Skip to content
MISP galaxy
Tidal References
Initializing search
MISP galaxy
Home
Statistics
360net
360net
360.net Threat Actors
Ammunitions
Ammunitions
Ammunitions
Android
Android
Android
Atrm
Atrm
Azure Threat Research Matrix
Attck4fraud
Attck4fraud
attck4fraud
Backdoor
Backdoor
Backdoor
Banker
Banker
Banker
Bhadra framework
Bhadra framework
Bhadra Framework
Botnet
Botnet
Botnet
Branded vulnerability
Branded vulnerability
Branded Vulnerability
Cancer
Cancer
Cancer
Cert eu govsector
Cert eu govsector
Cert EU GovSector
China defence universities
China defence universities
China Defence Universities Tracker
Cmtmf attack pattern
Cmtmf attack pattern
CONCORDIA Mobile Modelling Framework - Attack Pattern
Country
Country
Country
Cryptominers
Cryptominers
Cryptominers
Disarm actortypes
Disarm actortypes
Actor Types
Disarm countermeasures
Disarm countermeasures
Countermeasures
Disarm detections
Disarm detections
Detections
Disarm techniques
Disarm techniques
Techniques
Election guidelines
Election guidelines
Election guidelines
Entity
Entity
Entity
Exploit kit
Exploit kit
Exploit-Kit
Firearms
Firearms
Firearms
First dns
First dns
FIRST DNS Abuse Techniques Matrix
Gsma motif
Gsma motif
GSMA MoTIF
Handicap
Handicap
Handicap
Intelligence agencies
Intelligence agencies
Intelligence Agencies
Interpol dwva
Interpol dwva
INTERPOL DWVA Taxonomy
Malpedia
Malpedia
Malpedia
Microsoft activity group
Microsoft activity group
Microsoft Activity Group actor
Misinfosec amitt misinformation pattern
Misinfosec amitt misinformation pattern
Misinformation Pattern
Mitre atlas attack pattern
Mitre atlas attack pattern
MITRE ATLAS Attack Pattern
Mitre atlas course of action
Mitre atlas course of action
MITRE ATLAS Course of Action
Mitre attack pattern
Mitre attack pattern
Attack Pattern
Mitre course of action
Mitre course of action
Course of Action
Mitre d3fend
Mitre d3fend
MITRE D3FEND
Mitre data component
Mitre data component
mitre-data-component
Mitre data source
Mitre data source
mitre-data-source
Mitre ics assets
Mitre ics assets
Assets
Mitre ics groups
Mitre ics groups
Groups
Mitre ics levels
Mitre ics levels
Levels
Mitre ics software
Mitre ics software
Software
Mitre ics tactics
Mitre ics tactics
Tactics
Mitre intrusion set
Mitre intrusion set
Intrusion Set
Mitre malware
Mitre malware
Malware
Mitre tool
Mitre tool
mitre-tool
Nace
Nace
NACE
Naics
Naics
NAICS
Nice framework competency areas
Nice framework competency areas
NICE Competency areas
Nice framework knowledges
Nice framework knowledges
NICE Knowledges
Nice framework opm codes
Nice framework opm codes
OPM codes in cybersecurity
Nice framework skills
Nice framework skills
NICE Skills
Nice framework tasks
Nice framework tasks
NICE Tasks
Nice framework work roles
Nice framework work roles
NICE Work Roles
O365 exchange techniques
O365 exchange techniques
o365-exchange-techniques
Online service
Online service
online-service
Preventive measure
Preventive measure
Preventive Measure
Producer
Producer
Producer
Ransomware
Ransomware
Ransomware
Rat
Rat
RAT
Region
Region
Regions UN M49
Rsit
Rsit
rsit
Sector
Sector
Sector
Sigma rules
Sigma rules
Sigma-Rules
Social dark patterns
Social dark patterns
Dark Patterns
Sod matrix
Sod matrix
SoD Matrix
Stealer
Stealer
Stealer
Surveillance vendor
Surveillance vendor
Surveillance Vendor
Target information
Target information
Target Information
Tds
Tds
TDS
Tea matrix
Tea matrix
Tea Matrix
Threat actor
Threat actor
Threat Actor
Tidal campaigns
Tidal campaigns
Tidal Campaigns
Tidal groups
Tidal groups
Tidal Groups
Tidal references
Tidal references
Tidal References
Tidal References
Table of contents
D3Secutrity CTI Feeds
Linux Logs
Netspi PowerShell Execution Policy Bypass
Mandiant-leaks
Tilbury Windows Credentials
CWE top 25
CrowdStrike 2015 Global Threat Report
Prolific OSX Malware History
CERN Windigo June 2019
CrowdStrike GTR 2019
Crowdstrike GTR2020 Mar 2020
RecordedFuture 2021 Ad Infra
Red Canary 2021 Threat Detection Report March 2021
ACSC BlackCat Apr 2022
Internet crime report 2022
RC PowerShell
20 macOS Common Tools and Techniques
Microsoft GPP Key
Microsoft _VBA_PROJECT Stream
Microsoft Learn
Hybrid Analysis Icacls2 May 2018
Microsoft Wow6432Node 2018
DOJ-DPRK Heist
ITWorld Hard Disk Health Dec 2014
Microsoft 4657 APR 2017
Microsoft 4697 APR 2017
Microsoft User Creation Event
Microsoft User Modified Event
Microsoft 4768 TGT 2017
HIPAA Journal S3 Breach, 2017
Slack Security Risks
PurpleSec Data Loss Prevention
7zip Homepage
VMWare 8Base June 28 2023
Acronis 8Base July 17 2023
MicroFocus 9002 Aug 2016
CISA AA21-200A APT40 July 2021
AADInternals
AADInternals Documentation
AADInternals Github
Gigamon BADHATCH Jul 2019
bad_luck_blackcat
Cybereason Bazar July 2020
Red Canary Hospital Thwarted Ryuk October 2020
CyberCX Anonymous Sudan June 19 2023
Netskope Cloud Phishing
Microsoft O365 Admin Roles
Microsoft Atom Table
Microsoft About BITS
Microsoft About Event Tracing 2018
Microsoft PowerShell Command History
Microsoft List View Controls
Microsoft PowerShell Logging
Apple About Mac Scripting 2016
PowerShell About 2019
Microsoft PowerShellB64
Microsoft Profiles
Microsoft About Profiles
Microsoft Remote Desktop Services
systemsetup mac time
MSDN Clipboard
Microsoft HTML Help Executable Program
About UEFI
Microsoft Window Classes
Picus Sodinokibi January 2020
Application Bundle Manipulation Brandon Dalton
NCC Group Chimera January 2021
Electron 2
Harmj0y Abusing GPO Permissions
Retwin Directory Share Pivot
BOHOPS Abusing the COM Registry
abusing_com_reg
Rhino Security Labs AWS VPC Traffic Mirroring
Narrator Accessibility Abuse
Intezer ACBackdoor
AccCheckConsole.exe - LOLBAS Project
CyberScoop APT28 Nov 2018
Microsoft Azure Kubernetes Service Service Accounts
CrowdStrike Access Brokers
Microsoft Access Control Lists May 2018
Auth0 Access Tokens
BSidesSLC 2020 - LNK Elastic
Mythic SpecterOps
FireEye Chinese Espionage October 2019
Unit42 AcidBox June 2020
AcidRain JAGS 2022
acroread package compromised Arch Linux Mail 8JUL2018
Microsoft Actinium February 2022
Wikipedia Active Directory
Microsoft AD Accounts
Microsoft AD Admin Tier Model
Microsoft AD CS Overview
Microsoft Get-ADUser
Active Directory Enumeration with LDIFDE
Microsoft SID-History Attribute
Volexity Ivanti Zero-Day Exploitation January 2024
ActiveMalwareEnergy
Klein Active Setup 2010
Dark Vortex Brute Ratel C4
ad_blocker_with_miner
Microsoft Support O365 Add Another Admin, October 2019
Amazon AWS IMDS V2
Adding Login Items
MRWLabs Office Persistence Add-ins
AddinUtil.exe - LOLBAS Project
Microsoft - Add-MailboxPermission
AddMonitor
Microsoft Azure AD Users
Microsoft Office Add-ins
Microsoft AddPrintProcessor May 2018
RFC1918
Microsoft Exchange Address Lists
Microsoft AD DS Getting Started
Akamai DGA Mitigation
Keychain Decryption Passware
Trend Micro Deep Dive Into Defacement
Talos Lokibot Jan 2021
Malwarebytes Saint Bot April 2021
SecurityScorecard CredoMap September 2022
Krebs DNS Hijack 2019
Reaqta MuddyWater November 2017
ESET Turla PowerShell May 2019
Kubernetes Admission Controllers
Krebs Adobe
Github AD-Pentest-Script
adplus.exe - LOLBAS Project
Microsoft ADV170021 Dec 2017
FireEye APT Groups
Mandiant Advanced Persistent Threats
Mandiant APT Groups List
Advanced_sec_audit_policy_settings
Adversaries Hijack DLLs
CrowdStrike Richochet Chollima September 2021
Elastic - Hunting for Persistence Part 1
NCSC APT29 July 2020
Advpack.dll - LOLBAS Project
Kaspersky Adwind Feb 2016
Bitdefender Trickbot VNC module Whitepaper 2021
Mac Backdoors are back
SentinelOne January 30 2023
Trend Micro March 26 2024
Kaspersky MSSQL Aug 2019
Securelist Agent.btz
ThreatExpert Agent.btz
AgentExecutor.exe - LOLBAS Project
SentinelLabs Agent Tesla Aug 2020
LogPoint Agent Tesla March 23 2023
ATT Sidewinder January 2021
Harmj0y Domain Trusts
airwalk backdoor unix systems
Wired Lockergoga 2019
ZDNET Selling Data
ESET Zebrocy May 2019
Kersten Akira 2023
Akira Ransomware Analysis August 2023
Sophos Akira May 9 2023
Microsoft AKS Azure AD 2023
Okta DPoP 2023
US-CERT SamSam 2018
CISA MSS Sep 2020
CISA Lokibot September 2020
CISA_AA21_200B
cisa_malware_orgs_ukraine
US-CERT Ransomware 2016
US-CERT WannaCry 2017
US-CERT HIDDEN COBRA June 2017
US-CERT NotPetya 2017
US-CERT APT Energy Oct 2017
US-CERT FALLCHILL Nov 2017
US-CERT Volgmer Nov 2017
US-CERT TA18-074A
US-CERT-TA18-106A
US-CERT Emotet Jul 2018
AlKhaser Debug
Fysbis Palo Alto Analysis
Medium KONNI Jan 2020
Unit 42 Palo Alto Ransomware in Public Clouds 2022
Cyber Centre ALPHV/BlackCat July 25 2023
Mandiant ALPHV Affiliate April 3 2023
Microsoft ADS Mar 2014
XPNSec PPID Nov 2017
Microsoft AlwaysInstallElevated 2018
ASEC BLOG July 21 2022
Amazon Snapshots
Amazon AMI
Amazon S3
Trend Micro S3 Exposed PII, 2017
Recorded Future Beacon Certificates
Botnet Scan
Trend Micro Ngrok September 2020
CIRCL PlugX March 2013
Apple Unified Log Analysis Remote Login and Screen Sharing
Medium S2W WhisperGate January 2022
Analysis of FG-IR-22-369
Graeber 2014
Fortinet Agent Tesla April 2018
Antiy CERT Ramsay April 2020
Storm-0558 techniques for unauthorized email access
ESET Telebots July 2017
EST Kimsuky SmokeScreen April 2019
Ukraine15 - EISAC - 201603
Check Point Havij Analysis
ESET Emotet Dec 2018
Rewterz Sidewinder COVID-19 June 2020
CISA AR18-352A Quasar RAT December 2018
CISA AR21-126A FIVEHANDS May 2021
JoeSecurity Egregor 2020
GDATA Zeus Panda June 2017
jstnk9.github.io June 01 2022
Analyzing CS Dec 2020
Objective_See 1 4 2024
Microsoft Security Blog 4 22 2024
Uperesia Malicious Office Documents
Unit42 OilRig Nov 2018
McAfee GhostSecret
Microsoft Analyzing Solorigate Dec 2020
Lastline PlugX Analysis
TrendMicro Sandworm October 2014
Dragos Crashoverride 2018
Anatomy of an hVNC Attack
Syscall 2014
SCADAfence_ransomware
ESET IIS Malware 2021
Medium Anchor DNS July 2020
NSA Joint Advisory SVR SolarWinds April 2021
Kaspersky Andariel Ransomware June 2021
Sophos X-Ops C-23
RFC826 ARP
HP SVCReady Jun 2022
SecureList Fileless
ESET Ebury Feb 2014
Welivesecurity Ebury SSH
Avertium Black Basta June 2022
Myers 2007
Linux Services Run Levels
Anomali Pirate Panda April 2020
AnonGhost Team Profile
AnonHBGary
Fortinet Metamorfo Feb 2020
MuddyWater TrendMicro June 2018
AlienVault Sykipot 2011
RiskIQ Newegg September 2018
Dell WMI Persistence
iDefense Rootkit Overview
Trend Micro Rhysida August 09 2023
Mandiant Ukraine Cyber Threats January 2022
Microsoft AMSI
Microsoft Anti Spoofing
Fox-It Anunak Feb 2015
Group-IB Anunak
Google TAG Ukraine Threat Landscape March 2022
Zairon Hooking Dec 2006
SentinelOne Aoqin Dragon June 2022
Apache Server 2018
Secureworks BRONZEUNION Feb 2019
AppArmor official
PenTestLabs AppDomainManagerInject
Rapid7 AppDomain Manager Injection
Mandiant APT1 Appendix
AppInit Secure Boot
AppInstaller.exe - LOLBAS Project
objectivesee osx.shlayer apple approved 2020
AppleDocs AuthorizationExecuteWithPrivileges
AppleDocs Scheduling Timed Jobs
CISA AppleJeus Feb 2021
Apple Remote Desktop Admin Guide 3.3
applescript signing
Microsoft Entra ID Service Principals
Microsoft App Domains
Corio 2008
Microsoft Application Lockdown
SANS Application Whitelisting
Beechey 2010
NSA MS AppLocker
Penetration Testing Lab MSXSL July 2017
Microsoft Requests for Azure AD Roles in Privileged Identity Management
Apple App Security Overview
Tripwire AppUNBlocker
Appvlp.exe - LOLBAS Project
BlackHat Atkinson Winchester Token Manipulation
FireEye APT10 April 2017
Securelist APT10 March 2021
FireEye APT10 Sept 2018
NCC Group APT15 Alive and Strong
Mandiant APT1
Profero APT27 December 2020
FireEye APT28 January 2017
FireEye APT28
U.S. CISA APT28 Cisco Routers April 18 2023
Symantec APT28 Oct 2018
FireEye APT28 Hospitality Aug 2017
Bitdefender APT28 Dec 2015
FireEye APT29 Domain Fronting
FireEye APT29 Domain Fronting With TOR March 2017
FireEye APT30
Zscaler APT31 Covid-19 October 2020
sentinelone apt32 macOS backdoor 2020
FireEye APT33 Webinar Sept 2017
FireEye APT34 Webinar Dec 2017
DFIR Report APT35 ProxyShell March 2022
Check Point APT35 CharmPower January 2022
FireEye APT37 Feb 2018
FireEye APT38 Oct 2018
FireEye APT39 Jan 2019
APT3 Adversary Emulation Plan
evolution of pirpi
FireEye APT40 March 2019
Rostovcev APT41 2021
Mandiant APT42
NSA APT5 Citrix Threat Hunting December 2022
welivesecurity_apt-c-23
QiAnXin APT-C-36 Feb2019
360 Machete Sep 2020
Cycraft Chimera April 2020
CISA IT Service Providers
Securelist GCMAN
Proofpoint TA459 April 2017
Kaspersky ToddyCat June 2022
Securelist APT Trends April 2018
Kaspersky APT Trends Q1 2020
Kaspersky APT Trends Q1 April 2021
Securelist APT Trends Q2 2017
Wired ArcaneDoor April 24 2024
Cisco Talos ArcaneDoor April 24 2024
Wald0 Guide to GPOs
Lau 2011
Krebs-Booter
RSA Forfiles Aug 2017
FireEye Respond Webinar July 2017
Browser-updates
Sekoia.io AridViper
TechNet Arp
Cisco ARP Poisoning Mitigation 2016
ASEC Emotet 2017
ASERT Seven Pointed Dagger Aug 2015
Securelist Sofacy Feb 2018
THE FINANCIAL TIMES LTD 2019.
