Merge PR #5806 from @nasbench - Archive New Rule References
chore: archive new rule references and update cache file --------- Co-authored-by: nasbench <nasbench@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
committed by
GitHub
GitHub
parent
685194383b
commit
6d581764e7
@@ -458,6 +458,7 @@ https://docs.aws.amazon.com/efs/latest/ug/API_DeleteFileSystem.html
|
||||
https://docs.aws.amazon.com/efs/latest/ug/API_DeleteMountTarget.html
|
||||
https://docs.aws.amazon.com/glue/latest/webapi/API_CreateDevEndpoint.html
|
||||
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-kubernetes.html#privilegeescalation-kubernetes-privilegedcontainer
|
||||
https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_suspend-disable.html
|
||||
https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html
|
||||
https://docs.aws.amazon.com/IAM/latest/APIReference/API_UpdateSAMLProvider.html
|
||||
https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
|
||||
@@ -489,6 +490,7 @@ https://docs.github.com/en/organizations/keeping-your-organization-secure/managi
|
||||
https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization
|
||||
https://docs.github.com/en/organizations/managing-oauth-access-to-your-organizations-data/disabling-oauth-app-access-restrictions-for-your-organization
|
||||
https://docs.github.com/en/organizations/managing-organization-settings/transferring-organization-ownership
|
||||
https://docs.github.com/en/repositories/archiving-a-github-repository/archiving-repositories
|
||||
https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-security-and-analysis-settings-for-your-repository
|
||||
https://docs.google.com/presentation/d/1dkrldTTlN3La-OjWtkWJBb4hVk6vfsSMBFBERs6R8zA/edit
|
||||
https://docs.google.com/spreadsheets/d/17pSTDNpa0sf6pHeRhusvWG6rThciE8CsXTSlDUAZDyo
|
||||
@@ -681,6 +683,7 @@ https://docs.microsoft.com/en-us/windows/win32/wmisdk/mofcomp
|
||||
https://docs.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
|
||||
https://docs.microsoft.com/pt-br/windows/win32/secauthz/sid-strings
|
||||
https://docs.nginx.com/nginx/admin-guide/monitoring/debugging/#enabling-core-dumps
|
||||
https://docs.oracle.com/cd/E19683-01/816-4883/6mb2joatd/index.html
|
||||
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-reference/cortex-xdr-analytics-alert-reference/scrcons-exe-rare-child-process.html
|
||||
https://docs.python.org/3/library/site.html
|
||||
https://docs.python.org/3/using/cmdline.html#cmdoption-c
|
||||
@@ -1047,6 +1050,7 @@ https://github.com/iadgov/Event-Forwarding-Guidance/tree/master/Events
|
||||
https://github.com/iagox86/dnscat2
|
||||
https://github.com/Immersive-Labs-Sec/nimbuspwn
|
||||
https://github.com/j00sean/SecBugs/tree/ff72d553f75d93e1a0652830c0f74a71b3f19c46/CVEs/CVE-2023-27363
|
||||
https://github.com/joaoviictorti/RustRedOps/tree/ce04369a246006d399e8c61d9fe0e6b34f988a49/Self_Deletion
|
||||
https://github.com/JoelGMSec/PSAsyncShell
|
||||
https://github.com/jpalanco/alienvault-ossim/blob/f74359c0c027e42560924b5cff25cdf121e5505a/os-sim/agent/src/ParserUtil.py#L951
|
||||
https://github.com/jpillora/chisel/
|
||||
@@ -1537,6 +1541,7 @@ https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T10
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1486/T1486.md
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.004/T1562.004.md#atomic-test-24---set-a-firewall-rule-using-new-netfirewallrule
|
||||
https://github.com/redcanaryco/AtomicTestHarnesses/blob/7e1e4da116801e3d6fcc6bedb207064577e40572/TestHarnesses/T1218_SignedBinaryProxyExecution/InvokeRemoteFXvGPUDisablementCommand.ps1
|
||||
https://github.com/RhinoSecurityLabs/Aggressor-Scripts/tree/master/UACBypass
|
||||
@@ -2011,6 +2016,7 @@ https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/se
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5140
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6281
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6416
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-6423
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc959352(v=technet.10)
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-2000-server/cc960241(v=technet.10)?redirectedfrom=MSDN
|
||||
https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd348773(v=ws.10)
|
||||
@@ -2038,6 +2044,7 @@ https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon#event-id-21-wmie
|
||||
https://learn.microsoft.com/en-us/troubleshoot/developer/browsers/security-privacy/ie-security-zones-registry-entries
|
||||
https://learn.microsoft.com/en-us/troubleshoot/windows-client/setup-upgrade-and-drivers/network-provider-settings-removed-in-place-upgrade
|
||||
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/netsh-advfirewall-firewall-control-firewall-behavior
|
||||
https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/overview-server-message-block-signing
|
||||
https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/remove-entries-from-remote-desktop-connection-computer
|
||||
https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kdc-event-16-27-des-encryption-disabled
