Merge PR #5821 from @nasbench - Archive new rule references and update cache file
chore: archive new rule references and update cache file Co-authored-by: nasbench <nasbench@users.noreply.github.com>
This commit is contained in:
github-actions[bot]
committed by
GitHub
GitHub
parent
1cfdf4f82e
commit
8afdcc4321
@@ -410,6 +410,7 @@ https://devco.re/blog/2024/08/23/streaming-vulnerabilities-from-windows-kernel-p
|
||||
https://developer.apple.com/library/archive/documentation/MacOSX/Conceptual/BPSystemStartup/Chapters/StartupItems.html
|
||||
https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_network.html
|
||||
https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_storage.html
|
||||
https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vm.html
|
||||
https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_vsan.html
|
||||
https://developer.okta.com/docs/reference/api/event-types/
|
||||
https://developer.okta.com/docs/reference/api/system-log/
|
||||
@@ -744,6 +745,7 @@ https://evasions.checkpoint.com/techniques/macos.html
|
||||
https://f5.pm/go-59627.html
|
||||
https://fabian-voith.de/2020/06/25/sysmon-v11-1-reads-alternate-data-streams/
|
||||
https://fatrodzianko.com/2020/02/15/dll-side-loading-appverif-exe/
|
||||
https://fieldeffect.com/blog/grixba-play-ransomware-impersonates-sentinelone
|
||||
https://findingbad.blogspot.de/2017/01/hunting-what-does-it-look-like.html
|
||||
https://firewalld.org/documentation/man-pages/firewall-cmd.html
|
||||
https://forensafe.com/blogs/typedpaths.html
|
||||
@@ -869,6 +871,7 @@ https://github.com/carlospolop/PEASS-ng/blob/fa0f2e17fbc1d86f1fd66338a40e665e718
|
||||
https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
|
||||
https://github.com/CCob/MirrorDump
|
||||
https://github.com/center-for-threat-informed-defense/adversary_emulation_library/blob/bf62ece1c679b07b5fb49c4bae947fe24c81811f/fin6/Emulation_Plan/Phase1.md
|
||||
https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/personality-syscall/README.md
|
||||
https://github.com/CICADA8-Research/RemoteKrbRelay
|
||||
https://github.com/CICADA8-Research/RemoteKrbRelay/blob/19ec76ba7aa50c2722b23359bc4541c0a9b2611c/Exploit/RemoteKrbRelay/Relay/Attacks/RemoteRegistry.cs#L31-L40
|
||||
https://github.com/Cisco-Talos/IOCs/tree/80caca039988252fbb3f27a2e89c2f2917f582e0/2022/11
|
||||
@@ -1322,6 +1325,7 @@ https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742b
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-15---enumerate-domain-computers-within-active-directory-using-directorysearcher
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1018/T1018.md#atomic-test-9---remote-system-discovery---adidnsdump
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1020/T1020.md
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#atomic-test-1---rdp-to-domaincontroller
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.001/T1021.001.md#t1021001---remote-desktop-protocol
|
||||
https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1021.002/T1021.002.md#atomic-test-2---map-admin-share-powershell
|
||||
@@ -1604,6 +1608,7 @@ https://github.com/SigmaHQ/sigma/issues/253
|
||||
https://github.com/SigmaHQ/sigma/issues/3742
|
||||
https://github.com/SigmaHQ/sigma/pull/3946
|
||||
https://github.com/SigmaHQ/sigma/pull/4467
|
||||
https://github.com/SigmaHQ/sigma/pull/5724#issuecomment-3466382234
|
||||
https://github.com/skelsec/pypykatz
|
||||
https://github.com/sleventyeleven/linuxprivchecker/
|
||||
https://github.com/sleventyeleven/linuxprivchecker/blob/0d701080bbf92efd464e97d71a70f97c6f2cd658/linuxprivchecker.py
|
||||
@@ -1726,6 +1731,7 @@ https://gtfobins.github.io/gtfobins/wget/
|
||||
https://guides.lib.umich.edu/c.php?g=282942&p=1885348
|
||||
https://h.43z.one/ipconverter/
|
||||
https://hackingiscool.pl/cmdhijack-command-argument-confusion-with-path-traversal-in-cmd-exe/