Aspnet_Compiler.exe - LOLBAS Project
Mandiant UNC2452 APT29 April 2022
Microsoft AssemblyLoad
Kubernetes Assigning Pods to Nodes
Microsoft Assoc Oct 2017
Rhino Security Labs Enumerating AWS Roles
Cybereason Astaroth Feb 2019
spamhaus-malvertising
Microsoft APC
Medium February 08 2023
AsyncRAT Crusade: Detections and Defense | Splunk
TechNet At
Die.net Linux at Man Page
Linux at
PWC Pirpi Scanbox
Atbroker.exe - LOLBAS Project
ESET Attor Oct 2019
LogRhythm WannaCry
Malwarebytes Dyreza November 2015
At.exe - LOLBAS Project
ENSIL AtomBombing Oct 2016
SentinelOne 5 3 2023
Malwarebytes 1 10 2024
FireEye TRITON 2018
The DFIR Report Truebot June 12 2023
att_def_ps_logging
Attack chain leads to XWORM and AGENTTESLA | Elastic
Intezer TeamTNT September 2020
Metcalf 2015
Cisco Blog Legacy Device Attacks
FireEye TRITON 2017
FireEye TRITON Dec 2017
Forbes GitHub Creds
GitHub Cloud Service Credentials
Unit 42 Unsecured Docker Daemons
Talos Roblox Scam 2023
Black Hills Attacking Exchange MailSniper, 2016
SANS Attacking Kerberos Nov 2014
NetSPI SQL Server CLR
Mandiant FIN5 GrrCON Oct 2016
Attacking VNC Servers PentestLab
Talos Template Injection July 2017
Lotus Blossom Dec 2015
Symantec Attacks Against Government Sector
Aqua Security Cloud Native Threat Report June 2021
CERT-FR PYSA April 2020
InsiderThreat NTFS EA Oct 2017
Microsoft ASR Obfuscation
Obfuscated scripts
TrendMicro Msiexec Feb 2018
GitHub ATTACK Empire
lambert systemd 2022
TechNet Credential Theft
AcidRain State Department 2022
Audit OSX
Microsoft Audit Logon Events
Cloud Audit Logs
Microsoft Scheduled Task Events Win10
auditpol
auditpol.exe_STRONTIC
Audit_Policy_Microsoft
TechNet Audit Policy
Microsoft Audit Registry July 2012
Security Affairs Elderwood Sept 2012
NIST Authentication
MSDN Authentication Packages
Microsoft Authenticode
K8s Authorization Overview
SSH Authorized Keys
Trend Micro njRAT 2018
Re-Open windows on Mac
TechNet Autoruns
Autoruns for Windows
Hornet Security Avaddon June 2020
Arxiv Avaddon Feb 2021
CISA Phishing
Malwarebytes AvosLocker Jul 2021
avoslocker_ransomware
Cisco Talos Avos Jun 2022
Awesome Executable Packing
ESET Kobalos Jan 2021
AWS Root User
GitHub AWS-ADFS-Credential-Generator
AWS GetPasswordPolicy
AWS Console Sign-in Events
AWS Describe DB Instances
AWS Get Bucket ACL
AWS Get Public Access Block
AWS Head Bucket
Rhino Security Labs AWS Privilege Escalation
AWS Lambda Redirector
Sysdig AMBERSQUID September 18 2023
Rhino Security Labs AWS S3 Ransomware
AWS Systems Manager Run Command
Pylos Xenotime 2019
objective-see ay mami 2018
Microsoft AZ CLI
Intezer Russian APT Dec 2020
az monitor diagnostic-settings
Microsoft Azure AD Security Operations for Devices
Microsoft Azure Active Directory security operations guide
Azure AD Connect for Read Teamers
Microsoft - Azure PowerShell
Azure Blob Storage
Microsoft Azure Instance Metadata 2021
Microsoft Azure Policy
SpecterOps Azure Privilege Escalation
Azure Products
Azure - Resource Manager API
Mandiant Azure Run Command 2021
Microsoft Azure security baseline for Azure Active Directory
Microsoft - Azure Sentinel ADFSDomainTrustMods
Azure Serial Console
Microsoft Azure Storage Security, 2019
Azure - Stormspotter
Medium Babuk February 2021
Sogeti CERT ESEC Babuk March 2021
Unit42 BabyShark Apr 2019
Symantec Briba May 2012
TrendMicro Squiblydoo Aug 2017
Symantec Darkmoon Aug 2005
ESET BackdoorDiplomacy Jun 2021
Backdooring an AWS account
Symantec Linfo May 2012
Symantec Backdoor.Mivast
Symantec Nerex May 2012
Symantec Backdoor.Nidiran
Symantec Remsec IOCs
Symantec Ristol May 2012
Symantec Vasport May 2012
FSecure Hupigon
Symantec Wiarp May 2012
Microsoft Lamin Sept 2017
Microsoft PoisonIvy 2017
Microsoft Win Defender Truvasys Sep 2017
Microsoft Wingbird Nov 2017
Microsoft BITS
NCC Group Research Blog August 19 2022
Tech Republic - Restore AWS Snapshots
Secureworks COBALT DICKENS August 2018
Cybereason Kimsuky November 2020
Proofpoint TA453 March 2021
Unit 42 BadPatch Oct 2017
ESET Bad Rabbit
Secure List Bad Rabbit
BlackBerry Bahamut
BaltimoreSun RobbinHood May 2019
ESET Research Bandook July 7 2021
CheckPoint Bandook Nov 2020
Banker Google Chrome Extension Steals Creds
Unit42 Banking Trojans Hooking 2022
Linux manual bash invocation
DieNet Bash
Bash.exe - LOLBAS Project
Bashfuscator Command Obfuscators
Microsoft Basic TxF Concepts
eSentire | BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif
BATLOADER: The Evasive Downloader Malware
Palo Alto Networks BBSRAT
Microsoft bcdedit 2021
Securelist BlackEnergy Nov 2014
Securelist BlackEnergy Feb 2015
Crowdstrike DNC June 2016
Deep Instinct Black Basta August 2022
Bienstock, D. - Defending O365 - 2019
Kevin Mandia Statement to US Senate Committee on Intelligence
Microsoft Dofoil 2018
Obsidian SSPR Abuse 2023
FireEye CARBANAK June 2017
Expel Behind the Scenes
Microsoft BEC Campaign
Unit42 BendyBear Feb 2021
Google Cloud Storage Best Practices, 2019
Shadowbunny VM Defense Evasion
T1105: Trellix_search-ms
Hexacorn Office Test
Hexacorn Logon Scripts
Hexacorn Office Template Macros
Bginfo.exe - LOLBAS Project
Cyble August 18 2022
BianLian Ransomware Gang Gives It a Go! | [redacted]
Group IB APT 41 June 2021
Crowdstrike Indrik November 2018
CrowdStrike Ryuk January 2019
OWASP Binary Planting
Wikipedia Binary-to-text Encoding
Sucuri BIND9 August 2015
Wikipedia BIOS
Ge 2011
Talos Bisonal Mar 2020
Talos Bisonal 10 Years March 2020
Unit 42 Bisonal July 2018
Bitsadmin.exe - LOLBAS Project
Microsoft BITSAdmin
Cisco Talos Bitter Bangladesh May 2022
Forcepoint BITTER Pakistan Oct 2016
Camba RARSTONE
TrendMicro BKDR_URSNIF.SM
Cyble September 28 2022
Trend Micro Pikabot January 9 2024
Check Point Black Basta October 2022
BlackBasta
Trend Micro Black Basta October 2022
Uptycs Black Basta ESXi June 2022
Elliptic Black Basta November 29 2023
BlackBerry Black Basta May 2022
WMI 6
FBI BlackCat April 19 2022
X-Force BlackCat May 30 2023
BlackBerry BlackCat Threat Overview
Huntress BlackCat
Sophos BlackCat Jul 2022
ESEST Black Energy Jan 2016
ESET BlackEnergy Jan 2016
F-Secure BlackEnergy 2014
ESET BlackLotus March 01 2023
Securelist BlackOasis Oct 2017
ReliaQuest May 28 2024
HC3 Analyst Note BlackSuit Ransomware November 2023
Cyble May 12 2023
Palo Alto Black-T October 2020
BlackWater Malware Cloudflare Workers
NHS UK BLINDINGCAN Aug 2020
Azure Blob Snapshots
objsee block blocking login items
Technospot Chrome Extensions GP
Evi1cg Forfiles Nov 2017
Fifield Blocking Resistent Communication through domain fronting 2015
GitHub Bloodhound
Blue Cloud of Death Video
Blue Cloud of Death
1 - appv
apple doco bonjour description
Booby Trap Shortcut 2017
Microsoft Bootcfg
Imperva DDoS for Hire
Wikipedia Booting
FireEye BOOTRASH SANS
Booz Allen Hamilton
Unit42 LockerGoga 2019
Threatexpress MetaTwin 2017
Sandfly BPFDoor 2022
AADInternals - BPRT
Brazking-Websockets
Morphisec 3 26 2024
MSTIC Nobelium Toolset May 2021
Lee 2013
sentinelone-malvertising
OS X Keychain
Brown Exploiting Linkers
FireEye Outlook Dec 2019
Cisco Talos Blog December 08 2022
PaloAlto Preventing Opportunistic Attacks Apr 2016
Mandiant BYOL
Mandiant BYOL 2018
Comparitech Leak
ThreatPost Broadvoice Leak
Secureworks BRONZE BUTLER Oct 2017
Secureworks BRONZE FLEETWOOD Profile
Secureworks BRONZE HUNTLEY
Secureworks BRONZE PRESIDENT December 2019
Dell SecureWorks BRONZE STARLIGHT Profile
SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022
SecureWorks BRONZE UNION June 2017
Wikipedia Browser Extension
Mr. D0x BitB 2022
Cobalt Strike Browser Pivot
Symantec Buckeye
ESET Buhtrap and Buran April 2019
S1 Custom Shellcode Tool
Data Driven Security DGA
CTD PPID Spoofing Macro Mar 2019
Trend Micro September 02 2022
Proofpoint 2 12 2024
Toxin Labs 3 4 2023
SEC Consult Bumblebee April 11 2023
Cybereason Bumblebee August 2022
Secureworks Bumblebee April 20 2023
Symantec Bumblebee June 2022
Cyble September 07 2022
The DFIR Report Bumblebee September 26 2022
The DFIR Report Bumblebee November 14 2022
objsee netwire backdoor 2019
401 TRG Winnti Umbrella May 2018
Bypassing Gatekeeper
engima0x3 DNX Bypass
engima0x3 RCSI Bypass
Exploit Monday WinDbg
SubTee MSBuild
Bypassing CloudTrail in AWS Service Catalog
AADInternals - Conditional Access Bypass
MsitPros CHM Aug 2017
TCC macOS bypass
enigma0x3 sdclt app paths
MDSec System Calls
Hybrid Analysis Icacls1 June 2018
Microsoft Credential Manager store
Microsoft - Cached Creds
Kaspersky CactusPete Aug 2020
Kroll CACTUS Ransomware May 10 2023
ESET CaddyWiper March 2022
Cadet Blizzard emerges as novel threat actor
Cado Security Denonia
Cado Denonia April 3 2022
Caesars Scattered Spider September 13 2023
Securelist Calisto July 2018
CERTFR-2023-CTI-009
FSI Andariel Campaign Rifle July 2017
Check Point Research January 5 2022
Kaspersky Carbanak
KasperskyCarbanak
Forcepoint Carbanak Google C2
Trend Micro Carberp February 2014
Prevx Carberp March 2011
Trusteer Carberp October 2010
ESET Carbon Mar 2017
CrowdStrike Carbon Spider August 2021
PaloAlto CardinalRat Apr 2017
ESET Casbaneiro Oct 2019
Microsoft Catalog Files and Signatures April 2017
Catch All Chrome Extension
Akamai JS
Categorisation_not_boundary
CrowdStrike Flying Kitten
Telephone Attack Delivery
Tetra Defense Sodinokibi March 2020
CarbonBlack RobbinHood May 2019
Talos CCleanup 2017
Cdb.exe - LOLBAS Project
Slowik Sandworm 2021
ESET PLEAD Malware July 2018
Medium Certified Pre Owned
SpecterOps Certified Pre Owned
GitHub Certify
CertOC.exe - LOLBAS Project
