog.menasec.net/2019/02/threat-hunting-24-microsoft-windows-dns.html
+- https://ss64.com/osx/sw_vers.html
+- https://github.com/LOLBAS-Project/LOLBAS/blob/2cc01b01132b5c304027a658c698ae09dd6a92bf/yml/OSBinaries/Wbadmin.yml
+- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
+- https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
+- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
+- https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials
+- https://www.softperfect.com/products/networkscanner/
+- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
+- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
+- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
+- https://intel.thedfirreport.com/eventReports/view/70
+- https://thehackernews.com/2024/12/cisa-and-fbi-raise-alerts-on-exploited.html
+- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
+- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
+- https://www.cloudcoffee.ch/microsoft-365/configure-windows-laps-in-microsoft-intune/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
+- https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rpt-apt41/
+- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
+- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
+- https://linux.die.net/man/1/arecord
+- https://www.anyviewer.com/help/remote-technical-support.html
+- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
+- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
+- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
+- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5012
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
+- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
 - https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
-- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
+- https://intel.thedfirreport.com/events/view/30032
+- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
+- https://web.archive.org/web/20231210115125/http://www.xuetr.com/
+- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
+- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
+- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
+- https://learn.microsoft.com/en-us/iis/configuration/system.applicationhost/sites/sitedefaults/logfile/
+- https://media.defense.gov/2021/Jul/19/2002805003/-1/-1/1/CSA_CHINESE_STATE-SPONSORED_CYBER_TTPS.PDF
+- https://www.microsoft.com/en-us/security/blog/2024/07/29/ransomware-operators-exploit-esxi-hypervisor-vulnerability-for-mass-encryption/
+- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
+- https://gtfobins.github.io/gtfobins/nawk/#shell
+- https://localtonet.com/documents/supported-tunnels
+- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
+- https://github.com/logangoins/Krueger/tree/main
+- https://learn.microsoft.com/en-us/powershell/module/nettcpip/test-netconnection?view=windowsserver2022-ps
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
+- https://www.spamhaus.org/reputation-statistics/cctlds/domains/
+- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations
+- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html
+- https://twitter.com/Cryptolaemus1/status/1517634855940632576
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country
+- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
+- https://blog.sekoia.io/scattered-spider-laying-new-eggs/
+- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-script
+- https://boinc.berkeley.edu/
+- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
+- https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://paper.seebug.org/1495/
+- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
+- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
+- https://web.archive.org/web/20231221193106/https://www.swascan.com/cactus-ransomware-malware-analysis/
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4794
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
+- https://docs.microsoft.com/en-us/sql/tools/bcp-utility
+- https://learn.microsoft.com/en-us/entra/identity/monitoring-health/reference-audit-activities#core-directory
+- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm
+- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
+- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
+- https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
+- https://github.com/embedi/CVE-2017-11882
+- https://gist.github.com/mgeeky/3b11169ab77a7de354f4111aa2f0df38
+- https://objective-see.org/blog/blog_0x1E.html
+- https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/quick-start/enable-hyper-v
+- https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure
+- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
+- https://tria.ge/220422-1pw1pscfdl/
+- https://www.proofpoint.com/us/blog/threat-insight/serpent-no-swiping-new-backdoor-targets-french-entities-unique-attack-chain
+- https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091
+- https://learn.microsoft.com/en-us/windows/win32/secauthz/security-descriptor-definition-language
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
+- https://github.com/rapid7/metasploit-framework/issues/11337
+- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-info.js#L55
+- https://twitter.com/th3_protoCOL/status/1480621526764322817
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
+- https://news.ycombinator.com/item?id=29504755
+- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit
+- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_ProxyByPass
+- https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
+- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently
+- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
+- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
+- https://www.qemu.org/docs/master/system/invocation.html#hxtool-5
+- https://adsecurity.org/?p=1785
+- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
+- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.utility/invoke-expression?view=powershell-7.2
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
+- https://www.trustedsec.com/blog/critical-vulnerability-in-progress-moveit-transfer-technical-analysis-and-recommendations/
+- https://tria.ge/240226-fhbe7sdc39/behavioral1
+- https://github.com/elddy/NimScan
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts
+- https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf
+- https://www.group-ib.com/resources/threat-research/red-curl-2.html
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/schtasks-create
+- https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html
+- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
+- https://labs.nettitude.com/blog/introducing-sharpwsus/
+- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
+- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
+- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
+- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
+- https://gtfobins.github.io/gtfobins/gawk/#shell
+- https://gtfobins.github.io/gtfobins/find/#shell
+- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
+- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
+- https://www.huntress.com/blog/threat-advisory-oh-no-cleo-cleo-software-actively-being-exploited-in-the-wild
+- https://tria.ge/231212-r1bpgaefar/behavioral2
+- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
 - https://kubernetes.io/docs/tasks/manage-kubernetes-objects/update-api-object-kubectl-patch
+- https://www.loobins.io/binaries/launchctl/
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
+- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+- https://intel.thedfirreport.com/eventReports/view/57
+- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
+- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
+- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension

tests/rule-references.txt

@@ -3993,3 +3993,21 @@ https://www.gradenegger.eu/en/details-of-the-event-with-id-53-of-the-source-micr
 https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#anonymous-ip-address
 https://github.com/GhostPack/SharpDPAPI
 https://web.archive.org/web/20230329155141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html
+https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-assigned-outside-of-privileged-identity-management
+https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/chcp
+https://confluence.atlassian.com/bitbucketserver/enable-ssh-access-to-git-repositories-776640358.html
+https://learn.microsoft.com/en-us/windows/client-management/manage-recall
+https://www.linkedin.com/feed/update/urn:li:activity:7282295814792605698/
+https://learn.microsoft.com/en-us/powershell/module/storage/mount-diskimage?view=windowsserver2022-ps
+https://asec.ahnlab.com/en/61000/
+https://github.com/PwC-IR/Business-Email-Compromise-Guide/blob/fe29ce06aef842efe4eb448c26bbe822bf5b895d/PwC-Business_Email_Compromise-Guide.pdf
+https://gtfobins.github.io/gtfobins/flock/#shell
+https://www.datadoghq.com/blog/monitor-kubernetes-audit-logs/#monitor-api-authentication-issues
+https://twitter.com/Kostastsale/status/1646256901506605063?s=20
+https://adsecurity.org/?p=3513
+https://blackpointcyber.com/resources/blog/breaking-through-the-screen/
+https://twitter.com/TheDFIRReport/status/1482078434327244805
+https://www.virustotal.com/gui/file/6f0f20da34396166df352bf301b3c59ef42b0bc67f52af3d541b0161c47ede05
+https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
+https://research.nccgroup.com/2022/07/13/climbing-mount-everest-black-byte-bytes-back/
+https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html