|
||||
https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
|
||||
@@ -2294,6 +2301,7 @@ https://man.openbsd.org/ssh_config#LocalCommand
|
||||
https://man.openbsd.org/ssh_config#ProxyCommand
|
||||
https://man7.org/linux/man-pages/man1/ncat.1.html
|
||||
https://man7.org/linux/man-pages/man1/passwd.1.html
|
||||
https://man7.org/linux/man-pages/man2/mknod.2.html
|
||||
https://man7.org/linux/man-pages/man7/bpf-helpers.7.html
|
||||
https://man7.org/linux/man-pages/man8/getcap.8.html
|
||||
https://man7.org/linux/man-pages/man8/kmod.8.html
|
||||
@@ -2444,6 +2452,7 @@ https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
|
||||
https://oddvar.moe/2018/09/06/persistence-using-universal-windows-platform-apps-appx/
|
||||
https://okta.github.io/okta-help/en/prod/Content/Topics/Security/threat-insight/configure-threatinsight-system-log.htm
|
||||
https://old.zeek.org/zeekweek2019/slides/bzar.pdf
|
||||
https://onapsis.com/blog/active-exploitation-of-sap-vulnerability-cve-2025-31324/
|
||||
https://onedrive.live.com/view.aspx?resid=D026B4699190F1E6!2843&ithint=file%2cpptx&app=PowerPoint&authkey=!AMvCRTKB_V1J5ow
|
||||
https://opencanary.readthedocs.io/en/latest/starting/configuration.html#services-configuration
|
||||
https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
|
||||
@@ -3266,6 +3275,7 @@ https://twitter.com/shutingrz/status/1469255861394866177?s=21
|
||||
https://twitter.com/splinter_code/status/1420546784250769408
|
||||
https://twitter.com/splinter_code/status/1483815103279603714
|
||||
https://twitter.com/splinter_code/status/1519075134296006662?s=12&t=DLUXH86WtcmG_AZ5gY3C6g
|
||||
https://twitter.com/standa_t/status/1808868985678803222
|
||||
https://twitter.com/StopMalvertisin/status/1648604148848549888
|
||||
https://twitter.com/stvemillertime/status/1024707932447854592
|
||||
https://twitter.com/subTee/status/1216465628946563073
|
||||
@@ -3361,6 +3371,7 @@ https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fu
|
||||
https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
|
||||
https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
|
||||
https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
|
||||
https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
|
||||
https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
|
||||
https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
|
||||
https://web.archive.org/web/20200128160046/https://twitter.com/reegun21/status/1222093798009790464
|
||||
@@ -3396,6 +3407,7 @@ https://web.archive.org/web/20220830134315/https://content.fireeye.com/apt-41/rp
|
||||
https://web.archive.org/web/20221019044836/https://nsudo.m2team.org/en-us/
|
||||
https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
|
||||
https://web.archive.org/web/20230208123920/https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for_22.html
|
||||
https://web.archive.org/web/20230217071802/https://blooteem.com/march-2022
|
||||
https://web.archive.org/web/20230329153811/https://blog.menasec.net/2019/02/threat-huting-10-impacketsecretdump.html
|
||||
https://web.archive.org/web/20230329155141/https://blog.menasec.net/2019/03/threat-hunting-26-remote-windows.html
|
||||
https://web.archive.org/web/20230329170326/https://blog.menasec.net/2019/02/threat-hunting-21-procdump-or-taskmgr.html
|
||||
@@ -3436,6 +3448,7 @@ https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-grou
|
||||
https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies
|
||||
https://www.anomali.com/blog/pulling-linux-rabbit-rabbot-malware-out-of-a-hat
|
||||
https://www.anquanke.com/post/id/226029
|
||||
https://www.anyviewer.com/help/remote-technical-support.html
|
||||
https://www.arxiv-vanity.com/papers/2008.04676/
|
||||
https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
|
||||
https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
|
||||
@@ -3444,6 +3457,7 @@ https://www.autoitscript.com/site/
|
||||
https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
|
||||
https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon
|
||||
https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
|
||||
https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
|
||||
https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
|
||||
https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
|
||||
https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf
|
||||
@@ -3582,6 +3596,7 @@ https://www.elastic.co/guide/en/security/current/windows-service-installed-via-a
|
||||
https://www.elastic.co/security-labs/a-peek-behind-the-bpfdoor
|
||||
https://www.elastic.co/security-labs/exploring-the-qbot-attack-pattern
|
||||
https://www.elastic.co/security-labs/exploring-the-ref2731-intrusion-set
|
||||
https://www.elastic.co/security-labs/grimresource
|
||||
https://www.elastic.co/security-labs/Hunting-for-Suspicious-Windows-Libraries-for-Execution-and-Evasion
|
||||
https://www.elastic.co/security-labs/operation-bleeding-bear
|
||||
https://www.elastic.co/security-labs/stopping-vulnerable-driver-attacks
|
||||
|
||||
Reference in New Issue
Block a user