CertReq.exe - LOLBAS Project
GitHub CertStealer
TechNet Certutil
LOLBAS Certutil
FireEye CFR Watering Hole 2012
Twitter Cglyer Status Update APT3 eml
Cybereason Chaes Nov 2020
Symantec Chafer February 2018
Securelist Remexi Jan 2019
change_rdp_port_conti
Microsoft Change Normal Template
Microsoft Change Default Programs
Chaos Stolen Backdoor
Wardle Persistence Chapter
cisco_deploy_rsa_keys
Wikipedia Character Encoding
ClearSky Charming Kitten Dec 2017
Certfa Charming Kitten January 2021
Proofpoint TA2541 February 2022
JPCERT ChChes Feb 2017
EclecticLightChecksonEXECodeSigning
Mandiant Pulse Secure Zero-Day April 2021
Anomali MUSTANG PANDA October 2019
FireEye admin@338
IronNet BlackTech Oct 2021
Recorded Future RedEcho Feb 2021
EFF China GitHub Attack
PaloAlto 3102 Sept 2015
ZScaler Hacking Team
Hacker News LuckyMouse June 2018
The Record APT31 Router Hacks
Dark Reading Codoso Feb 2015
Recorded Future TAG-22 July 2021
Recorded Future Chinese Activity in Southeast Asia December 2021
Recorded Future REDDELTA July 2020
Github CHIPSEC
McAfee CHIPSEC Blog
Chkrootkit Main
Azure AD Hybrid Identity
Chrome Remote Desktop
show_ssh_users_cmd_cisco
Cisco IOS Shellcode
Cisco IOS Software Integrity Assurance - AAA
Cisco IOS Software Integrity Assurance - Boot Information
Cisco IOS Software Integrity Assurance - Change Control
Cisco IOS Software Integrity Assurance - Image File Verification
Cisco IOS Software Integrity Assurance - Run-Time Memory Verification
Cisco IOS Software Integrity Assurance - Command History
Cisco IOS Software Integrity Assurance - Credentials Management
Cisco IOS Software Integrity Assurance - Deploy Signed IOS
Cisco IOS Software Integrity Assurance - Image File Integrity
Cisco IOS Software Integrity Assurance - Secure Boot
Cisco IOS Software Integrity Assurance - TACACS
Cisco Traffic Mirroring
Talos - Cisco Attack 2022
Citrix Bulletin CVE-2023-3519
Malwarebytes Citrix Bleed November 24 2023
Cyble April 28 2023
Cyble April 03 2023
Talent-Jump Clambling February 2020
FireEye Clandestine Fox Part 2
Microsoft Clear-EventLog
Clearing quarantine attribute
NPPSPY - Huntress
CL_Invocation.ps1 - LOLBAS Project
clip_win_server
Red Canary Silver Sparrow Feb2021
CL_LoadAssembly.ps1 - LOLBAS Project
CL_Mutexverifiers.ps1 - LOLBAS Project
Cybereason Clop Dec 2020
Mcafee Clop Aug 2019
Bleeping Computer Clop February 2023
Kaspersky Cloud Atlas December 2014
Kandji 4 8 2024
Rhino Labs Cloud Backdoor September 2019
Google Cloud Storage
Office 265 Azure Domain Availability
Mandiant Cloudy Logs 2023
win_clsid_key
Kube Cluster Admin
Kube Cluster Info
TechNet Cmd
Cmd.exe - LOLBAS Project
Cmdkey.exe - LOLBAS Project
cmdl32.exe - LOLBAS Project
Cmstp.exe - LOLBAS Project
Twitter CMSTP Jan 2018
Secureworks COBALT DICKENS September 2019
Morphisec Cobalt Gang Oct 2018
Secureworks COBALT GYPSY Threat Profile
Secureworks COBALT ILLUSION Threat Profile
PTSecurity Cobalt Dec 2016
CobaltStrike Daddy May 2017
Cobalt Strike Manual 4.3 November 2020
cobaltstrike manual
TrendMicro Cobalt Group Nov 2017
PTSecurity Cobalt Group Aug 2017
Zscaler Cobian Aug 2017
MACOS Cocoa
code.exe - LOLBAS Project
Dark Reading Code Spaces Cyber Attack
Medium Ptrace JUL 2018
Wikipedia Code Signing
SpectorOps Code Signing Dec 2017
CoinLoader: A Sophisticated Malware Loader Campaign
NYT-Colonial
Colorcpl.exe - LOLBAS Project
mod_rewrite
sentinelone shlayer to zshlayer
University of Birmingham C2
Microsoft Command-line Logging
Microsoft Netdom Trust Sept 2012
Microsoft msxsl.exe
Kettle CSV DDE Aug 2014
Microsoft CLR Integration 2017
Palo Alto Comnie
GDATA COM Hijacking
AP-NotPetya
Microsoft COM
Unit 42 12 8 2022
Palo Alto Unit 42 Compromised Cloud Compute Credentials 2022
US-CERT Alert TA15-314A Web Shells
Comsvcs.dll - LOLBAS Project
Condi-Botnet-binaries
Okta Conditional Access Policies
Microsoft Common Conditional Access Policies
Microsoft Token Protection 2023
Trend Micro Conficker
ConfigSecurityPolicy.exe - LOLBAS Project
Microsoft SAML Token Lifetimes
Apple Developer Configuration Profile
MDMProfileConfigMacOS
Azure Just in Time Access 2023
capture_embedded_packet_on_software
Kubernetes Security Context
Microsoft SharePoint Logging
TechNet RDP NLA
Microsoft Security Alerts for Azure AD Roles
Kubernetes Service Accounts
Windows RDP Sessions
Microsoft Configure LSA
Microsoft LSA Protection Mar 2014
Microsoft LSA
Configuring Data Access audit logs
Microsoft SID Filtering Quarantining Jan 2009
TechRepublic Wireless GPO FEB 2009
ZDNet Dtrack
Uptycs Confucius APT Jan 2021
TrendMicro Confucius APT Aug 2021
Conhost.exe - LOLBAS Project
EC2 Instance Connect
Sophos News 2 23 2024
Docker Docs Container
DigitalShadows CDN
Content trust in Azure Container Registry
Content trust in Docker
Microsoft File Folder Exclusions
Arctic Wolf Akira 2023
Arctic Wolf Conti Akira July 26 2023
DFIR Conti Bazar Nov 2021
Cybereason Conti Jan 2021
Cybleinc Conti January 2020
Control.exe - LOLBAS Project
Wikipedia Control Flow Integrity
Kubernetes API Control Access
TrendMicro CPL Malware Dec 2013
GitHub Conveigh
MITRE Copernicus
Secureworks COPPER FIELDSTONE Profile
TechNet Copy
copy_cmd_cisco
CopyKittens Nov 2015
coregen.exe - LOLBAS Project
Apple Core Services
Microsoft IoT Compromises August 05 2019
Microsoft STRONTIUM Aug 2019
Palo Alto ARP
F-Secure Cosmicduke
Costin Raiu IAmTheKing October 2020
Google Iran Threats October 2021
Cisco DNSMessenger March 2017
Juniper IcedID June 2020
PTSecurity Higaisa 2020
F-Secure CozyDuke
TrendMicro CPL Malware Jan 2014
Trend Micro CPL
SANS Brute Ratel October 2022
Stealthbits Cracking AS-REP Roasting Jun 2019
AdSecurity Cracking Kerberos Dec 2015
Dragos Crashoverride 2017
Unit 42 ATOM Crawling Taurus
Microsoft Image
Microsoft Snapshot
Microsoft Create Token
GCP Create Cloud Identity Users
Createdump.exe - LOLBAS Project
Google Cloud Kubernetes IAM
Microsoft CreateProcess
Microsoft CLI Create Subscription
create_sym_links
GCP - Creating and Starting a VM
AWS Create IAM User
GNU Fork
AppleDocs Launch Agent Daemons
TechNet Logon Scripts
Google Cloud Service Account Credentials
creatingXPCservices
GitHub Creddump7
Microsoft Midnight Blizzard Replay Attack
Anomali Template Injection MAR 2018
Microsoft Credential Locker
Microsoft CredEnumerate
SentinelLabs Intermittent Encryption September 08 2022
TrendmicroHideoutsLease
doppelpaymer_crowdstrike
Critical Vulnerabilities in PaperCut Print Management Software
Security Affairs SILENTTRINITY July 2019
Die.net Linux crontab Man Page
Symantec Frutas Feb 2013
Bishop Fox Sliver Framework August 2019
Okta Cross-Tenant Impersonation 2023
Okta Cross-Tenant Impersonation
Crowdstrike CrowdCast Oct 2013
Crowdstrike Global Threat Report Feb 2018
CrowdStrike GTR 2021 June 2021
CrowdStrike Adversary Carbon Spider
CrowdStrike Adversary Cozy Bear
CrowdStrike Labyrinth Chollima Feb 2022
CrowdStrike Adversary Ocean Buffalo
CrowdStrike Adversary Venomous Bear
CrowdStrike Adversary Wizard Spider
Crowdstrike DriveSlayer February 2022
CrowdStrike Putter Panda
Softpedia MinerC
Microsoft Cryptojacking 2023
Microsoft CryptUnprotectData April 2018
Csc.exe - LOLBAS Project
Cscript.exe - LOLBAS Project
csi.exe - LOLBAS Project
OWASP CSV Injection
Microsoft Subkey
Microsoft SolarWinds Customer Guidance
Microsoft - Customer Guidance on Recent Nation-State Cyber Attacks
Login Scripts Apple Dev
TechNet Screensaver GP
CustomShellHost.exe - LOLBAS Project
Mandiant Cutting Edge Part 2 January 2024
Mandiant Cutting Edge Part 3 February 2024
Mandiant Cutting Edge January 2024
Symantec Naid in the Wild June 2012
NVD CVE-2014-7169
NVD CVE-2016-6662
NVD CVE-2017-0176
FireEye Attacks Leveraging HTA
Microsoft CVE-2017-8625 Aug 2017
NVD CVE-2019-3610
CVMServer Vuln
Crowdstrike Kubernetes Container Escape
CyberArk Labs Safe Mode 2016
PJ Cyber Army of Russia 2023
Cyware Ngrok May 2019
The Record RansomHub June 3 2024
Microsoft Phosphorus Oct 2020
Check Point Mid-Year Report 2022
Talos Seduploader Oct 2017
FBI-search
Secureworks GOLD KINGSWOOD September 2018
Cybereason OSX Pirrit
Zdnet Kimsuky Dec 2018
FireEye APT32 May 2017
Shadowserver Strategic Web Compromise
CyberKnow Tweet July 7 2022
Cyber Safety Review Board: Lapsus
CISA Scattered Spider Advisory November 2023
NSA NCSC Turla OilRig
OPM Leak
ExpressVPN PATH env Windows 2021
SCILabs Malteiro 2021
Cyber Threat Profile MALTEIRO – Sciblog
NCSC Cyclops Blink February 2022
Trend Micro Cyclops Blink March 2022
Cynet Ragnar Apr 2020
Microsoft DACL May 2018
Apple Developer Doco Archive Launchd
Kubernetes DaemonSet
Picus Daixin Team October 24 2022
Medium Eli Salem GuLoader April 2021
Lookout Dark Caracal Jan 2018
Dark Clouds_Usenix_Mulazzani_08_2011
TrendMicro DarkComet Sept 2014
DarkGate Loader delivered via Teams - Truesec
Bleeping Computer DarkGate October 14 2023
Trend Micro DarkGate October 12 2023
DarkGate - Threat Breakdown Journey
Kaspersky Tomiris Sep 2021
Volexity SolarWinds
Securelist Darkhotel Aug 2015
Unit42 DarkHydrus Jan 2019
Unit 42 Phishery Aug 2018
Darkside Ransomware Cybereason
DarkSide Ransomware Gang
Secureworks DarkTortilla Aug 2022
Securelist DarkVishnya Dec 2018
Prevailion DarkWatchman 2021
Moran 2014
DataSvcUtil.exe - LOLBAS Project
Operation Emmental
Hijacking VNC
DBatLoader Actively Distributing Malwares Targeting European Businesses
Microsoft COM ACL
DCShadow Blog
GitHub DCSYNCMonitor
DD Man
Arbor SSLDoS April 2012
CERT-EU DDoS March 2017
Unit42 Sofacy Dec 2018
Death by 1000 installers; it's all broken!