|
||||
https://harfanglab.io/insidethelab/uac-0057-pressure-ukraine-poland/
|
||||
https://hashcat.net/wiki/doku.php?id=hashcat
|
||||
https://hatching.io/blog/powershell-analysis/
|
||||
https://hausec.com/2021/07/26/cobalt-strike-and-tradecraft/
|
||||
@@ -1949,6 +1955,7 @@ https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-fscc/c54dec26-1
|
||||
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pan/e44d984c-07d3-414c-8ffc-f8c8ad8512a8
|
||||
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-par/93d1915d-4d9f-4ceb-90a7-e8f2a59adc29
|
||||
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/4464eaf0-f34f-40d5-b970-736437a21913
|
||||
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rprn/d42db7d5-f141-4466-8f47-0a4be14e2fc1
|
||||
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-rrp/0fa3191d-bb79-490a-81bd-54c2601b7a78
|
||||
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/02b1f559-fda2-4ba3-94c2-806eb2777183
|
||||
https://learn.microsoft.com/en-us/outlook/troubleshoot/security/information-about-email-security-settings
|
||||
@@ -2618,6 +2625,7 @@ https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multip
|
||||
https://researchcenter.paloaltonetworks.com/2018/03/unit42-telerat-another-android-trojan-leveraging-telegrams-bot-api-to-target-iranian-users/
|
||||
https://researchcenter.paloaltonetworks.com/2018/07/unit42-upatre-continues-evolve-new-anti-analysis-techniques/
|
||||
https://resources.infosecinstitute.com/topic/netwire-malware-what-it-is-how-it-works-and-how-to-prevent-it-malware-spotlight/
|
||||
https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html
|
||||
https://rhinosecuritylabs.com/aws/aws-privilege-escalation-methods-mitigation/
|
||||
https://rhinosecuritylabs.com/research/cve-2024-1212unauthenticated-command-injection-in-progress-kemp-loadmaster/
|
||||
https://room362.com/post/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/
|
||||
@@ -3371,6 +3379,7 @@ https://web.archive.org/web/20180718061628/https://securitybytes.io/blue-team-fu
|
||||
https://web.archive.org/web/20180725233601/https://www.pwc.co.uk/cyber-security/pdf/cloud-hopper-annex-b-final.pdf
|
||||
https://web.archive.org/web/20190209154607/https://subt0x11.blogspot.com/2018/04/wmicexe-whitelisting-bypass-hacking.html
|
||||
https://web.archive.org/web/20190213114956/http://www.windowsinspired.com/understanding-the-command-line-string-and-arguments-received-by-a-windows-program/
|
||||
https://web.archive.org/web/20190508165435/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf
|
||||
https://web.archive.org/web/20190710034152/https://github.com/zerosum0x0/CVE-2019-0708
|
||||
https://web.archive.org/web/20190720093911/http://www.endurant.io/cmstp/detecting-cmstp-enabled-code-execution-and-uac-bypass-with-sysmon/
|
||||
https://web.archive.org/web/20191023232753/https://twitter.com/Hexacorn/status/1187143326673330176
|
||||
@@ -3391,6 +3400,7 @@ https://web.archive.org/web/20201124182207/https://github.com/yosqueoy/ditsnap
|
||||
https://web.archive.org/web/20210126045316/https://darrenmartyn.ie/2021/01/24/visualdoor-sonicwall-ssl-vpn-exploit/
|
||||
https://web.archive.org/web/20210511204621/https://github.com/AlsidOfficial/WSUSpendu
|
||||
https://web.archive.org/web/20210512154016/https://github.com/AlsidOfficial/WSUSpendu/blob/master/WSUSpendu.ps1
|
||||
https://web.archive.org/web/20210629055600/https://github.com/hhlxf/PrintNightmare/
|
||||
https://web.archive.org/web/20210701042336/https://github.com/afwu/PrintNightmare
|
||||
https://web.archive.org/web/20210901184449/https://www.fireeye.com/blog/threat-research/2021/09/unknown-actor-using-clfs-log-files-for-stealth.html
|
||||
https://web.archive.org/web/20220224045756/https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf
|
||||
