From cf68547b29cae8368ff55f8707dab6453b6f49c8 Mon Sep 17 00:00:00 2001 From: "github-actions[bot]" <41898282+github-actions[bot]@users.noreply.github.com> Date: Mon, 4 May 2026 12:33:04 +0200 Subject: [PATCH] Merge PR #5974 from @nasbench - Archive new rule references and update cache file chore: archive new rule references and update cache file Co-authored-by: nasbench --- .github/latest_archiver_output.md | 1216 +++++++++++++++-------------- tests/rule-references.txt | 18 + 2 files changed, 644 insertions(+), 590 deletions(-) diff --git a/.github/latest_archiver_output.md b/.github/latest_archiver_output.md index 9d4c06f34..5230ee948 100644 --- a/.github/latest_archiver_output.md +++ b/.github/latest_archiver_output.md @@ -1,621 +1,657 @@ # Reference Archiver Results -Last Execution: 2026-04-15 02:21:42 +Last Execution: 2026-05-01 02:22:17 ### Archiver Script Results #### Newly Archived References -- https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/bun_environment.js +N/A #### Already Archived References -- https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3 -- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install -- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting -- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm -- https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal -- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7 -- https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/ -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771 -- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python -- https://intel.thedfirreport.com/eventReports/view/57 -- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys -- https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/ -- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon -- https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/ -- https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004 +- https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/ +- https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity +- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef +- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking +- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html +- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11 +- https://woshub.com/disable-credential-guard-windows/ +- https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps +- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/ +- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/ +- https://github.com/CoreyCBurton/DripLoaderNG +- https://x.com/0x534c/status/1944694507787710685 +- https://github.com/Nightmare-Eclipse/RedSun +- https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html +- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ +- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event +- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration #### Error While Archiving References -- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/ -- https://www.cyberciti.biz/faq/linux-remove-user-command/ -- https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory -- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/ -- https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad -- https://notepad-plus-plus.org/news/v889-released/ -- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel -- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php -- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware -- https://www.group-ib.com/blog/apt41-world-tour-2021/ -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 -- https://www.fortiguard.com/psirt/FG-IR-24-535 -- https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c -- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack -- https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/ -- https://man7.org/linux/man-pages/man2/syslog.2.html -- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16 -- https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html -- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html -- https://jgspiers.com/audit-group-policy-changes/ -- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/ -- https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251 -- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ -- https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/ -- https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html -- https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 -- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675 -- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently -- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy -- https://huntress.com/blog/esxi-vm-escape-exploit -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed -- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ -- https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/ -- https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468 -- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis -- https://pentestlab.blog/2022/03/21/unconstrained-delegation/ -- https://www.fortiguard.com/psirt/FG-IR-22-398 -- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/ -- https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/ -- https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33 -- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ -- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension -- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef -- https://github.com/h4rmy/KDU -- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4 -- https://localtonet.com/documents/supported-tunnels -- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps -- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump -- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local -- https://www.huntress.com/blog/silencing-the-edr-silencers -- https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation -- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/ -- https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session -- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html -- https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm -- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/ -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation -- https://trustedsec.com/blog/command-line-underdog-wmic-in-action -- https://woshub.com/disable-credential-guard-windows/ -- https://redcanary.com/blog/threat-detection/process-masquerading/ -- https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron -- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode -- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure -- https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample - https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/ -- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ -- https://unit42.paloaltonetworks.com/cve-2025-59287/ -- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/ -- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ -- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/ -- https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ -- https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ -- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11 -- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/ -- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216 -- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html -- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ -- https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html -- https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution -- https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting -- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html -- https://twitter.com/th3_protoCOL/status/1536788652889497600 -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732 -- https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ -- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/ -- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions -- https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity -- https://blog.sekoia.io/scattered-spider-laying-new-eggs/ -- https://github.com/mulwareX/CVE-2025-6218-POC -- https://github.com/TwoSevenOneT/EDR-Freeze -- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray -- https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py -- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/ -- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/ -- https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ -- https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml - https://www.cyberciti.biz/faq/how-force-kill-process-linux/ -- https://restic.net/ -- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion -- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash -- https://www.scip.ch/en/?labs.20240523 -- https://www.virustotal.com/gui/file/d2a4f52a9923336f119a52e531bbb1e66f18322fd8efa9af1a64b94f4d36dc97 -- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis -- https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware -- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware -- https://x.com/0gtweet/status/1564131230941122561 -- https://x.com/byrne_emmy12099/status/1932346420226658668 -- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ -- https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html -- https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 -- https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 -- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ -- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/ -- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16 -- https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ -- https://github.com/CoreyCBurton/DripLoaderNG -- https://www.joesandbox.com/analysis/1467354/0/html -- https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html -- https://www.loobins.io/binaries/pbpaste/ -- https://github.com/rapid7/metasploit-framework/issues/11337 -- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/ -- https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/ -- https://ss64.com/nt/set.html -- https://x.com/Max_Mal_/status/1826179497084739829 -- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps -- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 -- https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior +- https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251 +- https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad +- https://blog.talosintelligence.com/uncovering-qilin-attack-methods-exposed-through-multiple-cases/ - https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/ -- https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html -- https://www.coreycburton.com/blog/driploader-case-study -- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis -- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software -- https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware -- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/ -- https://securelist.com/apt41-in-africa/116986/ -- https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised -- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 -- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 -- https://www.youtube.com/watch?v=uSYvHUVU8xY -- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html -- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx -- https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml -- https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 -- https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage -- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ -- https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/ +- https://deadeclipse666.blogspot.com/2026/04/public-disclosure-response-for-cve-2026.html +- https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ +- https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv +- https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware +- https://x.com/BlackArrowSec/status/2044374743491424508 +- https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/ - http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/ -- https://adsecurity.org/?p=3377 +- https://www.zscaler.com/blogs/security-research/european-diplomats-targeted-spikedwine-wineloader +- https://www.cisa.gov/stopransomware/ransomware-guide - https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html -- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ -- https://github.com/JohnHammond/recaptcha-phish -- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability -- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/ -- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events -- https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8 -- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection -- https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ -- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741 -- https://redcanary.com/blog/threat-intelligence/msix-installers/ -- https://pwn.guide/free/web/crushftp -- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/ -- https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc -- https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ -- https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/ -- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf -- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ -- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ -- https://docs.datadoghq.com/security/default_rules/719-39f-9cd/ +- https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/ +- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025 +- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/ +- https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 +- https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/ +- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48 +- https://itm4n.github.io/cdpsvc-dll-hijacking/ +- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html +- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/ +- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack +- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy +- https://juggernaut-sec.com/capabilities/#cap_setgid +- https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm +- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer +- https://docs.python.org/3/library/base64.html +- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml +- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector +- https://www.fortiguard.com/psirt/FG-IR-22-398 +- https://github.com/rtecCyberSec/BitlockMove +- https://unit42.paloaltonetworks.com/cve-2025-59287/ +- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json +- https://en.wikipedia.org/wiki/Right-to-left_override +- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html +- https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login +- https://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960/software/release/12-2_53_se/command/reference/2960ComRef/cli1.html#47220 - https://github.com/msanft/CVE-2025-55182 -- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/ -- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html -- https://x.com/Wietze/status/1933495426952421843 -- https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure -- https://megatools.megous.com/ -- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability -- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ -- https://novasky.io/hunts/hunting-litellm-supply-chain -- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md -- https://www.loobins.io/binaries/xattr/ -- https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md +- https://man7.org/linux/man-pages/man2/sysinfo.2.html +- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/ +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs +- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin +- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis +- https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 +- https://www.huntress.com/blog/silencing-the-edr-silencers +- https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/ +- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/ +- https://www.attackiq.com/2023/09/20/emulating-rhysida/ - https://mrd0x.com/filefix-clickfix-alternative/ -- https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer -- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration -- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/ +- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html +- https://github.com/corneliusweig/rakkess +- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/ +- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry +- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7 +- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt +- https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing +- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal +- https://www.coreycburton.com/blog/driploader-case-study +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins +- https://twitter.com/Kostastsale/status/1480716528421011458 +- https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1 +- https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/ +- https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement +- https://x.com/Wietze/status/1933495426952421843 +- https://www.proofpoint.com/us/blog/threat-insight/http-client-tools-exploitation-account-takeover-attacks +- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ +- https://blog.axelarator.net/hunting-for-edr-freeze/ +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741 +- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ +- https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware +- https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ +- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC +- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed +- https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/ +- https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ +- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps +- https://www.mandiant.com/resources/blog/apt29-wineloader-german-political-parties +- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/ +- https://www.cyberciti.biz/faq/linux-remove-user-command/ +- https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/ +- https://github.com/amidaware/tacticalrmm +- https://research.splunk.com/cloud/605cc93a-70e4-4ee3-9a3d-1a62e8c9b6c2/ +- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx +- https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2 +- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/ +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions +- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/ +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11) +- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear +- https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html +- https://redcanary.com/blog/threat-detection/process-masquerading/ +- https://hawktrace.com/blog/CVE-2025-59287-UNAUTH +- https://thehackernews.com/2025/09/axios-abuse-and-salty-2fa-kits-fuel.html +- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44 - https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415 +- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf +- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/ +- https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py +- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump +- https://github.com/TwoSevenOneT/WSASS +- https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/ +- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/ +- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ +- https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md +- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval +- https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/security/a1/sec-a1-xe-3se-3850-cr-book/sec-a1-xe-3se-3850-cr-book_chapter_010.html#wp3502072400 +- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html +- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/ +- https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1 +- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/ +- https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke +- https://www.cve.org/CVERecord?id=CVE-2024-1709 +- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ +- https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session +- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ +- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains +- https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ +- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/ +- https://redcanary.com/blog/threat-intelligence/msix-installers/ +- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ +- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps +- https://github.com/0xthirteen/SharpMove/ +- https://github.com/rtecCyberSec/SpeechRuntimeMove +- https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage +- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps +- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access +- https://www.derp.ca/research/axios-npm-supply-chain-rat/ +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931 +- https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md +- https://github.com/grayhatkiller/SharpExShell +- https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample +- https://huskyhacks.io/posts/litellm-cred-stealer/ +- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior +- https://x.com/wietze/status/1958302556033065292?s=12 +- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/ +- https://redcanary.com/threat-detection-report/techniques/installer-packages/ +- https://learn.