SpecterOps Lateral Movement from Azure to On-Prem AD 2020
Microsoft PowerShell SilentlyContinue
virtualization.info 2006
TrendMicro Confucius APT Feb 2018
Ciberseguridad Decoding malicious RTF files
Nccgroup Gh0st April 2018
MalwareBytes Template Injection OCT 2017
Crowdstrike PartyTicket March 2022
Fortinet Emotet May 2017
Aqua TeamTNT August 2020
Bitdefender FIN8 July 2021
Cyble Ragnar Locker January 20 2022
Sophos Pikabot June 12 2023
Microsoft Deep Dive Solorigate January 2021
AADInternals - Device Registration
Alperovitch 2014
DefaultPack.EXE - LOLBAS Project
Lastline DarkHotel Just In Time Decryption Nov 2015
piazza launch agent mitigation
VectorSec ForFiles Aug 2017
Black Hat 2015 App Shim
TechNet O365 Outlook Rules
Defending Against Scheduled Task Attacks in Windows Environments
Rapid7 HAFNIUM Mar 2021
Microsoft SQL Server
rundll32.exe defense evasion
def_ev_win_event_logging
Kaspersky DeftTorero October 3 2022
TechNet Del
Hunters Domain Wide Delegation Google Workspace 2023
Azure Shared Access Signature
Register Deloitte
Talos Micropsia June 2017
TrendMicro EarthLusca 2022
Demiguise Guardrail Router Logo
FireEye Hacking Team
Demystifying Azure AD Service Principals
demystifying_ryuk
DOJ Iran Indictments September 2020
Microsoft GitHub Device Guard CI Policies
Microsoft Deploying AD Federation
Apple Kernel Extension Deprecation
Amazon Describe Instance
Amazon Describe Instances API
DescribeSecurityGroups - Amazon Elastic Compute Cloud
Microsoft RunOnceEx APR 2018
Designing Daemons Apple Dev
Desk.cpl - LOLBAS Project
Free Desktop Application Autostart Feb 2006
Desktopimgdownldr.exe - LOLBAS Project
CISA AA22-057A Destructive Malware February 2022
Microsoft WhisperGate January 2022
URI Unique
NSA and ASD Detect and Prevent Web Shells 2020
Microsoft Detect Outlook Forms
ADDSecurity DCShadow Feb 2018
Pace University Detecting DGA May 2017
MDSec Detecting DOTNET
Cisco DoSdetectNetflow
RSA2017 Detect and Respond Adair
Nmap Firewalls NIDS
Medium Detecting Attempts to Steal Passwords from Memory
Endurant CMSTP July 2018
Red Canary COR_PROFILER May 2020
NVisio Labs DDE Detection Oct 2017
Zhang 2013
ADSecurity Detecting Forged Tickets
Microsoft Detecting Kerberoasting Feb 2018
Medium Detecting Lateral Movement
macOS root VNC login without authentication
Sans Virtual Jan 2016
Mandiant Azure AD Backdoors
CounterCept PPID Spoofing Dec 2018
CISA SolarWinds Cloud Detection
Detecting Rclone
Medium Detecting WMI Persistence
Okta Scatter Swine 2022
Splunk Supernova Jan 2021
Microsoft Winnti Jan 2017
Chokepoint preload rootkits
Sygnia Golden SAML
FireEye Exchange Zero Days March 2021
Microsoft DEV-0537
MSTIC DEV-0537 Mar 2022
Microsoft Royal ransomware November 2022
Cisco IOS Forensics Developments
DeviceCredentialDeployment.exe - LOLBAS Project
GitHub mattifestation DeviceGuardBypass
Devinit.exe - LOLBAS Project
Devtoolslauncher.exe - LOLBAS Project
devtunnel.exe - LOLBAS Project
Dfshim.dll - LOLBAS Project
Dfsvc.exe - LOLBAS Project
dhcp_serv_op_events
GitHub Diamorphine
diantz.exe_lolbas
Fortinet Diavol July 2021
DFIR Diavol Ransomware December 2021
Überwachung APT28 Forfiles June 2015
Microsoft DSE June 2017
Microsoft East Asia Threats September 2023
ESET Turla Mosquito Jan 2018
TechNet Dir
Frisk DMA August 2016
Redops Syscalls
GitHub Disable DDEAUTO Oct 2017
Disable automount for ISO
Disable_Win_Event_Logging
GitHub MOTW
Apple Disable SIP
Microsoft GPO Bluetooth FEB 2009
ITSyndicate Disabling PHP functions
disable_notif_synology_ransom
Krebs Discord Bookmarks 2023
Diskshadow
Diskshadow.exe - LOLBAS Project
OpenAI-CTI
Bitdefender FunnyDream Campaign November 2020
FireEye NETWIRE March 2019
Cybereason Dissecting DGAs
FireEye POSHSPY April 2017
Microsoft DTC
Mandiant Search Order
FireEye DLL Search Order Hijacking
Stewart 2014
Dnscmd.exe - LOLBAS Project
Dnscmd Microsoft
DNS Dumpster
Talos DNSpionage Nov 2018
Unit42 DNS Mar 2019
dnx.exe - LOLBAS Project
GTFOBins Docker
Docker Daemon CLI
Docker API
Docker Build Image
Docker Containers API
Docker Exec
Docker Images
Docker Overview
Docker Entrypoint
TechNet Server Operator Scheduled Task
Cisco Umbrella DGA
Microsoft GetAllTrustRelationships
ICANNDomainNameHijacking
Palo Alto Unit 42 Domain Shadowing 2022
ASERT Donot March 2018
Mandiant URL Obfuscation 2023
mandiant-masking
Schema-abuse
Donut Github
Introducing Donut
Dotnet.exe - LOLBAS Project
cyberproof-double-bounce
FireEye APT41 Aug 2019
FireEye APT41 2019
Malwarebytes IssacWiper CaddyWiper March 2022
Crowdstrike-leaks
tlseminar_downgrade_att
LogRhythm Do You Trust Oct 2014
VNC Vulnerabilities
Accenture Dragonfish Jan 2018
Symantec Dragonfly
Symantec Dragonfly 2.0 October 2017
Symantec Dragonfly Sept 2017
Kaspersky Dridex May 2017
Dell Dridex Oct 2015
Red Canary Dridex Threat Report 2021
volexity_0day_sophos_FW
Google Drive Log Events
Microsoft Driverquery
Dropbox Malware Sync
Cyberreason Anchor December 2019
Samba DRSUAPI
dsdbutil.exe - LOLBAS Project
TechNet Dsquery
CyberBit Dtrack
Kaspersky Dtrack
Crowdstrike Qakbot October 2020
Dump64.exe - LOLBAS Project
dump_pwd_dcsync
ired mscache
ired Dumping LSA Secrets
DumpMinitool.exe - LOLBAS Project
DuplicateToken function
Wikipedia Duqu
Dxcap.exe - LOLBAS Project
TheEvilBit DYLD_INSERT_LIBRARIES
Wardle Dylib Hijacking OSX 2015
Dragos DYMALLOY
MWRInfoSecurity Dynamic Hooking 2015
rfc2131
rfc3315
Microsoft DLL Redirection
Microsoft Dynamic-Link Library Redirection
Microsoft Dynamic Link Library Search Order
Microsoft DLL Search
MSDN DLL Security
Microsoft DLL Security
Microsoft Dynamic-Link Library Security
Symantec Dyre June 2015
EA Hacked via Slack - June 2021
CrowdStrike StellarParticle January 2022
Trend Micro Muddy Water March 2021
Earthworm English Project Page
SEC EDGAR Search
Intrinsec Egregor Nov 2020
Cybereason Egregor Nov 2020
Cyble Egregor Oct 2020
NHS Digital Egregor Nov 2020
Security Boulevard Egregor Oct 2020
U.S. CISA Trends June 30 2020
Dragos EKANS
EldoS RawDisk ITpro
Microsoft Targeting Elections September 2020
Secureworks IRON RITUAL USAID Phish May 2021
Electron Security
Dragos-Sandworm-Ukraine-2022
Dragos ELECTRUM
Symantec Elfin Mar 2019
Backtrace VDSO
Securelist Machete Aug 2014
Cylance Machete Mar 2017
Sophos News September 24 2020
Power Automate Email Exfiltration Controls
HackersArise Email
Elastic - Koadiac Detection with EQL
Nccgroup Emissary Panda May 2018
Unit42 Emissary Panda May 2019
Emissary Trojan Feb 2016
Sophos Emotet Apr 2019
Deep Instinct March 10 2023
CIS Emotet Apr 2017
Binary Defense Emotes Wi-Fi Spreader
ESET Emotet Nov 2018
Trend Micro Emotet 2020
Talos Emotet Jan 2019
Cybersécurité - INTRINSEC January 09 2023
Emotet shutdown
Carbon Black Emotet Apr 2019
DanielManea Emotet May 2017
Empire Keychain Decrypt
Github EmpireProject CreateHijacker Dylib
Github EmpireProject HijackScanner
Microsoft ASR Nov 2017
Microsoft TESTSIGNING Feb 2021
Microsoft Disable DCOM
Microsoft Disable Macros
Microsoft Remote
PCMag DoubleExtension
FireEye Periscope March 2018
NCCIC AR-17-20045 February 2017
ESET Sednit Part 1
ESET Sednit Part 2
ESET Sednit Part 3
Google Ensuring Your Information is Safe
Fortinet Blog November 13 2018
Ensilo Darkgate 2018
Splunk DarkGate
Splunk DarkGate January 17 2024
Microsoft EnumDeviceDrivers
EK Clueless Agents
Deloitte Environment Awareness
MSDN Environment Property
Microsoft Environment Property
Kaspersky Equation QA
erase_cmd_cisco
Container Escape
Microsoft Esentutl
LOLBAS Esentutl
ESET Twitter Ida Pro Nov 2021
ESET PowerPool Code October 2020
ESET FinFisher Jan 2018
ESET Trickbot Oct 2020
WeLiveSecurity April 19 2022
Riskiq Remcos Jan 2018
EventLog_Core_Technologies
ISACA Malware Tricks
ThreatStream Evasion Analysis
Anomali Evasive Maneuvers July 2015
Unit42 OilRig Playbook 2023
Microsoft EventLog.Clear
evt_log_tampering
Microsoft ETW May 2018
Eventvwr.exe - LOLBAS Project
Secure Ideas SMB Relay
CSV Excel Macro Injection
Avertium callback phishing
Intezer Aurora Sept 2017
Cyphort EvilBunny Dec 2014
Evil Clippy May 2019
Cyble August 19 2022
Evilginx 2 July 2018
Evilginx Sources & Methods December 2023
SentinelOne EvilQuest Ransomware Spyware 2020
Cisco Synful Knock Evolution
SCILabs URSA/Mispadu Evolution 2023
Securelist JSWorm
S2 Grupo TrickBot June 2017
Unit 42 Valak July 2020
Microsoft - Device Registration
Amnesty OAuth Phishing Attacks, August 2019
RSAC 2015 Abu Dhabi Stefano Maccaglia
Microsoft Iranian Threat Actor Trends November 2021
Palo Alto Unit 42 VBA Infostealer 2014
Trend Micro Black Basta May 2022
Mandiant Glyer APT 2010
Excel.exe - LOLBAS Project
Microsoft Tim McMichael Exchange Mail Forwarding 2
DFIR Phosphorus November 2021
Mandiant UNC2596 Cuba Ransomware February 2022
ExchangePowerShell Module
ESET Exchange Mar 2021
Executable Installers are Vulnerable
Seclists Kanthak 7zip Installer
Redxorblue Remote Template Injection
Microsoft PSfromCsharp APR 2014
PAM Creds
Microsoft Expand Utility
LOLBAS Expand
Mandiant CVE-2023-3519 Exploitation
Exploit Database
Rhino Labs Cloud Image Backdoor Technique Sept 2019
Azure AD PTA Vulnerabilities
Exploiting Smartphone USB
versprite xpc vpn
Explorer.exe - LOLBAS Project
Palo Alto Unit 42 Google Workspace Domain Wide Delegation 2023
Trend Micro Emotet Jan 2019
SecurityTrails Google Hacking
Medium SSL Cert
Google EXOTIC LILY March 2022
Microsoft POLONIUM June 2022
External to DA, the OS X Way
Extexport.exe - LOLBAS Project
Extrac32.exe - LOLBAS Project
Journey into IR ZeroAccess NTFS EA
Bizeul 2014
Facad1ng
ThreatPost Social Media Phishing
SentinelLabs reversing run-only applescripts 2021
Sentinel Labs
ESET OceanLotus Mar 2019
ZScaler BitB 2020
FalconFeedsio Tweet October 9 2023
FalconFeedsio Tweet September 28 2023
falconoverwatch_blackcat_attack
CitizenLab Tropic Trooper Aug 2018
CISA AA20-239A BeagleBoyz August 2020
Fast Flux - Welivesecurity
MehtaFastFluxPt1
MehtaFastFluxPt2
FBI-BEC
FBI Flash FIN7 USB
FBI Lazarus Stake.com Theft Attribution September 2023
Hakobyan 2009
Google Federating GC
Kaspersky Ferocious Kitten Jun 2021
Fidelis njRAT June 2013
Fidelis INOCNATION
Securelist fileless attacks Feb 2017
Airbus Security Kovter Analysis
Microsoft Fileless
enigma0x3 Fileless UAC Bypass
enigma0x3 sdclt bypass
Microsoft File Mgmt
Microsoft File Streams
file_upload_attacks_pt2
Microsoft GPO Security Filtering
FireEye FIN10 June 2017
Mandiant FIN12 Group Profile October 07 2021
Mandiant FIN12 Oct 2021
CERTFR-2023-CTI-007
Mandiant FIN13 Aug 2022
