 Jonhnathan
|
9c434eaf04
|
Update sysmon_susp_service_installed.yml
|
2020-10-15 20:10:06 -03:00 |
|
|
Jonhnathan
|
33ed01e285
|
Update sysmon_susp_run_key_img_folder.yml
|
2020-10-15 20:09:42 -03:00 |
|
|
Jonhnathan
|
45466cf95d
|
Update sysmon_susp_reg_persist_explorer_run.yml
|
2020-10-15 20:08:47 -03:00 |
|
|
Jonhnathan
|
b55b78c42d
|
Update sysmon_susp_lsass_dll_load.yml
|
2020-10-15 20:08:12 -03:00 |
|
|
Jonhnathan
|
17ade8e5f5
|
Update sysmon_susp_download_run_key.yml
|
2020-10-15 20:07:53 -03:00 |
|
|
Jonhnathan
|
6fc6409c7f
|
Update sysmon_stickykey_like_backdoor.yml
|
2020-10-15 20:07:11 -03:00 |
|
|
Jonhnathan
|
03ea1375e2
|
Update sysmon_registry_persistence_search_order.yml
|
2020-10-15 20:05:46 -03:00 |
|
|
Jonhnathan
|
f101d661f0
|
Update sysmon_reg_office_security.yml
|
2020-10-15 20:05:11 -03:00 |
|
|
Jonhnathan
|
176b7ce08f
|
Update sysmon_rdp_settings_hijack.yml
|
2020-10-15 20:04:57 -03:00 |
|
|
Jonhnathan
|
4c9cf8b759
|
Update sysmon_new_dll_added_to_appinit_dlls_registry_key.yml
|
2020-10-15 20:04:31 -03:00 |
|
|
Jonhnathan
|
51eefbae0c
|
Update sysmon_logon_scripts_userinitmprlogonscript_reg.yml
|
2020-10-15 20:04:05 -03:00 |
|
|
Jonhnathan
|
143e6512ad
|
Update sysmon_dns_serverlevelplugindll.yml
|
2020-10-15 20:03:42 -03:00 |
|
|
Jonhnathan
|
c4a44e2376
|
Update sysmon_dns_serverlevelplugindll.yml
|
2020-10-15 20:03:29 -03:00 |
|
|
Jonhnathan
|
bdca2febe9
|
Update sysmon_dhcp_calloutdll.yml
|
2020-10-15 20:02:58 -03:00 |
|
|
Jonhnathan
|
337e26a034
|
Update sysmon_cmstp_execution.yml
|
2020-10-15 20:02:37 -03:00 |
|
|
Jonhnathan
|
4adf092a25
|
Update win_workflow_compiler.yml
|
2020-10-15 20:00:57 -03:00 |
|
|
Jonhnathan
|
eb9bac761f
|
Update win_wmi_spwns_powershell.yml
|
2020-10-15 20:00:44 -03:00 |
|
|
Jonhnathan
|
b2e1b857ae
|
Update win_wmi_backdoor_exchange_transport_agent.yml
|
2020-10-15 20:00:27 -03:00 |
|
|
Jonhnathan
|
86ad1f45f5
|
Update win_win10_sched_task_0day.yml
|
2020-10-15 20:00:13 -03:00 |
|
|
Jonhnathan
|
630e92f3c2
|
Update win_webshell_spawn.yml
|
2020-10-15 19:59:59 -03:00 |
|
|
Jonhnathan
|
138b8fed06
|
Update win_webshell_recon_detection.yml
|
2020-10-15 19:59:36 -03:00 |
|
|
Jonhnathan
|
e402356e82
|
Update win_webshell_detection.yml
|
2020-10-15 19:58:37 -03:00 |
|
|
Jonhnathan
|
2d9233d418
|
Update win_vul_java_remote_debugging.yml
|
2020-10-15 19:57:43 -03:00 |
|
|
Jonhnathan
|
d9afa1aec6
|
Update win_termserv_proc_spawn.yml
|
2020-10-15 19:57:05 -03:00 |
|
|
Jonhnathan
|
737fbd1619
|
Update win_system_exe_anomaly.yml