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session +- https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/ +- https://ss64.com/osx/sw_vers.html +- https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 +- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/ +- https://paper.seebug.org/1495/ +- https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous +- https://restic.net/ +- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/ +- https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows +- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis +- https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_programmatic_login +- https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3 +- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions +- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address +- https://docs.python.org/3/library/http.server.html +- https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc +- https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md +- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html +- https://feeds.alphasoc.net/bad-etlds.txt +- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ +- https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla +- https://news.sophos.com/en-us/2025/05/09/lumma-stealer-coming-and-going/ +- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/ +- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware +- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 +- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/ +- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ +- https://securelist.com/apt41-in-africa/116986/ +- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software +- https://man7.org/linux/man-pages/man1/dmesg.1.html +- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/ +- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/ +- https://localtonet.com/documents/supported-tunnels +- https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/ +- https://docs.microsoft.com/en-us/sql/tools/bcp-utility +- https://www.cisa.gov/known-exploited-vulnerabilities-catalog +- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/ +- https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ +- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/ +- https://github.com/mhaskar/FsquirtCPLPoC +- https://github.com/trufflesecurity/trufflehog +- https://notepad-plus-plus.org/news/v889-released/ +- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ +- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/ +- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625 +- https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting +- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/ +- https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall +- https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/ +- https://nvd.nist.gov/vuln/detail/CVE-2025-5054 +- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin +- https://github.com/The-Viper-One/Invoke-PowerDPAPI/ +- https://redfoxsec.com/blog/ipv6-dns-takeover/ +- https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis +- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/ +- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/ +- https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix +- https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics +- https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd +- https://research.checkpoint.com/2025/stealth-falcon-zero-day/ +- https://cloud.google.com/logging/docs/audit/gsuite-audit-logging +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673 +- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b +- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html +- https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/ +- https://www.scip.ch/en/?labs.20240523 +- https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes +- https://tria.ge/241231-j9yatstqbm/behavioral1 +- https://www.loobins.io/binaries/xattr/ +- https://www.softperfect.com/products/networkscanner/ +- https://ngrok.com/blog-post/new-ngrok-domains +- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/ +- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ +- https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/ +- https://nvd.nist.gov/vuln/detail/CVE-2025-4598 +- https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package +- https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616 +- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code +- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations +- https://snehbavarva.medium.com/privilege-escalation-techniques-series-linux-cron-jobs-a5b797b424b4 +- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events#codespaces +- https://novasky.io/hunts/hunting-litellm-supply-chain +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation +- https://blu.org/mhonarc/discuss/2001/04/msg00285.php +- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/ +- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps +- https://x.com/cyberfeeddigest/status/1887041526397587859 +- https://x.com/Threatlabz/status/1879956781360976155 +- https://cert.gov.ua/article/6277849 +- https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry +- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy +- https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c +- https://vmois.dev/query-signal-desktop-messages-sqlite/ +- https://lolbas-project.github.io/lolbas/Binaries/Sftp/ +- https://www.stepsecurity.io/blog/sha1-hulud-the-second-coming-zapier-ens-domains-and-other-prominent-npm-packages-compromised +- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 +- https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ +- https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html +- https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml +- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/ +- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks +- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms +- https://redcanary.com/threat-detection-report/techniques/email-hiding-rules/ +- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ +- https://unit42.paloaltonetworks.com/chromeloader-malware/ +- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ +- https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L605 +- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 +- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/ +- https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory +- https://x.com/JangPr0/status/1932034543026065833 +- https://learn.microsoft.com/en-us/windows/wsl/install +- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging +- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection +- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/ +- https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign +- https://www.joesandbox.com/analysis/1467354/0/html +- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md +- https://x.com/byrne_emmy12099/status/1932346420226658668 +- https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4 +- https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation +- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038 +- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md +- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/ +- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist +- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 +- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites +- https://gtfobins.github.io/gtfobins/gawk/#shell +- https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060 +- https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16 +- https://github.com/shoober420/windows11-scripts/blob/38d83331738cd713ccb42f2c4557d17a27aefd98/Windows11Tweaks.bat#L1825 +- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ +- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/ +- https://jgspiers.com/audit-group-policy-changes/ +- https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/ +- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0 +- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel +- https://cert.gov.ua/article/6284080 +- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ +- https://pberba.github.io/security/2022/01/30/linux-threat-hunting-for-persistence-systemd-timers-cron/ +- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4 +- https://www.trendmicro.com/en_us/research/25/f/water-curse.html +- https://tria.ge/240731-jh4crsycnb/behavioral2 +- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh +- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ +- https://www.cisco.com/en/US/docs/ios-xml/ios/san/command/san-xe-3se-3850-cr-book_chapter_00.html#wp3394428680 +- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf +- https://github.com/TwoSevenOneT/EDR-Freeze +- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ +- https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30 +- https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ +- https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm +- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role +- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ +- https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV +- https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/ +- https://naikordian.github.io/blog/posts/brute-force-aws-console/ +- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules +- https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure +- https://www.fortiguard.com/psirt/FG-IR-24-535 +- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit +- https://ss64.com/nt/set.html +- https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468 +- https://github.com/h4rmy/KDU +- https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/ +- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension +- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion +- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ +- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html +- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15 +- https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh +- https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/ +- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing +- https://securelist.com/sidewinder-apt/114089/ +- https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/ +- https://developer.okta.com/docs/reference/system-log-query/ +- https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html +- https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers +- https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml +- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/ +- https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/ +- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4 +- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html +- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr +- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ +- https://www.joesandbox.com/analysis/1605063/0/html +- https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/ +- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ +- https://us-cert.cisa.gov/ncas/alerts/aa21-259a +- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ +- https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8 +- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324 +- https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf +- https://scythe.io/threat-thursday/threatthursday-darkside-ransomware +- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776 +- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/ +- https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2 +- https://github.com/mulwareX/CVE-2025-6218-POC +- https://www.youtube.com/watch?v=uSYvHUVU8xY +- https://tria.ge/231212-r1bpgaefar/behavioral2 +- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local +- https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d +- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html +- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging +- https://twitter.com/th3_protoCOL/status/1536788652889497600 +- https://0xdf.gitlab.io/2024/10/05/htb-freelancer.html# +- https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html +- https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html +- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes +- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings +- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability +- https://tria.ge/241015-l98snsyeje/behavioral2 +- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability +- https://pentestlab.blog/2022/03/21/unconstrained-delegation/ +- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ +- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7 +- https://www.jamf.com/blog/infostealers-pose-threat-to-macos/ +- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country +- https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#gov_attack_warning +- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/ +- https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2 +- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/ +- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide +- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/ +- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/ +- https://man7.org/linux/man-pages/man8/setcap.8.html +- https://bazaar.abuse.ch/browse/tag/one/ +- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin +- https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ +- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html +- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ +- https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site +- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675 +- https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection +- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/ +- https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/ +- https://linux.die.net/man/8/auditct +- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard +- https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md +- https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ +- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216 +- https://ss64.com/nt/schtasks.html +- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/ +- https://www.virustotal.com/gui/file/bc43e925d7b4b74319f6e74e836a96f1997ba404e14ac566cf12a21e9da463db/behavior +- https://dfir.ch/posts/linux_capabilities/ +- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode +- https://manual.cs50.io/2/personality +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 +- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/ +- https://github.com/Arno0x/DNSExfiltrator/ +- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php +- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules +- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf +- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis +- https://github.com/logangoins/Krueger/tree/main +- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel +- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications +- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/ +- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/ +- https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt +- https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution +- https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/ +- https://adsecurity.org/?p=3377 +- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication +- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ +- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/ +- https://x.com/0gtweet/status/1564131230941122561 +- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/ +- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16 +- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/ +- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis +- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/ +- https://gtfobins.github.io/gtfobins/rsync/#shell +- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet +- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36 +- https://blog.qualys.com/vulnerabilities-threat-research/2025/05/29/qualys-tru-discovers-two-local-information-disclosure-vulnerabilities-in-apport-and-systemd-coredump-cve-2025-5054-and-cve-2025-4598 +- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/ +- https://www.getsafety.com/blog-posts/shai-hulud-npm-attack +- https://www.netexec.wiki/ +- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/ +- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f +- https://github.com/varwara/CVE-2024-35250 +- https://adsecurity.org/?p=1785 +- https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091 +- https://www.virustotal.com/gui/file/d2a4f52a9923336f119a52e531bbb1e66f18322fd8efa9af1a64b94f4d36dc97 +- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ +- https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference +- https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123 +- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100 +- https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware +- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker +- https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639 +- https://intel.thedfirreport.com/eventReports/view/70 +- https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf +- https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm +- https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron +- https://ptylu.github.io/content/report/report.html?report=25 +- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c +- https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870 +- https://taggart-tech.com/evildeno/ +- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set +- https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399 +- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html +- https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today +- https://medium.com/@poudelswachchhanda123/preventing-lnk-and-fakecaptcha-threats-a-system-hardening-approach-2f7b7ed2e493 +- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack - https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/ - https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html -- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer -- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin -- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1 -- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c -- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard -- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/set-inboxrule?view=exchange-ps -- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ -- https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers -- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ -- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/ -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776 -- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/ -- https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md -- https://github.com/amidaware/tacticalrmm -- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker -- https://dfir.ch/posts/linux_capabilities/ -- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/ -- https://blu.org/mhonarc/discuss/2001/04/msg00285.php -- https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml -- https://github.com/trufflesecurity/trufflehog -- https://github.com/mhaskar/FsquirtCPLPoC -- https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site -- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/ -- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md -- https://www.aikido.dev/blog/shai-hulud-strikes-again-hitting-zapier-ensdomains -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role -- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md -- https://www.softperfect.com/products/networkscanner/ -- https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ -- https://learn.microsoft.com/en-us/windows/wsl/install -- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/ -- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/ -- https://itm4n.github.io/cdpsvc-dll-hijacking/ -- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/ -- https://securelist.com/sidewinder-apt/114089/ -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins -- https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf -- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15 -- https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure -- https://www.cisa.gov/known-exploited-vulnerabilities-catalog -- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7 -- https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics -- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/ -- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool -- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53 -- https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ -- https://man7.org/linux/man-pages/man2/personality.2.html -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10) -- https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html -- https://intel.thedfirreport.com/eventReports/view/70 -- https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002 -- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event -- https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3 - https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository -- https://x.com/JangPr0/status/1932034543026065833 -- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md -- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html -- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html -- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/ -- https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes -- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/ -- https://github.com/grayhatkiller/SharpExShell -- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/ -- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ -- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/ -- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173 -- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1 -- https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store -- https://tria.ge/241231-j9yatstqbm/behavioral1 -- https://tria.ge/240731-jh4crsycnb/behavioral2 -- https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall -- https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/ -- https://thehackernews.com/2026/03/axios-supply-chain-attack-pushes-cross.html?m=1 -- https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/ -- https://labs.nettitude.com/blog/introducing-sharpwsus/ -- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/ -- https://github.com/wiz-sec-public/wiz-research-iocs/blob/a836ce8aacf12d6d2f6afc3c44b391dc4c08f46e/reports/shai-hulud-2-packages.csv -- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/ -- https://cert.gov.ua/article/6277849 -- https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790 -- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ -- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit -- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf -- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging -- https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ -- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/ -- https://unit42.paloaltonetworks.com/chromeloader-malware/ -- https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt -- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html -- https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action -- https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16 -- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing -- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code -- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36 -- https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123 -- https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/ -- https://news.ycombinator.com/item?id=29504755 -- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country -- https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md -- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ -- https://taggart-tech.com/evildeno/ -- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ -- https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/ -- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder -- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ -- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1 -- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html -- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect -- https://www.huntress.com/blog/active-exploitation-solarwinds-web-help-desk-cve-2025-26399 -- https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html -- https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html -- https://www.akamai.com/blog/security-research/abusing-bad-successor-for-privilege-escalation-in-active-directory -- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/ -- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48 -- https://feeds.alphasoc.net/bad-etlds.txt -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11) -- https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png -- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9 -- https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091 -- https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing -- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html -- https://moonlock.com/amos-backdoor-persistent-access -- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1 -- https://research.checkpoint.com/2025/stealth-falcon-zero-day/ -- https://nodejs.org/api/child_process.html#class-childprocess -- https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ -- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195 -- https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today -- https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/ -- https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/ -- https://www.getsafety.com/blog-posts/shai-hulud-npm-attack -- https://github.com/rtecCyberSec/SpeechRuntimeMove -- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials -- https://x.com/wietze/status/1958302556033065292?s=12 -- https://www.wiz.io/blog/threes-a-crowd-teampcp-trojanizes-litellm-in-continuation-of-campaign -- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html -- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053 -- https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639 -- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws -- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/ -- https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/ -- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval -- https://learn.microsoft.com/it-it/powershell/module/exchangepowershell/new-inboxrule?view=exchange-ps -- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address -- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019 -- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins -- https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows +- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/ - https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ -- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f -- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules -- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/ -- https://juggernaut-sec.com/capabilities/#cap_setgid -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start -- https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry -- https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/ -- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/ -- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry -- https://docs.python.org/3/library/http.server.html -- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/ -- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html -- https://huskyhacks.io/posts/litellm-cred-stealer/ -- https://docs.microsoft.com/en-us/sql/tools/bcp-utility -- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites -- https://tria.ge/241015-l98snsyeje/behavioral2 -- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/ -- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/ -- https://adsecurity.org/?p=1785 -- https://github.com/0xthirteen/SharpMove/ -- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage -- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ -- https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/ -- https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html -- https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html -- https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2 -- https://linux.die.net/man/8/auditct -- https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf -- https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan -- https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm -- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/ -- https://gtfobins.github.io/gtfobins/gawk/#shell -- https://paper.seebug.org/1495/ -- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ -- https://us-cert.cisa.gov/ncas/alerts/aa21-259a -- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7 -- https://ngrok.com/blog-post/new-ngrok-domains -- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii -- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo -- https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4 -- https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm -- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/ -- https://github.com/Arno0x/DNSExfiltrator/ -- https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla -- https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 -- https://man7.org/linux/man-pages/man2/sysinfo.2.html -- https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/ -- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear -- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings -- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/ -- https://github.com/rtecCyberSec/BitlockMove -- https://www.joesandbox.com/analysis/1605063/0/html -- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ -- https://juggernaut-sec.com/capabilities/#cap_setuid -- https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457 -- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior -- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector -- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access -- https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/ -- https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js -- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/ -- https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/ -- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/ -- https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/ -- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in -- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd -- https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/ -- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml -- https://hawktrace.com/blog/CVE-2025-59287-UNAUTH -- https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ -- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3 -- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673 -- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json -- https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md -- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324 -- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh -- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration -- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/ -- https://asec.ahnlab.com/en/40263/ -- https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/ -- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications -- https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown -- https://lolbas-project.github.io/#/download -- https://www.derp.ca/research/axios-npm-supply-chain-rat/ -- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/ -- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/ -- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm -- https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f -- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan -- https://en.wikipedia.org/wiki/Right-to-left_override -- https://www.security.com/threat-intelligence/medusa-ransomware-attacks -- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/ -- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections -- https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled -- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/ -- https://github.com/rapid7/Rapid7-Labs/blob/741c7196ec12a0a56b63463d1fd726ff14d3a97a/BPFDoor/rapid7_detect_bpfdoor.sh -- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16 -- https://github.com/TwoSevenOneT/WSASS -- https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference -- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal -- https://www.group-ib.com/resources/threat-research/red-curl-2.html -- https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060 -- https://www.trendmicro.com/en_us/research/25/f/water-curse.html -- https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/ -- https://www.virustotal.com/gui/file/e10b1fa84f1d6481625f741b69892780140d4e0e7769e7491e5f4d894c2e0e09 -- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/ -- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/ -- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/ -- https://www.man7.org/linux/man-pages/man1/systemctl.1.html -- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC -- https://gtfobins.github.io/gtfobins/rsync/#shell -- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist -- https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior -- https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware -- https://gtfobins.github.io/gtfobins/gcc/#shell -- https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement -- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html -- https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/ -- https://manual.cs50.io/2/personality -- https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack -- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ -- https://github.com/The-Viper-One/Invoke-PowerDPAPI/ -- https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/ - https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054 -- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy -- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/ -- https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/ -- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations -- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_ -- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/ -- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44 -- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/ -- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/ -- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/ -- https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis -- https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870 -- https://x.com/cyberfeeddigest/status/1887041526397587859 -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616 -- https://github.com/logangoins/Krueger/tree/main -- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication -- https://www.huntress.com/blog/supply-chain-compromise-axios-npm-package -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038 -- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking - https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39 -- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100 -- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel -- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html -- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf -- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes -- https://naikordian.github.io/blog/posts/brute-force-aws-console/ -- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/ -- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/ -- https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions -- https://tria.ge/231212-r1bpgaefar/behavioral2 -- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md -- https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution -- https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 -- https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix -- https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50 -- https://www.loobins.io/binaries/nscurl/ -- https://ss64.com/osx/sw_vers.html -- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe -- https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html -- https://scythe.io/threat-thursday/threatthursday-darkside-ransomware -- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html -- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/ -- https://www.virustotal.com/gui/file/71e35aef03099cd1f2d6446734273025a163597de93912df321ef118bf135238/ -- https://man7.org/linux/man-pages/man8/setcap.8.html +- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware +- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md - https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/ -- https://www.jamf.com/blog/infostealers-pose-threat-to-macos/ -- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr -- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/ -- https://www.huntress.com/blog/malicious-browser-extention-crashfix-kongtuke -- https://ss64.com/nt/schtasks.html -- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/ -- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211 -- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4 -- https://bazaar.abuse.ch/browse/tag/one/ -- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7 -- https://securelist.com/notepad-supply-chain-attack/118708/ -- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html -- https://tria.ge/231023-lpw85she57/behavioral2 -- https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/ -- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt -- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules -- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0 -- https://cloud.google.com/logging/docs/audit/understanding-audit-logs -- https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV -- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/ -- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) -- https://x.com/Threatlabz/status/1879956781360976155 -- https://www.cve.org/CVERecord?id=CVE-2024-1709 -- https://www.cisa.gov/stopransomware/ransomware-guide -- https://x.com/0x534c/status/1944694507787710685 -- https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/ -- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions -- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/ -- https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime -- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures -- https://cert.gov.ua/article/6284080 -- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/ -- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea -- https://gtfobins.github.io/gtfobins/capsh/#shell -- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg -- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/ -- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/ -- https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ -- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/ -- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs -- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/ -- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/ -- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html -- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ -- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html -- https://redfoxsec.com/blog/ipv6-dns-takeover/ -- https://blog.axelarator.net/hunting-for-edr-freeze/ -- https://github.com/varwara/CVE-2024-35250 -- https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/ -- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/ -- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ -- https://vmois.dev/query-signal-desktop-messages-sqlite/ -- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/ -- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin -- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure - https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/ -- https://twitter.com/Kostastsale/status/1480716528421011458 -- https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/ -- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns -- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/ -- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/ -- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/ -- https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous -- https://medium.com/@poudelswachchhanda123/preventing-lnk-and-fakecaptcha-threats-a-system-hardening-approach-2f7b7ed2e493 -- https://man7.org/linux/man-pages/man1/dmesg.1.html -- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b +- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures - https://www.microsoft.com/en-us/security/blog/2026/02/06/active-exploitation-solarwinds-web-help-desk/ -- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy -- https://redcanary.com/threat-detection-report/techniques/installer-packages/ -- https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d -- https://www.attackiq.com/2023/09/20/emulating-rhysida/ +- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/ +- https://www.rapid7.com/blog/post/tr-bpfdoor-telecom-networks-sleeper-cells-threat-research-report/ +- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html +- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/ +- https://github.com/asyncapi/cli/blob/2efa4dff59bc3d3cecdf897ccf178f99b115d63d/setup_bun.js +- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/ +- https://trustedsec.com/blog/command-line-underdog-wmic-in-action +- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/ +- https://www.elastic.co/security-labs/primer-on-persistence-mechanisms +- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-service +- https://documentation.solarwinds.com/en/success_center/whd/content/release_notes/whd_2026-1_release_notes.htm +- https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled +- https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown +- https://www.validin.com/blog/exploring_notepad_plus_plus_network_indicators/ +- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1 +- https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html +- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md +- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/ +- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage +- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files +- https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure +- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray +- https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer +- https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html +- https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f +- https://github.com/Bert-JanP/Hunting-Queries-Detection-Rules/blob/e7250648cb16d4a497ae8737943bf010ea96d2e6/Defender%20For%20Cloud%20Apps/MaliciousEmailDeliveredInMailbox.md +- https://github.com/rapid7/metasploit-framework/issues/11337 +- https://learn.microsoft.com/en-us/defender-office-365/threat-explorer-real-time-detections-about +- https://www.nccgroup.com/research/detection-engineering-for-kubernetes-clusters/ +- https://support.okta.com/help/s/article/What-is-the-systemoktacom-Account-in-Syslog-Used-For +- https://news.ycombinator.com/item?id=29504755 +- https://www.huntress.com/blog/credential-theft-expanding-your-reach-pt-2 +- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195 +- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3 +- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns +- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16 +- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy +- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/ +- https://moonlock.com/amos-backdoor-persistent-access +- https://www.heise.de/en/news/Notepad-updater-installed-malware-11109726.html +- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327 +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials +- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash +- https://asec.ahnlab.com/en/40263/ +- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/ +- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/ +- https://www.endorlabs.com/learn/shai-hulud-2-malware-campaign-targets-github-and-cloud-credentials-using-bun-runtime +- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/ +- https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50 +- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws +- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053 +- https://www.group-ib.com/blog/apt41-world-tour-2021/ +- https://lolbas-project.github.io/#/download +- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe +- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently +- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211 +- https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml +- https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store +- https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/ +- https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions +- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/ +- https://juggernaut-sec.com/capabilities/#cap_setuid +- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10) +- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/ +- https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/ +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10) +- https://labs.nettitude.com/blog/introducing-sharpwsus/ +- https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1 +- https://unprotect.it/technique/right-to-left-override-rlo-extension-spoofing/ +- https://github.com/Nightmare-Eclipse/RedSun/blob/7456cc8cf066f5e5fc6cdf7d3272a466ebd6b2f6/RedSun.cpp#L591 +- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/ +- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16 +- https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952 +- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins +- https://x.com/SBousseaden/status/2044417029721997635 +- https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan +- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect +- https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#suspicious_login_less_secure_app +- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +- https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/ +- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/ +- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html +- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/ +- https://www.elastic.co/security-labs/axios-supply-chain-compromise-detections +- https://gtfobins.github.io/gtfobins/gcc/#shell +- https://blog.palantir.com/tampering-with-windows-event-tracing-background-offense-and-defense-4be7ac62ac63 +- https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/ +- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/ +- https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1 +- https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/ +- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/ +- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration +- https://gtfobins.github.io/gtfobins/capsh/#shell +- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732 +- https://github.com/Pennyw0rth/NetExec +- https://nodejs.org/api/child_process.html#class-childprocess +- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg +- https://x.com/Max_Mal_/status/1826179497084739829 +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo +- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html +- https://huntress.com/blog/esxi-vm-escape-exploit +- https://man7.org/linux/man-pages/man2/personality.2.html +- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/ +- https://pwn.guide/free/web/crushftp +- https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/ +- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html +- https://www.loobins.io/binaries/pbpaste/ +- https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png +- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea +- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf +- https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33 +- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii +- https://man7.org/linux/man-pages/man2/syslog.2.html +- https://www.loobins.io/binaries/nscurl/ +- https://docs.datadoghq.com/security/default_rules/719-39f-9cd/ +- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool +- https://www.man7.org/linux/man-pages/man1/systemctl.1.html +- https://github.com/JohnHammond/recaptcha-phish +- https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan +- https://www.akamai.com/blog/security-research/abusing-dmsa-for-privilege-escalation-in-active-directory +- https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action +- https://megatools.megous.com/ +- https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/ +- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/ +- https://developers.google.com/workspace/admin/reports/v1/appendix/activity/login#email_forwarding_out_of_domain +- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/ +- https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/ +- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173 +- https://github.com/ufrisk/MemProcFS +- https://tria.ge/231023-lpw85she57/behavioral2 +- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events +- https://www.group-ib.com/resources/threat-research/red-curl-2.html +- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019 +- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/ +- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/ +- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/ +- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/ +- https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/ +- https://www.security.com/threat-intelligence/medusa-ransomware-attacks +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc +- https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution +- https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/ +- https://www.nextron-systems.com/2023/09/15/detecting-janelarat-with-yara-and-thor/ +- https://securelist.com/notepad-supply-chain-attack/118708/ +- https://blog.sekoia.io/scattered-spider-laying-new-eggs/ +- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53 +- https://cloud.google.com/logging/docs/audit/understanding-audit-logs diff --git a/tests/rule-references.txt b/tests/rule-references.txt index d5f8deea0..7017cfa4e 100644 --- a/tests/rule-references.txt +++ b/tests/rule-references.txt @@ -174,6 +174,7 @@ https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966 https://attackerkb.com/topics/Bkij5kK1qK/cve-2022-21587/rapid7-analysis https://attackerkb.com/topics/SSTk336Tmf/cve-2024-3400/rapid7-analysis https://awakesecurity.com/blog/threat-hunting-for-paexec/ +https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html https://bad-jubies.github.io/RCE-NOW-WHAT/ https://badoption.eu/blog/2023/01/31/code_c2.html https://bazaar.abuse.ch/browse/signature/RaspberryRobin/ @@ -449,6 +450,7 @@ https://docs.aws.amazon.com/AmazonECS/latest/APIReference/API_RegisterTaskDefini https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_DeleteDBCluster.html https://docs.aws.amazon.com/AmazonRDS/latest/APIReference/API_ModifyDBCluster.html +https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html https://docs.aws.amazon.com/AmazonS3/latest/API/API_Operations.html https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketEncryption.html https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutBucketLogging.html @@ -482,10 +484,12 @@ https://docs.aws.amazon.com/vm-import/latest/userguide/vmexport.html#export-inst https://docs.djangoproject.com/en/1.11/ref/exceptions/ https://docs.djangoproject.com/en/1.11/topics/logging/#django-security https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group +https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr https://docs.github.com/en/actions/hosting-your-own-runners/about-self-hosted-runners#about-self-hosted-runners https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise +https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#private_repository_forking https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#ssh_certificate_authority https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/about-secret-scanning @@ -697,6 +701,7 @@ https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-analytics-alert-r https://docs.python.org/2/library/simplehttpserver.html https://docs.python.org/3/library/site.html https://docs.python.org/3/using/cmdline.html#cmdoption-c +https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html https://documentation.pdq.com/PDQDeploy/13.0.3.0/index.html?windows-services.htm https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e @@ -895,6 +900,7 @@ https://github.com/codewhitesec/SysmonEnte/ https://github.com/codewhitesec/SysmonEnte/blob/main/screens/1.png https://github.com/connormcgarr/LittleCorporal https://github.com/corelight/CVE-2021-1675 +https://github.com/CoreyCBurton/DripLoaderNG https://github.com/CsEnox/EventViewer-UACBypass https://github.com/cube0x0 https://github.com/cube0x0/CVE-2021-1675 @@ -1176,6 +1182,7 @@ https://github.com/NetSPI/aws_consoler https://github.com/NetSPI/PowerUpSQL https://github.com/nettitude/Invoke-PowerThIEf https://github.com/nettitude/SharpWSUS +https://github.com/Nightmare-Eclipse/RedSun https://github.com/nknorg/nkn-sdk-go https://github.com/nsacyber/Event-Forwarding-Guidance/tree/6e92d622fa33da911f79e7633da4263d632f9624/Events https://github.com/offsecginger/koadic/blob/457f9a3ff394c989cdb4c599ab90eb34fb2c762c/data/stager/js/stdlib.js @@ -2088,6 +2095,7 @@ https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/dtrace https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/pnputil-command-syntax https://learn.microsoft.com/en-us/windows-hardware/drivers/taef/ +https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11 https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_install_firstuse?tabs=powershell https://learn.microsoft.com/en-us/windows-server/administration/server-core/server-core-sconfig#powershell-is-the-default-shell-on-server-core @@ -2135,6 +2143,7 @@ https://learn.microsoft.com/en-us/windows/security/application-security/applicat https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/using-event-viewer-with-applocker https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/design/applications-that-can-bypass-wdac https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-tag-explanations +https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4634 https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4647 @@ -2410,6 +2419,7 @@ https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/ https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/ https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/ +https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/ https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/ https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/ https://mikefrobbins.com/2017/06/15/simple-obfuscation-with-powershell-using-base64-encoding/ @@ -2458,6 +2468,7 @@ https://news.sophos.com/en-us/2022/07/14/blackcat-ransomware-attacks-not-merely- https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/ https://news.sophos.com/en-us/2023/04/19/aukill-edr-killer-malware-abuses-process-explorer-driver/ https://news.sophos.com/en-us/2024/06/05/operation-crimson-palace-a-technical-deep-dive +https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/ https://newtonpaul.com/analysing-fileless-malware-cobalt-strike-beacon/ https://ngrok.com/ https://ngrok.com/docs @@ -2724,9 +2735,11 @@ https://securityintelligence.com/posts/raspberry-robin-worm-dridex-malware/ https://securityintelligence.com/x-force/x-force-hive0129-targeting-financial-institutions-latam-banking-trojan/ https://securityjosh.github.io/2020/04/23/Mute-Sysmon.html https://securitylab.github.com/research/octopus-scanner-malware-open-source-supply-chain +https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/ https://securityliterate.com/how-malware-abuses-the-zone-identifier-to-circumvent-detection-and-analysis/ https://securityscorecard.com/research/deep-dive-into-alphv-blackcat-ransomware https://securityxploded.com/ +https://semgrep.dev/blog/2025/digging-for-secrets-sha1-hulud-the-second-coming-of-the-npm-worm/ https://sensepost.com/blog/2022/abusing-windows-tokens-to-compromise-active-directory-without-touching-lsass/ https://sensepost.com/blog/2024/dumping-lsa-secrets-a-story-about-task-decorrelation/ https://sergiusechel.medium.com/improving-the-network-based-detection-of-cobalt-strike-c2-servers-in-the-wild-while-reducing-the-6964205f6468 @@ -3485,6 +3498,7 @@ https://windows-internals.com/faxing-your-way-to-system/ https://windows-internals.com/printdemon-cve-2020-1048/ https://winscripting.blog/2017/05/12/first-entry-welcome-and-uac-bypass/ https://wojciechregula.blog/post/macos-red-teaming-initial-access-via-applescript-url/ +https://woshub.com/disable-credential-guard-windows/ https://www-fsb-ru.translate.goog/fsb/press/message/single.htm!id=10439739@fsbMessage.html?_x_tr_sch=http&_x_tr_sl=ru&_x_tr_tl=en&_x_tr_hl=de&_x_tr_pto=wapp https://www.13cubed.com/downloads/windows_process_genealogy_v2.pdf https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/ @@ -3736,6 +3750,7 @@ https://www.huntress.com/blog/a-catastrophe-for-control-understanding-the-screen https://www.huntress.com/blog/attacking-mssql-servers https://www.huntress.com/blog/confluence-to-cerber-exploitation-of-cve-2023-22518-for-ransomware-deployment https://www.huntress.com/blog/critical-vulnerabilities-in-papercut-print-management-software +https://www.huntress.com/blog/curling-for-data-a-dive-into-a-threat-actors-malicious-ttps https://www.huntress.com/blog/moveit-transfer-critical-vulnerability-rapid-response https://www.huntress.com/blog/slashandgrab-screen-connect-post-exploitation-in-the-wild-cve-2024-1709-cve-2024-1708 https://www.huntress.com/blog/the-unwanted-guest @@ -4099,6 +4114,7 @@ https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-blackbyte https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.azoruit.a https://www.trendmicro.com/vinfo/vn/threat-encyclopedia/malware/ransom.bat.zarlock.a +https://www.trendmicro.com/zh_hk/research/26/c/axios-npm-package-compromised.html https://www.trimarcsecurity.com/single-post/TrimarcResearch/Detecting-Kerberoasting-Activity https://www.trustedsec.com/blog/abusing-windows-telemetry-for-persistence/ https://www.trustedsec.com/blog/art_of_kerberoast/ @@ -4149,6 +4165,7 @@ https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13 https://www.virustotal.com/gui/file/0e2854753d17b1bb534de8e765d5813c9fb584a745978b3d92bc6ca78e3e7735/relations https://www.virustotal.com/gui/file/13828b390d5f58b002e808c2c4f02fdd920e236cc8015480fa33b6c1a9300e31 https://www.virustotal.com/gui/file/13ae8bfbc02254b389ab052aba5e1ba169b16a399d9bc4cb7414c4a73cd7dc78/detection +https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef https://www.virustotal.com/gui/file/15b57c1b68cd6ce3c161042e0f3be9f32d78151fe95461eedc59a79fc222c7ed https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior @@ -4287,6 +4304,7 @@ https://www.zscaler.com/blogs/security-research/onenote-growing-threat-malware-d https://www.zscaler.com/blogs/security-research/steal-it-campaign https://www.zscaler.com/blogs/security-research/technical-analysis-crytox-ransomware https://www.zscaler.com/blogs/security-research/unintentional-leak-glimpse-attack-vectors-apt37 +https://x.com/0x534c/status/1944694507787710685 https://x.com/_st0pp3r_/status/1742203752361128162?s=20 https://x.com/cyb3rops/status/1862406110365245506 https://x.com/defusedcyber/status/1971492272966598683