FireEye FIN4 Stealing Insider NOV 2014
Visa FIN6 Feb 2019
SentinelOne FrameworkPOS September 2019
SecureList Griffon May 2019
Threatpost Lizar May 2021
FireEye FIN7 April 2017
Mandiant FIN7 April 4 2022
Mandiant FIN7 Apr 2022
Gemini FIN7 Oct 2021
Flashpoint FIN 7 March 2019
FireEye FIN7 March 2017
Morphisec FIN7 June 2017
Esentire 5 8 2024
CyberScoop FIN7 Oct 2017
Bitdefender FIN8 BADHATCH Report
BitDefender BADHATCH Mar 2021
Bitdefender Sardonic Aug 2021
Symantec FIN8 Jul 2023
DiginotarCompromise
FireEye Financial Actors Moving into OT
MITRECND FindAPIHash
Expel IO Evil in AWS
Evil WMI
SANS Decrypting SSL
ADSecurity Finding Passwords in SYSVOL
Findstr.exe - LOLBAS Project
FinFisher Citation
Microsoft FinFisher March 2018
FinFisher exposed
Finger.exe - LOLBAS Project
FireEye Cyber Threats to Media Industries
FireEye DLL Side-Loading
FireEye Shamoon Nov 2016
FireEye Ryuk and Trickbot January 2019
DarkReading FireEye SolarWinds
FireEye FinSpy Sept 2017
RiskIQ Cobalt Jan 2018
Chrome Extension Crypto Miner
Aquasec Kubernetes Attack 2023
ESET-Twitoor
Microsoft Azure AD Admin Consent
NTT Security Flagpro new December 2021
Kaspersky Flame Functionality
Crysys Skywiper
Symantec Beetlejuice
Microsoft Flax Typhoon August 24 2023
fltMC.exe - LOLBAS Project
IranThreats Kittens Dec 2017
MSTIC FoggyWeb September 2021
Following the CloudTrail: Generating strong AWS security signals with Sumo Logic
Group IB RTM August 2019
TrendMicro BlackTech June 2017
FireEye FIN6 April 2016
ESET FontOnLake Analysis 2021
amnesty_nso_pegasus
Microsoft Forfiles Aug 2016
Forfiles.exe - LOLBAS Project
Mandiant Log4Shell March 28 2022
Proofpoint March 24 2023
Symantec Seaduke 2015
Register Uber
format_cmd_cisco
Quick Heal Blog February 17 2023
Fortinet Zero-Day and Custom Malware Used by Suspected Chinese Actor in Espionage Operation
Mandiant Fortinet Zero Day
macOS Foundation
SentinelOne Lazarus macOS July 2020
DOJ Russia Targeting Critical Infrastructure March 2022
ClearkSky Fox Kitten February 2020
FSISAC FraudNetDoS September 2012
MalwareBytes Ngrok February 2020
ESET ComRAT May 2020
Azure AD to AD
blackmatter_blackcat
Unit42 Malware Roundup December 29 2023
Reaqta Mavinject
IBM MegaCortex
BiZone Lizar May 2021
Kaspersky StoneDrill 2017
FsiAnyCpu.exe - LOLBAS Project
Fsi.exe - LOLBAS Project
fsutil_behavior
Fsutil.exe - LOLBAS Project
Microsoft FTP
Linux FTP
Ftp.exe - LOLBAS Project
Microsoft WMI Filters
Cybersecurity Advisory SVR TTP May 2021
RiskIQ Cobalt Nov 2017
Unit 42 PingPull Jun 2022
Microsoft GALLIUM December 2019
Symantec Gallmaker Oct 2018
TrendMicro Gamaredon April 2020
ESET Gamaredon June 2020
CERT-EE Gamaredon January 2021
Kaspersky Winnti June 2015
WeLiveSecurity Gapz and Redyms Mar 2013
theevilbit gatekeeper bypass 2021
Kaspersky Gauss Whitepaper
Kaspersky MoleRATs April 2019
ESET Gazer Aug 2017
file_sig_table
Google Cloud Add Metadata
Google Compute Instances
GCP SSH Key Add
Google Cloud - IAM Servie Accounts List API
ESET Gelsemium June 2021
TechNet Scheduled Task Events
Ebowla: Genetic Malware
Proofpoint NETWIRE December 2020
Hartrell cd00r 2002
Kubectl Exec Get Shell
Microsoft getglobaladdresslist
Jay GetHooks Sept 2011
Microsoft Get-InboxRule
Microsoft Msolrole
Microsoft msolrolemember
JumpCloud Conditional Access Policies
rowland linux at 2019
Elastic GuLoader December 5 2023
BlackHatRobinSage
AADInternals Root Access to Azure VMs
Wardle Dylib Hijack Vulnerable Apps
2 - appv
MSDN VBA in Office
Windows Getting Started Drivers
Bloxham
Microsoft GetWindowLong function
Microsoft GFlags Mar 2017
GfxDownloadWrapper.exe - LOLBAS Project
GhostToken GCP flaw
GitHub ADRecon
GitHub BeichenDream BadPotato
GitHub Chisel
Github evilginx2
GitHub evilginx2 - Duplicate
GitHub Malleable C2
GitHub masscan
GitHub meganz MEGAsync
GitHub - NYAN-x-CAT/AsyncRAT-C-Sharp: Open-Source Remote Administration Tool For Windows C
GitHub ohpe Juicy Potato
code_persistence_zsh
Github PowerShell Empire
GitHub Pupy
GitHub purple-team-attack-automation - Available Modules
GitHub random_c2_profile
GitHub ransomware_map
GitHub rsockstun
GitHub secretsdump
GitHub SharpChromium
GitHub SharpHound
GitHub SharpRoast
GitHub SILENTTRINITY March 2022
GitHub SoftEtherVPN SoftEtherVPN_Stable
GitHub Terminator
GitHub xmrig-proxy
GitHub Gitrob
FireEye DNS Hijack 2019
McAfee Night Dragon
GMER Rootkits
Gnome Remote Desktop grd-settings
Gnome Remote Desktop gschema
MITRE Trustworthy Firmware Measurement
Secureworks Gold Blackburn Mar 2022
Secureworks GOLD CABIN
McAfee Gold Dragon
Cyberark Golden SAML
Trustwave GoldenSpy2 June 2020
Secureworks GOLD KINGSWOOD Threat Profile
MSTIC NOBELIUM Mar 2021
Secureworks GOLD NIAGARA Threat Profile
Secureworks Gold Prelude Profile
Secureworks GOLD SAHARA
Secureworks GOLD SOUTHFIELD
Google Chrome Remote Desktop
Google Cloud Identity API Documentation
GCPBucketBrute
ExploitDB GoogleHacking
Freejacked
Google Workspace Global Access List
Trend Micro January 09 2023
Sophos Gootloader
SentinelLabs Gootloader June 2021
Cybereason Gootloader February 2023
SentinelOne 1 16 2023
Unit 42 CARROTBAT January 2020
Secureworks BRONZE SILHOUETTE May 2023
FireEye HAWKBALL Jun 2019
CISA AA20-296A Berserk Bear December 2020
Obscuresecurity Get-GPPPassword
Microsoft gpresult
Gpscript.exe - LOLBAS Project
ESET Grandoreiro April 2020
IBM Grandoreiro April 2020
AWS PassRole
Microsoft Azure Storage Shared Access Signature
CopyFromScreen .NET
Talos GravityRAT
FireEye PowerShell Logging
FireEye PowerShell Logging 2016
Glitch-Cat Green Lambert ATTCK Oct 2021
GreenMwizi - Kenyan scamming campaign using Twitter bots
ESET GreyEnergy Oct 2018
GRIZZLY STEPPE JAR
Citizen Lab Group5
Group-IB Threat Intelligence Tweet October 9 2023
TechNet Group Policy Basics
Microsoft GPP 2016
groups man page
Venafi SSH Key Abuse
Wikibooks Grsecurity
TrueSec Gsecdump
GTFOBins Suid
GTFObins at
Fortinet Moses Staff February 15 2022
Microsoft Log4j Vulnerability Exploitation December 2021
Unit 42 NETWIRE April 2020
H0lyGh0st - North Korean Threat Group Strikes Back With New Ransomware
Cisco H1N1 Part 1
Cisco H1N1 Part 2
Wired Magecart S3 Buckets, 2019
Wired Uber Breach
Trendmicro NPM Compromise
Data Destruction - Threat Post
Bloomberg Scattered Spider May 8 2024
Salesforce zero-day in facebook phishing attack
Fortune Dragonfly 2.0 Sept 2017
Wired Cyber Army of Russia April 17 2024
Huntress API Hash
BleepingComputer Agent Tesla steal wifi passwords
SWAT-hospital
PCMag FakeLogin
Krebs-Bazaar
BleepingComputer Molerats Dec 2020
Microsoft Hacking Team Breach
Intel HackingTeam UEFI Rootkit
TrendMicro Hacking Team UEFI
TempertonDarkHotel
FireEye Hacking FIN4 Video Dec 2014
FireEye Hacking FIN4 Dec 2014
Malwarebytes OSINT Leaky Buckets - Hioureas
Microsoft Gsecdump
Microsoft HAFNIUM March 2020
haking9 libpcap network sniffing
FireEye APT29
FireEye Hancitor
NCC Group Fivehands June 2021
Apple Developer Doco Hardened Runtime
FireEye APT34 July 2019
GitHub Hashjacking
FireEye HawkEye Malware July 2017
Specter Ops - Cloud Credential Storage
Securelist Dtrack2
Securelist Dtrack
Baggett 2012
Help eliminate unquoted path
Default VBS macros Blocking
Twitter CMSTP Usage Jan 2018
ESET Hermetic Wiper February 2022
SentinelOne Hermetic Wiper February 2022
Dragos Hexane
Sourceforge Heyoka 2022
Hh.exe - LOLBAS Project
CrowdStrike BloodHound April 2018
McAfee Bankshot
Pfammatter - Hidden Inbox Rules
Hidden VNC
Intezer HiddenWasp Map 2019
Apple Support Hide a User Account
Malwarebytes Wow6432Node 2016
FireEye APT17
Crowdstrike Hiding in Plain Sight 2018
Hiding Malicious Code with Module Stomping
SpectorOps Hiding Reg Jul 2017
FireEye SUNBURST Backdoor December 2020
Redirectors_Domain_Fronting
Synack Secure Kernel Extension Broken
Unit 42 Hildegard Malware
Drakonia HInvoke
Hive Ransomware Analysis | Kroll
Microsoft CurrentControlSet Services
microsoft_services_registry_tree
Accenture Hogfish April 2018
Proofpoint Router Malvertising
Trustwave Honeypot SkidMap 2023
Microsoft Hook Overview
SpectorOps Host-Based Jul 2017
Crowdstrike AWS User Federation Persistence
Andy Greenberg June 2017
Symantec Digital Certificates
ADSecurity Silver Tickets
Amazon S3 Security, 2019
Microsoft Connection Manager Oct 2009
Kaspersky-masking
dns_changer_trojans
Entrust Enable CAPI2 Aug 2017
Apple Culprit Access
SFX - Encrypted/Encoded File
DOJ FIN7 Aug 2018
Charles McLellan March 2016
Cyware Social Media
malware_hides_service
S1 macOs Persistence
sentinelone macos persist Jun 2019
Kaspersky Autofill
Microsoft Threat Actor Naming July 2023
Microsoft Threat Actor Naming
TheEclecticLightCompany apple notarization
SentinelOne AppleScript
SecureWorld - How Secure Is Your Slack Channel - Dec 2021
Windows OS Hub RDP
Xpn Argue Like Cobalt 2019
Seqrite DoubleExtension
BOA Telephone Scams
bypass_webproxy_filtering
Systemd Remote Control
Microsoft Admin Shares
Delpy Mimikatz Crendential Manager
Stealthbits Overpass-the-Hash
Stealthbits Detect PtT 2019
WindowsIR Anti-Forensic Techniques
Microsoft Disable Autorun
Superuser Linux Password Policies
Confluence Linux Command Line
Atlassian Confluence Logging
Remote Shell Execution in Python
Find Wi-Fi Password on Mac
Microsoft Web Root OCT 2016
Microsoft Replication ACL
Hide GDM User Accounts
Elastic COM Hijacking
Elastic Masquerade Ball
Linux Loadable Kernel Module Insert and Remove LKMs
DigiCert Install SSL Cert
HowToGeek ShowExtension
Microsoft RDP Removal
Startup Items Eclectic
Podman Systemd
CrowdStrike Endpoint Security Testing Oct 2021
Microsoft Disable VBA Jan 2020
Microsoft Regsvr32
Microsoft SAM
AWS Traffic Mirroring
Symantec Hydraq Persistence Jan 2010
Microsoft UAC Nov 2018
TechNet How UAC Works
PWC WellMess July 2020
Google Election Threats October 2020
Microsoft Credential Guard April 2017
NPPSPY Video
BleepingComputer HPE January 24 2024
Cylance Sodinokibi July 2019
Wikipedia HTML Application
MSDN HTML Applications
Microsoft HTML Help ActiveX
Outlflank HTML Smuggling 2018
CrowdStrike Linux Rootkit
Wikipedia HPKP
Cobalt Strike Arguments 2019
Talos Discord Webhook Abuse
Red Canary Emotet Feb 2019
TechNet Removable Media Control
Chromium HSTS
CISA AA20-301A Kimsuky
FireEye Targeted Attacks Middle East Banks
Forbes Dyre May 2017
Microsoft Subscription Hijacking 2022
crowdstrike bpf socket filters
Koczwara Beacon Hunting Sep 2021
Fireeye Hunting COM June 2019
Berba hunting linux systemd
Elastic HuntingNMemory June 2017
LogPoint Hunting LockBit
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023