@@ -3452,16 +3462,19 @@ https://www.anyviewer.com/help/remote-technical-support.html
|
||||
https://www.arxiv-vanity.com/papers/2008.04676/
|
||||
https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
|
||||
https://www.atomicredteam.io/atomic-red-team/atomics/T1562.002#atomic-test-8---modify-event-log-channel-access-permissions-via-registry---powershell
|
||||
https://www.atomicredteam.io/atomic-red-team/atomics/T1562.012
|
||||
https://www.autohotkey.com/download/
|
||||
https://www.autoitscript.com/site/
|
||||
https://www.beyondtrust.com/blog/entry/okta-support-unit-breach
|
||||
https://www.binarydefense.com/analysis-of-hancitor-when-boring-begets-beacon
|
||||
https://www.binarydefense.com/resources/blog/icedid-gziploader-analysis/
|
||||
https://www.bitdefender.com/en-us/blog/businessinsights/bitdefender-advisory-critical-unauthenticated-rce-windows-server-update-services-cve-2025-59287
|
||||
https://www.bitdefender.com/en-us/blog/businessinsights/shrinklocker-decryptor-from-friend-to-foe-and-back-again
|
||||
https://www.bitdefender.com/files/News/CaseStudies/study/262/Bitdefender-WhitePaper-An-APT-Blueprint-Gaining-New-Visibility-into-Financial-Threats-interactive.pdf
|
||||
https://www.bitdefender.com/files/News/CaseStudies/study/377/Bitdefender-Whitepaper-WMI-creat4871-en-EN-GenericUse.pdf
|
||||
https://www.blackhat.com/docs/asia-14/materials/Erickson/Asia-14-Erickson-Persist-It-Using-And-Abusing-Microsofts-Fix-It-Patches.pdf
|
||||
https://www.blackhat.com/presentations/bh-usa-03/bh-us-03-convery-franz-v3.pdf
|
||||
https://www.blackhillsinfosec.com/mitm6-strikes-again-the-dark-side-of-ipv6/
|
||||
https://www.blackhillsinfosec.com/my-first-joyride-with-silenttrinity/
|
||||
https://www.blackhillsinfosec.com/rogue-rdp-revisiting-initial-access-methods/
|
||||
https://www.blackhillsinfosec.com/windows-event-logs-for-red-teams/
|
||||
@@ -3744,6 +3757,7 @@ https://www.loobins.io/binaries/sysctl/#
|
||||
https://www.loobins.io/binaries/tmutil/
|
||||
https://www.lunasec.io/docs/blog/log4j-zero-day/
|
||||
https://www.makeuseof.com/how-to-install-and-use-doas/
|
||||
https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage
|
||||
https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl
|
||||
https://www.malwarebytes.com/blog/detections/pup-optional-onelaunch-silentcf
|
||||
https://www.malwarebytes.com/blog/news/2014/01/the-rtlo-method
|
||||
@@ -4147,6 +4161,7 @@ https://www.virustotal.com/gui/file/fa71eee906a7849ba3f4bab74edb577bd1f1f8397ca4
|
||||
https://www.virustotal.com/gui/file/fab408536aa37c4abc8be97ab9c1f86cb33b63923d423fdc2859eb9d63fa8ea0/community
|
||||
https://www.virustotal.com/gui/file/fc614fb4bda24ae8ca2c44e812d12c0fab6dd7a097472a35dd12ded053ab8474
|
||||
https://www.virustotal.com/gui/file/fdc86a5b3d7df37a72c3272836f743747c47bfbc538f05af9ecf78547fa2e789/behavior
|
||||
https://www.virustotal.com/gui/search/behaviour_network%253A*.miningocean.org/files
|
||||
https://www.virustotal.com/gui/search/content%253A%2522Set-MpPreference%2520-Disable%2522/files
|
||||
https://www.virustotal.com/gui/search/filename%253A*spoof*%2520filename%253A*ppid*/files
|
||||
https://www.virustotal.com/gui/search/metadata%253ACube0x0/files
|
||||
@@ -4210,6 +4225,8 @@ https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransom
|
||||
https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37
|
||||
https://x.com/_st0pp3r_/status/1742203752361128162?s=20
|
||||
https://x.com/cyb3rops/status/1862406110365245506
|
||||
https://x.com/defusedcyber/status/1971492272966598683
|
||||
https://x.com/NullSecurityX/status/1937444064867029179
|
||||
https://x.com/russianpanda9xx/status/1940831134759506029
|
||||
https://x.com/yarden_shafir/status/1822667605175324787
|
||||
https://xmrig.com/docs/miner/command-line-options
|
||||
|
||||
Reference in New Issue
Block a user