|
2020-10-15 19:55:57 -03:00 |
|
|
Jonhnathan
|
434c6257f0
|
Update win_susp_wmi_execution.yml
|
2020-10-15 19:52:25 -03:00 |
|
|
Jonhnathan
|
7b9ec4709f
|
Update win_susp_whoami.yml
|
2020-10-15 19:51:55 -03:00 |
|
|
Jonhnathan
|
d09dd70695
|
Update win_susp_userinit_child.yml
|
2020-10-15 19:51:42 -03:00 |
|
|
Jonhnathan
|
ad8620f729
|
Update win_susp_tscon_rdp_redirect.yml
|
2020-10-15 19:51:05 -03:00 |
|
|
yugoslavskiy
|
9e7789bb32
|
Update win_susp_logon_explicit_credentials.yml
|
2020-10-16 00:50:29 +02:00 |
|
|
Jonhnathan
|
c38ccefc21
|
Update win_susp_tscon_localsystem.yml
|
2020-10-15 19:50:14 -03:00 |
|
|
Jonhnathan
|
9d8116c486
|
Update win_susp_taskmgr_parent.yml
|
2020-10-15 19:50:04 -03:00 |
|
|
Jonhnathan
|
dde03e760b
|
Update win_susp_taskmgr_localsystem.yml
|
2020-10-15 19:49:47 -03:00 |
|
|
Jonhnathan
|
4543e18e4e
|
Update win_susp_sysvol_access.yml
|
2020-10-15 19:49:31 -03:00 |
|
|
Jonhnathan
|
08a018a2ee
|
Update win_susp_sysprep_appdata.yml
|
2020-10-15 19:49:12 -03:00 |
|
|
Jonhnathan
|
4c9124952e
|
Update win_susp_svchost.yml
|
2020-10-15 19:47:47 -03:00 |
|
|
Jonhnathan
|
5c7bc4c48a
|
Update win_susp_schtask_creation.yml
|
2020-10-15 19:47:15 -03:00 |
|
|
Jonhnathan
|
d3f0d25ffb
|
Update win_susp_rundll32_by_ordinal.yml
|
2020-10-15 19:46:54 -03:00 |
|
|
Jonhnathan
|
8d471775e0
|
Update win_susp_regsvr32_anomalies.yml
|
2020-10-15 19:45:08 -03:00 |
|
|
Jonhnathan
|
cc338507c9
|
Update win_susp_ps_appdata.yml
|
2020-10-15 19:43:37 -03:00 |
|
|
Jonhnathan
|
91fb5cdcd0
|
Update win_susp_prog_location_process_starts.yml
|
2020-10-15 19:43:19 -03:00 |
|
|
Jonhnathan
|
253014ee68
|
Update win_susp_procdump.yml
|
2020-10-15 19:42:48 -03:00 |
|
|
Jonhnathan
|
f614ac658f
|
Update win_susp_powershell_parent_combo.yml
|
2020-10-15 19:42:20 -03:00 |
|
|
Vasilisa-L
|
c6442bcb4a
|
Spaces are cool but not enough!
|
2020-10-16 01:41:53 +03:00 |
|
|
Jonhnathan
|
1feba3a12c
|
Update win_susp_powershell_hidden_b64_cmd.yml
|
2020-10-15 19:40:23 -03:00 |
|
|
Jonhnathan
|
7df7d7f48b
|
Update win_susp_powershell_enc_cmd.yml
|
2020-10-15 19:39:11 -03:00 |
|
|
Jonhnathan
|
610ae5ddd7
|
Update win_susp_powershell_enc_cmd.yml
|
2020-10-15 19:38:47 -03:00 |
|
|
Vasilisa-L
|
3d20aeca64
|
Reference to LOLbas added
|
2020-10-16 01:36:16 +03:00 |
|
|
Jonhnathan
|
4485436957
|
Update win_susp_powershell_empire_uac_bypass.yml
|
2020-10-15 19:34:18 -03:00 |
|
|
Jonhnathan
|
90d20094ac
|
Update win_susp_ping_hex_ip.yml
|
2020-10-15 19:34:00 -03:00 |
|