Falcon Sandbox smp: 28553b3a9d
Wikipedia Hypervisor
FireEye ADFS
AWS IAM Conditions
AWS EKS IAM Roles for Service Accounts
Kaspersky IAmTheKing October 2020
Amazon IAM Groups
IAPP
CrowdStrike IceApple May 2022
ICIT China's Espionage Jul 2016
CISA ICS Advisory ICSA-10-272-01
US-CERT Ukraine Feb 2016
Dragos Threat Report 2020
id man page
Cisco Advisory SNMP v3 Authentication Vulnerabilities
Resource and Data Forks
AWS Identity Federation
Microsoft GetNCCChanges
Ie4uinit.exe - LOLBAS Project
Ieadvpack.dll - LOLBAS Project
iediagcmd.exe - LOLBAS Project
Wikipedia 802.1x
Ieexec.exe - LOLBAS Project
Ieframe.dll - LOLBAS Project
Wikipedia Ifconfig
EFF Manul Aug 2016
IIS Backdoor 2011
Microsoft IIS Modules Overview 2007
Proofpoint TA456 Defense Contractor July 2021
Ilasm.exe - LOLBAS Project
anomali-rocke-tactics
Microsoft Dev Blog IFEO Mar 2010
IMEWDBLD.exe - LOLBAS Project
Imminent Unit42 Dec2019
Core Security Impacket
Impacket Tools
EK Impeding Malware Analysis
Microsoft Impersonation and EWS in Exchange
Microsoft Implementing CPL
TechNet Least Privilege
Dragos IT ICS Ransomware
Microsoft SolarWinds Steps
White House Imposing Costs RU Gov April 2021
Malicious Driver Reporting Center
Unit 42 Inception November 2018
Symantec Inception Framework March 2018
Expel AWS Attacker
Dark Reading Microsoft 365 Attacks 2021
Cisco Talos Q2 Trends July 26 2023
U.S. CISA Increased Truebot Activity July 6 2023
Increasing Linux kernel integrity
TechNet Scheduling Priority
Revil Independence Day
Fortinet Agent Tesla June 2017
NCC Group Team9 June 2020
Trend Micro APT Attack Tools
Symantec Suckfly May 2016
Joint CSA AvosLocker Mar 2022
FBI Flash Diavol January 2022
FBI Ragnar Locker 2020
FBI FLASH APT39 September 2020
US District Court Indictment GRU Oct 2018
Checkpoint IndigoZebra July 2021
HackerNews IndigoZebra July 2021
3 - appv
Check Point Meteor Aug 2021
Crowdstrike EvilCorp March 2021
Industroyer2 ESET April 2022
Industroyer2 Blackhat ESET
Industroyer2 Mandiant April 2022
Sixdub PowerPick Jan 2016
Infdefaultinstall.exe - LOLBAS Project
Trend Micro Exposed Docker APIs
SentinelOne MacMa Nov 2021
SANS Information Security Reading Room Securing SNMP Securing SNMP
InfoSec Handlers Diary Blog - SANS Internet Storm Center
Symantec Catchamas April 2018
TrendMicro Ursnif File Dec 2014
ThreatConnect Infrastructure Dec 2020
elastic.co 6 21 2023
Init Man Page
Proofpoint RTF Injection
HighTech Bridge Inline Hooking Sept 2011
Stuart ELF Memory
ASERT InnaputRAT April 2018
Microsoft Holmium June 2020
Metabase Q Mispadu Trojan 2023
RiskIQ British Airways September 2018
Arbor AnnualDoSreport Jan 2018
FireEye APT33 Sept 2017
Microsoft Installation Procedures
Installer Package Scripting Rich Trouton
Microsoft Install Password Filter n.d
Microsoft Unsigned Driver Apr 2017
LOLBAS Installutil
MSDN InstallUtil
AWS Instance Identity Documents
AWS Instance Metadata API
RedLock Instance Metadata API 2018
Nick Tyrer GitHub
Intel Hardware-based Security Technologies
Red Canary Intelligence Insights July 20 2023
checkpoint_interactive_map_apt-c-23
Microsoft ISAPI Extension All Incoming 2017
Clymb3r Function Hook Passwords Sept 2013
Microsoft ICMP
Linux IPC
HackerNews - 3 SaaS App Cyber Attacks - April 2022
RedCanary Mockingbird May 2020
Fidelis Hi-Zor
Roadtools
Talos ROKRAT
Microsoft Open XML July 2017
Securelist WhiteBear Aug 2017
MalwareBytes ADS July 2015
Apple AppleScript
Microsoft Outlook Files
Microsoft Intro Print Processors
Microsoft Services
Red Canary NETWIRE January 2020
Discord Intro to Webhooks
GitHub Inveigh
Summit Route Malicious AMIs
inv_ps_attacks
Kazanciyan 2014
Beek Use of VHD Dec 2020
ESET InvisiMole June 2018
ESET InvisiMole June 2020
GitHub OmerYa Invisi-Shell
Invoke-DOSfuscation
PowerSploit Invoke Kerberoast
Empire InvokeKerberoast Oct 2016
Github PowerSploit Ninjacopy
Invoke-Obfuscation
GitHub Invoke-Obfuscation
GitHub PSImage
GitHub Invoke-PSImage
GitHub - PowerSploit Invoke-Shellcode
Wikipedia Xen
iOS URL Scheme
TechNet Ipconfig
cisco_ip_ssh_pubkey_ch_cmd
Symantec Chafer Dec 2015
CISA AA20-259A Iran-Based Actor September 2020
U.S. CISA Iran Voter Data November 3 2020
ClearSky MuddyWater June 2019
Talos MuddyWater Jan 2022
BitDefender Chafer May 2020
DHS CISA AA22-055A MuddyWater February 2022
U.S. CISA Advisory November 25 2022
U.S. CISA Iranian Government Actors November 19 2021
NEWSCASTER2014
CYBERCOM Iranian Intel Cyber January 2022
U.S. CISA IRGC Actors September 14 2022
Secureworks Cobalt Gypsy Feb 2017
ClearSky OilRig Jan 2017
FireEye MuddyWater Mar 2018
Check Point APT34 April 2021
Dark Reading APT39 JAN 2019
U.S. CISA IRGC-Affiliated PLC Activity December 2023
Secureworks IRON HEMLOCK Profile
Secureworks IRON HUNTER Profile
Secureworks IRON LIBERTY
Unit 42 IronNetInjector February 2021
Secureworks IRON RITUAL Profile
Trend Micro Iron Tiger April 2021
Lunghi Iron Tiger Linux
Secureworks IRON TILDEN Profile
Secureworks IRON TWILIGHT Profile
Secureworks IRON TWILIGHT Active Measures March 2017
Secureworks IRON VIKING
ESET Hermetic Wizard March 2022
Microsoft ISAPICGIRestriction 2016
Microsoft ISAPI Extension Overview 2017
Microsoft ISAPI Filter Overview 2017
welivesecurity TCC
iSight Sandworm Oct 2014
CrySyS Blog TeamSpy
NYTStuxnet
Microsoft Issues with BITS July 2011
Ready.gov IT DRP
Security Intelligence ITG08 April 2020
Talos Frankenstein June 2019
AdSecurity Forging Trust Tickets
It’s Always DarkGate Before the Dawn
CitizenLab KeyBoy Nov 2016
Twitter ItsReallyNick Status Update APT32 PubPrn
Volexity Ivanti Global Exploitation January 2024
Trend Micro IXESHE 2012
James TermServ DLL
Jamfsoftware 3 29 2024
Symantec Cicada November 2020
Carbon Black JCry May 2019
ClearSky CopyKittens March 2017
Joe Sandbox 23893f035f8564dfea5030b9fdd54120d96072bb
Joe Slowik August 2019
US District Court of DC Phosphorus Complaint 2019
NCSC Joint Report Public Tools
USG Joint Statement SolarWinds January 2021
Jsc.exe - LOLBAS Project
Juniper Netscreen of the Dead
Microsoft PS JEA
Justice GRU 2024
U.S. Justice Department GRU Botnet February 2024
Azure Active Directory Reconnaisance
Azure AD Recon
intezer-kaiji-malware
Kali Redsnarf
TrustedSignal Service Failure
Kansa Service related collectors
U.S. CISA Karakurt December 12 2023
CISA Karakurt 2022
Kaspersky Lab SynAck May 2018
Unit 42 Kazuar May 2017
Citizen Lab Stealth Falcon May 2016
Github KeeThief
Kekeo
Harmj0y Kerberoast Nov 2016
ADSecurity Kerberos Ring Decoder
macOS kerberos framework MIT
Microsoft Kerberos Golden Ticket
CERT-EU Golden Ticket Protection
AdSecurity Kerberos GT Aug 2015
ADSecurity Kerberos and KRBTGT
Microsoft Kerberos Preauth 2014
Linux Kerberos Tickets
Kernel Self Protection Project
Rapid7 KeyBoy Jun 2013
Keychain Items Apple Dev API
Keychain Services Apple
Wikipedia keychain
Keyctl-unmask
Google Cloud Encryption Key Rotation
KillDisk Ransomware
Trend Micro KillDisk 1
Trend Micro KillDisk 2
Killing IOS diversity myth
Killing the myth of Cisco IOS rootkits
Vedere Labs Killnet 2022
Flashpoint Glossary Killnet
Malwarebytes Kimsuky June 2021
Kimsuky Malwarebytes
VirusBulletin Kimsuky October 2019
EST Kimsuky April 2019
ThreatConnect Kimsuky September 2020
BRI Kimsuky April 2019
Microsoft Klist
FireEye Know Your Enemy FIN8 Aug 2016
Github Koadic
ESET Kobalos Feb 2021
Talos Konni May 2017
Malwarebytes KONNI Evolves Jan 2022
Talos Group123
Kube Kubectl
Kubernetes Kubelet
Kubernetes CronJob
Kubernetes Hardening Guide
Kubernetes Jobs
AppSecco Kubernetes Namespace Breakout 2020
Kubernetes Dashboard
Intezer App Service Phishing
Alintanahin 2014
Wits End and Shady PowerShell Profiles
AWS Lambda Execution Role
NCC Group LAPSUS Apr 2022
BBC LAPSUS Apr 2022
Enigma Excel DCOM Sept 2017
Enigma Outlook DCOM Lateral Movement Nov 2017
Enigma MMC20 COM Jan 2017
Enigma DCOM Lateral Movement Jan 2017
Jacobsen 2014
Launchctl Man
LaunchDaemon Hijacking
launchd Keywords for plists
Launch Services Apple Developer
Launch Service Keys Developer Apple
Launch-VsDevShell.ps1 - LOLBAS Project
MalwareBytes Lazarus-Andariel Conceals Code April 2021
Lazarus RATANKBA
ATT Lazarus TTP Evolution
TrendMicro Lazarus Nov 2018
F-Secure Lazarus Cryptocurrency Aug 2020
Lazarus KillDisk
ESET Lazarus KillDisk April 2018
McAfee Lazarus Resurfaces Feb 2018
Kaspersky ThreatNeedle Feb 2021
Kaspersky Lazarus Under The Hood Blog 2017
Kaspersky Lazarus Under The Hood APR 2017
Secureworks Emotet Nov 2018
MalwareBytes LazyScripter Feb 2021
Ldifde.exe - LOLBAS Project
Ldifde Microsoft
Symantec Leafminer July 2018
Proofpoint TA505 Mar 2018
Microsoft Purview Data Loss Prevention
Medium DnsTunneling
Learn XPC Exploitation
ClearSky Lebanese Cedar Jan 2021
Mandiant UNC3313 Feb 2022
LemonDuck
Twitter Leoloobeek Scheduled Task
TLDRSec AWS Attacks
Let's Encrypt FAQ
OSX Malware Detection
xorrior emond Jan 2018
Cyberreason DCOM DDE Lateral Movement Nov 2017
Proofpoint Leviathan Oct 2017
LIBC
libzip
Symantec Darkmoon Sept 2014
Wikipedia LLMNR
IzyKnows auditd threat detection 2022
Fysbis Dr Web Analysis
GDSecurity Linux injection
GDS Linux Injection
Linux/Cdorked.A We Live Security Analysis
Avast Linux Trojan Cron Persistence
BH Linux Inject
PAM Backdoor
Linux Password and Shadow File Formats
nixCraft - John the Ripper
Polop Linux PrivEsc Gitbook
setuid man page
Man LD.SO
BleepingComputer 12 3 2023
Uninformed Needle
List Blobs
ListObjectsV2
Wikipedia File Header Signatures
Wikipedia OSI
AWS List Roles
Google Cloud Secrets
Peripheral Discovery Linux
AWS List Users
Sophos PowerShell command audit
Dell TG-1314
Symantec Living off the Land
LOLBAS Main Site
LOLBAS Project
FireEye 2019 Apple Remote Desktop
LKM loading kernel restrictions
Rapid7 LLMNR Spoofer
Wikipedia Loadable Kernel Module
Microsoft LoadLibrary
Microsoft Local Accounts Feb 2019
Sternsecurity LLMNR-NBTNS
Sophos Geolocation 2016
ASEC BLOG November 08 2022
VMWare LockBit 3.0 October 2022
Sentinel Labs LockBit 3.0 July 2022
Cyble LockBit 3.0 July 2022
Cary Esentutl
Group IB Ransomware September 2020
AWS Cloud Trail Backup API
AWS Logging IAM Calls
Login Items AE
LoginWindowScripts Apple Dev
LogMeIn Homepage
LogonUserW function
ESET LoJax Sept 2018
Morphisec Lokibot April 2020
t1105_lolbas
Lolbin Ssh.exe Use As Proxy
Qualys LolZarus
Bitdefender Trickbot C2 infra Nov 2020
Proofpoint LookBack Malware Aug 2019
Fidelis DarkComet
BlackHat Process Doppelgänging Dec 2017
ESET LoudMiner June 2019
GitHub Mimikatz Issue 92 June 2017
Deep Instinct LSASS
lsmod man
