Ruben Groenewoud e822af47a4 [Hunt Tuning] Persistence via SSH Configurations and/or Keys (#4351) ...

* [Hunt Tuning] Persistence via SSH Configurations and/or Keys

* ++

* Revert "Merge branch 'main' into hunt-update-ssh-authorized-keys"

This reverts commit 2b31a3bb49e51a4c9f4752ad6880c3f398032b4e, reversing
changes made to 263ffd5eb98f53282850b4f777df4091f3f03926.

* ++

* Update pyproject.toml

2025-01-13 16:53:09 +01:00

..

command_and_control_via_network_connections_with_low_occurrence_frequency_for_unique_agents.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

command_and_control_via_unusual_file_downloads_from_source_addresses.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

defense_evasion_via_capitalized_process_execution.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

defense_evasion_via_hidden_process_execution.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

defense_evasion_via_multi_dot_process_execution.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

excessive_ssh_network_activity_unique_destinations.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

execution_uncommon_process_execution_from_suspicious_directory.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

login_activity_by_source_address.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

low_volume_external_network_connections_from_process.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

low_volume_gtfobins_external_network_connections.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

low_volume_modifications_to_critical_system_binaries.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

low_volume_process_injection_syscalls_by_executable.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_reverse_bind_shells.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_cron.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_driver_load_with_low_occurrence_frequency.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_dynamic_linker_hijacking.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_git_hook_pager.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_loadable_kernel_modules.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_malicious_docker_container.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_message_of_the_day.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_package_manager.md

[Tuning & Changes] Misc rule/hunt tuning (#3875)

2024-07-11 14:55:33 +02:00

persistence_via_pluggable_authentication_module.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_rc_local.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_rpm_dpkg_installer_packages.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_shell_modification_persistence.md

[Tuning & Changes] Misc rule/hunt tuning (#3875)

2024-07-11 14:55:33 +02:00

persistence_via_ssh_configurations_and_keys.md

[Hunt Tuning] Persistence via SSH Configurations and/or Keys (#4351)

2025-01-13 16:53:09 +01:00

persistence_via_systemd_timers.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_sysv_init.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_udev.md

[Tuning & Changes] Misc rule/hunt tuning (#3875)

2024-07-11 14:55:33 +02:00

persistence_via_unusual_system_binary_parent.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_user_group_creation_modification.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

persistence_via_web_shell.md

[New Hunts] Adding Several Hunting PRs into this Main PR (#4342)

2025-01-07 14:29:17 +01:00

persistence_via_xdg_autostart_modifications.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

privilege_escalation_via_existing_sudoers.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

privilege_escalation_via_process_capabilities.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

privilege_escalation_via_segmentation_fault_and_buffer_overflow.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00

privilege_escalation_via_suid_binaries.md

[Bug] Normalize Hunting Index Link Generation (#3872)

2024-07-10 11:01:59 -04:00