Unit 42 Lucifer June 2020
Securelist LuckyMouse June 2018
lucr-3: Getting SaaS-y in the cloud
Permiso Scattered Spider 2023
Kaspersky LuminousMoth July 2021
Bitdefender LuminousMoth July 2021
Unit42 Luna Moth
sygnia Luna Month
Zscaler Lyceum DnsSystem June 2022
Kaspersky Lyceum October 2021
SecureWorks August 2019
CoinTicker 2019
ESET Machete July 2019
synack 2016 review
objsee mac malware 2017
Unit42 CookieMiner Jan 2019
Unit 42 Mac Crypto Cookies January 2019
MacKeeper Bundlore Apr 2019
MalwareUnicorn macOS Dylib Injection MachO
macOS Hierarchical File System Overview
Add List Remove Login Items Apple Script
SentinelOne 9 11 2023
macOS MS office sandbox escape
MDSec macOS JXA and VSCode
SentinelOne macOS Red Team
Lockboxx ARD 2019
nixCraft macOS PATH variables
SensePost MacroLess DDE Oct 2017
Macro Malware Targets Macs
alientvault macspy
Reed thiefquest fake ransom
reed thiefquest ransomware analysis
Malwarebytes 9 6 2023
Objective See Green Lambert for OSX Oct 2021
Trend Micro FIN6 October 2019
Unit 42 Magic Hound Feb 2017
AMD Magic Packet
MagicWeb
MAGNET GOBLIN
FireEye FIN7 Oct 2019
Microsoft Mail Flow Rules 2023
GitHub MailSniper
mailx man page
enigma0x3 normal.dotm
NetSPI Startup Stored Procedures
QR-cofense
Cofense-redirect
Makecab.exe - LOLBAS Project
Infoblox Lokibot January 2019
U.S. CISA PaperCut May 2023
GoBotKR
ICEBRG Chrome Extensions
McAfee Malicious Doc Targets Pyeongchang Olympics
Fortinet Fareit
Microsoft OAuth Spam 2022
Zscaler Kasidet
SilentBreak Outlook Rules
Webroot PHP 2011
CISA ComRAT Oct 2020
Malware Analysis Report ComRAT
CISA Zebrocy Oct 2020
CISA Supernova Jan 2021
UK NCSC Jaguar Tooth April 18 2023
US-CERT SHARPKNOT June 2018
US-CERT Bankshot Dec 2017
US-CERT Volgmer 2 Nov 2017
US-CERT HARDRAIN March 2018
US-CERT BADCALL
CISA MAR SLOTHFULMEDIA October 2020
Kroll RawPOS Jan 2017
VMRay OSAMiner dynamic analysis 2021
Arch Linux Package Systemd Compromise BleepingComputer 10JUL2018
Alperovitch Malware
Chrome Extension C2 Malware
FireEye Kevin Mandia Guardrails
TechRepublic M-Trends 2023
CTU BITS Malware June 2016
CyberBit System Calls
Malware Monday VBE
RSAC 2015 San Francisco Patrick Wardle
Malware Persistence on OS X
FireEye Hijacking July 2010
Mondok Windows PiggyBack BITS May 2007
Conficker Nuclear Power Plant
MMPC ISAPI Filter 2012
Leonardo Turla Penquin May 2020
Malware System Language Check
JPCert TSCookie March 2018
Symantec BITS May 2007
JPCert BlackTech Malware September 2019
Unit 42 Rocke January 2019
Manage-bde.wsf - LOLBAS Project
Microsoft Manage Device Identities
Microsoft MOF May 2018
Microsoft Inbox Rules
Google Workspace External Sharing
Google Cloud Just in Time Access 2023
Microsoft Manage Mail Flow Rules 2023
Office 365 Partner Relationships
Microsoft 365 External Sharing
TechNet Trusted Publishers
Microsoft Enable Cred Guard April 2017
Outlook File Sizes
Microsoft Managing WebDAV Security
Mandiant M Trends 2011
Mandiant M Trends 2016
FireEye APT35 2018
Mandiant WMI
MSDN Manifests
Microsoft Manifests
Wikipedia Man in the Browser
Kaspersky Encyclopedia MiTM
Rapid7 MiTM Basics
mitm_tls_downgrade_att
Praetorian TLS Downgrade Attack 2014
InsiderThreat ChangeNTLM July 2017
Kaspersky ManOnTheSide
symantec_mantis
CrowdStrike Manufacturing Threat July 2020
US-CERT TYPEFRAME June 2018
US-CERT KEYMARBLE Aug 2018
US-CERT HOPLIGHT Apr 2019
US-CERT HOTCROISSANT February 2020
CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020
CISA MAR-10292089-1.v2 TAIDOOR August 2021
US-CERT BLINDINGCAN Aug 2020
CISA SoreFang July 2016
CISA WellMess July 2020
CISA WellMail July 2020
CISA EB Aug 2020
CISA HatMan
Outflank MotW 2020
Masquerads-Guardio
CNET Leaks
ArsTechnica Great Firewall of China
Europol Cobalt Mar 2018
LOLBAS Mavinject
Mavinject Functionality Deconstructed
Sophos Maze VM September 2020
mbed-crypto
McAfee REvil October 2019
McAfee Sodinokibi October 2019
McAfee Sandworm November 2013
McAfee Honeybee
Secureworks MCMD July 2019
Purves Kextpocalypse 2
MDSec Brute Ratel August 2022
Secureworks NICKEL ACADEMY Dec 2017
Cybereason Nocturnus MedusaLocker 2020
HC3 Analyst Note MedusaLocker Ransomware February 2023
Bleeping Computer Medusa Ransomware March 12 2023
CyberScoop Babuk February 2021
CrowdStrike Stardust Chollima Profile April 2018
CrowdStrike VOODOO BEAR
Crowdstrike MUSTANG PANDA June 2018
CrowdStrike VENOMOUS BEAR
Crowdstrike Helix Kitten Nov 2018
Cloudflare Memcrashed Feb 2018
Github Mempdump
Palo Alto menuPass Feb 2017
FireEye MESSAGETAP October 2019
SentinelLabs Metador Technical Appendix Sept 2022
FireEye Metamorfo Apr 2018
Metasploit_Ref
Metasploit SSH Module
Github Rapid7 Meterpreter Elevate
Methods of Mac Malware Persistence
MFA Fatigue Attacks - PortSwigger
Mftrace.exe - LOLBAS Project
Radware Micropsia July 2018
Optiv Device Code Phishing 2021
Microsoft Midnight Blizzard January 19 2024
Microsoft ZINC disruption Dec 2017
The Hacker News Microsoft DDoS June 19 2023
Posts By SpecterOps Team Members 2 5 2024
Microsoft OAuth 2.0 Consent Phishing 2021
Microsoft Digital Defense FY20 Sept 2020
BleepingComputer DDE Disabled in Word Dec 2017
Microsoft DuplicateTokenEx
Red Canary HTA Abuse Part Deux
Microsoft HTML Help May 2018
Microsoft - Azure AD Identity Tokens - Aug 2019
Microsoft Identity Platform Access 2019
Microsoft - OAuth Code Authorization flow - June 2019
Microsoft Identity Platform Protocols May 2019
Microsoft ImpersonateLoggedOnUser
Microsoft Internal Solorigate Investigation Blog
Microsoft LogonUser
mmc_vulns
Microsoft.NodejsTools.PressAnyKey.exe - LOLBAS Project
FireEye FELIXROOT July 2018
Irongeek Sims BSides 2017
Microsoft_rec_block_rules
Microsoft WDAC
Microsoft Driver Block Rules
Microsoft driver block rules - Duplicate
Microsoft Register-WmiEvent
Microsoft DDoS Attacks Response June 2023
Microsoft Security Advisory 2269637
Microsoft 2269637
Microsoft DDE Advisory Nov 2017
Microsoft WDigest Mit
MS17-010 March 2017
MSTIC GADOLINIUM September 2020
Microsoft SIR Vol 19
Microsoft SIR Vol 21
Microsoft Threat Intelligence Tweet April 26 2023
Microsoft Threat Intelligence Tweet August 17 2023
Microsoft Threat Intelligence Tweet June 17 2020
Microsoft Threat Intelligence Tweet May 18 2023
Wikipedia Windows Library Files
Proofpoint Cobalt June 2017
Microsoft.Workflow.Compiler.exe - LOLBAS Project
InfoSecurity Sandworm Oct 2014
objective-see windtail1 dec 2018
objective-see windtail2 jan 2019
CyberScoop BlackOasis Oct 2017
Int SP - chat apps
Microsoft Security Blog 1 26 2024
Deply Mimikatz
CG 2014
ADSecurity AD Kerberos Attacks
Harmj0y DCSync Sept 2015
Harmj0y Mimikatz and DCSync
ADSecurity Mimikatz DCSync
AdSecurity DCSync Sept 2015
GitHub Mimikittenz July 2016
MimiPenguin GitHub May 2017
mimipenguin proc file
Securelist Minidionis July 2015
mining_ruby_reversinglabs
lazgroup_idn_phishing
NCSC-NL COATHANGER Feb 2024
APT15 Intezer June 2018
ESET Mispadu November 2019
ESET Security Mispadu Facebook Ads 2019
Slideshare Abusing SSH
Mitiga Security Advisory: SSM Agent as Remote Access Trojan
ACSC Email Spoofing
NSA Cyber Mitigating Web Shells
MIT ccache
MITRE SE Guide 2014
win_mmc
Mmc.exe - LOLBAS Project
Trend Micro Bouncing Golf 2019
ELF Injection May 2009
Elastic Rules macOS launchctl 2022
modinfo man
hasherezade debug
Microsoft Module Class
GitHub Mimikatz kerberos Module
GitHub Mimikatz lsadump Module
Module Stomping for Shellcode Injection
Linux Kernel Module Programming Guide
FOX-IT May 2016 Mofang
Unit42 Molerat Mar 2020
Cybereason Molerats Dec 2020
Azure - Monitor Logs
EventTracker File Permissions Feb 2014
Microsoft Silent Process Exit NOV 2017
Windows Event Forwarding Payne
GCP Monitoring Service Account Usage
Forcepoint Monsoon
Microsoft Security Blog 5 28 2024
Security Intelligence More Eggs Aug 2019
ESET EvilNum July 2020
Microsoft More information about DLL
Microsoft DLL Preloading
aptsim
Washington Post WannaCry 2017
ArsTechnica Intel
Kaspersky Winnti April 2013
polygot_icedID
CrowdStrike Deep Panda Web Shells
MoustachedBouncer ESET August 2023
ESET MoustachedBouncer
Progress Software MOVEit Transfer Critical Vulnerability
TechNet Moving Beyond EMET
ScriptingOSX zsh
Volatility Detecting Hooks Sept 2012
Mozilla Firefox Installer DLL Hijack
mozilla_sec_adv_2012
MpCmdRun.exe - LOLBAS Project
TechNet MS14-019
SRD GPP
Microsoft MS14-025
MS14-025
MSDN MSBuild
LOLBAS Msbuild
Microsoft MSBuild Inline Tasks 2017
Msconfig.exe - LOLBAS Project
Msdeploy.exe - LOLBAS Project
MSDN File Associations
Microsoft DRSR Dec 2017
Msdt.exe - LOLBAS Project
Msedge.exe - LOLBAS Project
msedge_proxy.exe - LOLBAS Project
msedgewebview2.exe - LOLBAS Project
LOLBAS Mshta
Mshtml.dll - LOLBAS Project
Microsoft msiexec
LOLBAS Msiexec
CIS Emotet Dec 2018
Microsoft NRPC Dec 2017
MsoHtmEd.exe - LOLBAS Project
Mspub.exe - LOLBAS Project
Microsoft SAMR
GitHub IAD Secure Host Baseline UAC Filtering
msxsl.exe - LOLBAS Project
XSL Bypass Mar 2019
Mandiant M-Trends 2015
MTrends 2016
Mandiant M-Trends 2020
Accenture MUDCARP March 2019
Unit 42 4 9 2024
Unit 42 MuddyWater Nov 2017
Securelist MuddyWater Oct 2018
ClearSky MuddyWater Nov 2018
TrendMicro POWERSTATS V3 June 2019
NIST MFA
Talos Cobalt Group July 2018
U.S. CISA Zoho Exploits September 7 2023
CIS Multiple SMB Vulnerabilities
GitHub Mauraena
Arbor Musical Chairs Feb 2018
Mythc Documentation
Mythic Github
Crowdstrike Mythic Leopard Profile
CheckPoint Naikon May 2020
Bitdefender Naikon April 2021
Microsoft Named Pipes
fsecure NanHaiShu July 2016
DigiTrust NanoCore Jan 2017
PaloAlto NanoCore Feb 2016
Unit42 BabyShark Feb 2019
National Vulnerability Database
NationsBuying
FireEye Maze May 2020
Talos NavRAT May 2018
GitHub NBNSpoof
SecTools nbtscan June 2003
Debian nbtscan Nov 2019
TechNet Nbtstat
NCSC Sandworm Feb 2020
7 - appv
TechNet NetBIOS
Microsoft Net
Savill 1999
Microsoft Net Utility
TechNet Netsh Firewall
Netsh.exe - LOLBAS Project
Github Netsh Helper CS Beacon
TechNet Netstat
The DFIR Report NetSupport October 30 2023
TechNet Net Time
Technet Net Use
TrendMicro Netwalker May 2020
Sophos Netwalker May 2020
McAfee Netwire Mar 2015
Windows Anonymous Enumeration of SAM Accounts
Microsoft Network access Credential Manager
Microsoft NFS Overview
Network Provider API
Malware Bytes New AgentTesla variant steals WiFi credentials
Malwarebytes Agent Tesla April 2020
TrendMicro New Andariel Tactics July 2018
Unit 42 C0d0so0 Jan 2016
Trend Micro Banking Malware Jan 2019
IBM IcedID November 2017
Minerva Labs Black Basta May 2022
Google TAG Lazarus Jan 2021
Airbus Derusbi 2015
Malwarebytes Crossrider Apr 2018
CyberBit Early Bird Apr 2018
Zscaler Molerats Campaign
CrowdStrike Wizard Spider March 2019
Bleeping Computer Evil Corp mimics PayloadBin gang 2022
Microsoft Block Office Macros
TechNet Office Macro Security
SolarWinds Sunburst Sunspot Update January 2021
BleepingComp Godlua JUL19
HTML Smuggling Menlo Security 2020
Microsoft New-InboxRule
AWS - IAM Console Best Practices
Trend Micro Ransomware February 2021
Avast CCleaner3 2018
amnesia malware
Tsunami
ClearSky Siamesekitten August 2021
Unit 42 NOKKI Sept 2018
Arghire LazyScripter
Trend Micro Cheerscrypt May 2022
Malwarebytes Higaisa 2020
New loader on the bloc - AresLoader | Intel471
Gallagher 2015
FireEye Ursnif Nov 2017
FireEye TLS Nov 2017
Antiquated Mac Malware
Trend Micro MacOS Backdoor November 2020
TrendMicro MacOS April 2018
TrendMicro macOS Dacls May 2020
OSX Malware Exploits MacKeeper
Carbon Black Shlayer Feb 2019
Palo Alto Rover
Palo Alto Reaver Nov 2017
Trend Micro Xbash Sept 2018
NKAbuse BC
MSRC Nobelium June 2021
Symantec Orangeworm April 2018
OSX.Dok Malware
OSX Keydnap malware
Intego Shlayer Apr 2018
Cybereason Linux Exim Worm
Netskope Device Code Phishing 2021
Microsoft Prestige ransomware October 2022
Unit 42 MechaFlounder March 2019
Talos Nyetya June 2017
Cyble Black Basta May 2022
Bleepingcomputer RAT malware 2020
IBM ITG18 2020
new_rogue_DHCP_serv_malware
NCSC CISA Cyclops Blink Advisory February 2022
Eweek Newscaster and Charming Kitten May 2014
Deep Instinct TA505 Apr 2019
Janicab
MSTIC NOBELIUM May 2021
Microsoft Phosphorus Mar 2019
FireEye SUNSHUTTLE Mar 2021
Blasco 2013
Malwarebytes Targeted Attack against Saudi Arabia
FireEye APT34 Dec 2017
Unit 42 Cobalt Gang Oct 2018
ESET TeleBots Oct 2018
Unit 42 DarkHydrus July 2018
Bitdefender Trickbot March 2020
Malwarebytes Konni Aug 2021
Proofpoint Vega Credential Stealer May 2018
Proofpoint Azorult July 2018
Avira Mustang Panda January 2020
Palo Alto DNS Requests
PaloAlto DNS Requests May 2016
Unit42 Azorult Nov 2018
FireEye Clandestine Fox
Twitter ItsReallyNick Platinum Masquerade
Twitter ItsReallyNick APT32 pubprn Masquerade
Twitter ItsReallyNick APT41 EK
Twitter ItsReallyNick Masquerading Update
SecureWorks NICKEL GLADSTONE profile Sept 2021
Microsoft NICKEL December 2021
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011
ProofPoint Ursnif Aug 2016
NirSoft Website
NIST Server Security July 2008
Netskope Nitol
FireEye Njw0rm Aug 2013
Nltest Manual
Nmap: the Network Mapper
Microsoft Nobelium Admin Privileges
MSTIC Nobelium Oct 2021
Symantec Noberus September 22 2022
new_rust_based_ransomware
SentinelOne NobleBaron June 2021
NodeJS
Mandiant No Easy Breach
ESET PipeMon May 2020
nohup Linux Man
Unit 42 Nokki Oct 2018
ESET Nomadic Octopus 2018
Malwarebytes Pony April 2016
WithSecure Lazarus-NoPineapple Threat Intel Report 2023
xorrior chrome extensions macOS
Cybernews Yanfeng Qilin November 2023
The Hacker News Lazarus Aug 2022
Zdnet Kimsuky Group September 2020
Volexity InkySquid BLUELIGHT August 2021
Talos Kimsuky Nov 2021
Volexity InkySquid RokRAT August 2021
Lazarus APT January 2022
Github NoRunDll
Crowdstrike TELCO BPO Campaign December 2022
CrowdStrike Scattered Spider SIM Swapping December 22 2022
Sophos Dyreza April 2015
NIST Supply Chain 2012
eSentire FIN7 July 2021
Secureworks NotPetya June 2017
SensePost NotRuler
FireEye APT29 Nov 2018
Unit 42 Cuba August 9 2022
NT API Windows
Now You Serial
Npcap: Windows Packet Capture Library & Driver
NPLogonNotify
NPPSPY
ntdsutil.exe - LOLBAS Project
Ntdsutil Microsoft
Microsoft NTFS File Attributes Aug 2010
NtQueryInformationProcess
AsyncRAT GitHub
Joe Sec Nymaim
OWASP Fingerprinting
OWASP Vuln Scanning
SecureWorks Device Code Phishing 2021
BlackHat API Packers
FireEye Obfuscation June 2017
objective-see 2017 review
Talos Oblique RAT March 2021
IBM ITG07 June 2019
Palo Alto CVE-2015-3113 July 2015
Volexity OceanLotus Nov 2017
Volexity Ocean Lotus November 2020
OceanLotus for OS X
ESET OceanLotus macOS April 2019
ESET OceanLotus
Okta HAR Files Incident Update
Securelist Octopus Oct 2018
MSTIC Octo Tempest Operations October 2023
LOLBAS Odbcconf
Microsoft odbcconf.exe
GrimBlog UsernameEnum
GitHub Office 365 User Enumeration
GitHub Office-Crackros Aug 2016
GlobalDotName Jun 2019
Microsoft VBA
OfflineScannerShell.exe - LOLBAS Project
Bitdefender Agent Tesla April 2020
Palo Alto OilRig April 2017
OilRig New Delivery Oct 2017
Palo Alto OilRig Oct 2016
Unit 42 OilRig Sept 2018
Unit42 RDAT July 2020
Unit 42 QUADAGENT July 2018
OilRig ISMAgent July 2017
Unit 42 RGDoor Jan 2018
Palo Alto OilRig Sep 2018
ESET Okrum July 2019
Talos Agent Tesla Oct 2018
Securelist Malware Tricks April 2017
Red Canary Verclsid.exe
Talos Olympic Destroyer 2018
Crowdstrike Pirate Panda April 2020
OneDriveStandaloneUpdater.exe - LOLBAS Project
Electron 6-8
chasing_avaddon_ransomware
Onion Routing
FireEye FIN7 Aug 2018
securelist_strongpity
OSX.FairyTale
Unit 42 OopsIE! Feb 2018
Proofpoint ZeroT Feb 2017
OpenConsole.exe - LOLBAS Project
Open Login Items Apple
OpenSSH Project Page
OpenSSH Server Listening On Socket
Operating with EmPyre
Windows AppleJeus GReAT
Cybereason Operation Bearded Barbie April 5 2022
Novetta Blockbuster Destructive Malware
Novetta Blockbuster Loaders
Novetta Blockbuster RATs
Novetta Blockbuster Tools
Novetta Blockbuster
FireEye Clandestine Wolf
Cylance Cleaver
PWC Cloud Hopper April 2017
PWC Cloud Hopper Technical Annex April 2017
Cybereason Cobalt Kitty 2017
Cybereason Oceanlotus May 2017
Cybereason OperationCuckooBees May 2022
Securelist ScarCruft Jun 2016
FireEye Operation Double Tap
ClearSky Lazarus Aug 2020
Cylance Dust Storm
DustySky
DustySky2
Trend Micro Tick November 2019
FireEye DeputyDog 9002 November 2013
Volexity Exchange Marauder March 2021
ESET Dukes October 2019
IssueMakersLab Andariel GoldenAxe May 2017
ESET Operation Groundbait
Operation Hangover May 2013
ESET Lazarus Jun 2020
AhnLab Kimsuky Kabar Cobra Feb 2019
Villeneuve et al 2014
Mandiant Operation Ke3chang November 2014
Cisco Operation Layover September 2021
Lotus Blossom Jun 2015
FireEye Operation Molerats
McAfee Lazarus Nov 2020
McAfee Lazarus Jul 2020
McAfee Oceansalt Oct 2018
FireEye OpPoisonedHandover February 2016
Operation Quantum Entanglement
ProofPoint GoT 9002 Aug 2017
FireEye Op RussianDoll
FireEye Operation Saffron Rose 2013
Cylance Shaheen Nov 2018
McAfee Sharpshooter December 2018
Novetta-Axiom
Cybereason Soft Cell June 2019
Azure AD Graph API
ESET Operation Spalax Jan 2021
Proofpoint TA453 July2021
Proofpoint Operation Transparent Tribe March 2016
TrendMicro TropicTrooper 2015
ClearSky and Trend Micro Operation Wilted Tulip July 2017
ClearSky Wilted Tulip July 2017
ESET Windigo Mar 2014
FoxIT Wocao December 2019
TrendMicro Operation Woolen Goldfish March 2015
Bleeping Computer Op Sharpshooter March 2019
Symantec Orangeworm IOCs April 2018
Symantec WastedLocker June 2020
Symantec Calisto July 2018
Objective-See MacMa Nov 2021
hexed osx.dok analysis 2019
malwarebyteslabs xcsset dubrobber
wardle evilquest partii
wardle evilquest parti
eset_osx_flashback
CheckPoint Dok
Intego Shlayer Feb 2018
Decoded Avast.io Follina June 3 2022
SensePost Outlook Forms
SensePost Outlook Home Page
Outlook Today Home Page
Recorded Future Beacon 2019
FireEye APT33 Guardrail
Kubernetes Cloud Native Security
Apple Doco Archive Dynamic Libraries
Apple Dev Dynamic Libraries
GCP IAM Conditions
Kubeflow Pipelines
TechNet RDP Gateway
CrowdStrike AQUATIC PANDA December 2021
OWASP Top 10 2017
OWASP Top 10
Debian Manual Maintainer Scripts
GCP Packet Mirroring
Citizenlab Packrat 2015
GitHub Pacu
Pacu Detection Disruption Module
Symantec Palmerworm Sep 2020
Apple PAM
Man Pam_Unix
Unit42 PlugX June 2017
Palo Alto PlugX June 2017
Secuirtyinbits Ataware3 May 2019
Dragos PARISITE
DOJ Lazarus Sony 2018
intezer stripped binaries elf files 2018
Gabilondo DYLD_INSERT_LIBRARIES Catalina Bypass
Office 365 Delegated Administration
Microsoft IFEOorMalware July 2015
Circl Passive DNS
ObjectiveSee AppleJeus 2019
GentilKiwi Pass the Ticket
Wikipedia Password cracking
RDP Hijacking Korznikov
ise Password Manager February 2019
Microsoft Password Complexity
BlackHillsInfosec Password Spraying
how_pwd_rev_enc_1
how_pwd_rev_enc_2
Volexity Patchwork June 2018
PaloAlto Patchwork Mar 2018
Symantec Patchwork
Trend Micro Pawn Storm OAuth 2017
TrendMicro Pawn Storm 2019
TrendMicro Pawn Storm Dec 2020
ClearSky Pay2Kitten December 2020
PaypalScam
Pcalua.exe - LOLBAS Project
pcodedmp Bontchev
GitHub PcShare 2014
Pcwrun.exe - LOLBAS Project
Pcwutl.dll - LOLBAS Project
Microsoft Peach Sandstorm 2023
Microsoft Peach Sandstorm September 14 2023
Microsoft PEB 2021
Peirates GitHub
Pentesting AD Forests
U.S. CISA BlackTech September 27 2023
U.S. CISA Volt Typhoon May 24 2023
Joint Cybersecurity Advisory Volt Typhoon June 2023
TechNet Firewall Design
Oddvar Moe IFEO APR 2018
Oddvar Moe RunOnceEx Mar 2018
Xorrior Authorization Plugins
SpecterOps JXA 2020
PersistentJXA_leopitt
Pester.bat - LOLBAS Project
TrendMicro PE_URSNIF.A2
Volatility Phalanx2
Prevailion EvilNum May 2020
GitHub Phishery
ryhanson phishery SEPT 2016
ANSSI Nobelium Phishing December 2021
QR-campaign-energy-firm
Enigma Phishing for Credentials Jan 2015
KISA Operation Muzabi
Staaldraad Phishing with OAuth 2017
phobos_virustotal
Deep Instinct PhonyC2 June 2023
Talos Remcos Aug 2018
FireEye FIN6 Apr 2019
Picus Labs Proc cump 2022
wired-pig butchering
Malwarebytes Pikabot December 15 2023
Trustwave Pillowmint June 2020
TechNet Ping
Pass The Cookie
Pktmon.exe - LOLBAS Project
Osanda Stealing NetNTLM Hashes
Microsoft PLATINUM June 2017
Microsoft PLATINUM April 2016
Forcepoint Felismus Mar 2017
Symantec Play Ransomware April 19 2023
Trend Micro Play Ransomware September 06 2022
Trend Micro Play Playbook September 06 2022
JPCert PLEAD Downloader June 2018
Trend Micro PLEAD RTLO
fileinfo plist file description
Pnputil.exe - LOLBAS Project
uptycs Fake POC linux malware 2023
GitHub SIP POC Sept 2017
Kube Pod
Talos PoetRAT October 2020
Talos PoetRAT April 2020
Talos Zeus Panda Nov 2017
FireEye Poison Ivy
Umbreon Trend Micro
AWS IAM Policies and Permissions
EnableMPRNotifications
Microsoft DirSync
Polyglot Files: a Hacker’s best friend
CheckPoint Redaman October 2019
Kaspersky Poseidon Group
Breach Post-mortem SSH Hijack
Elastic Docs Potential Protocol Tunneling via EarthWorm
sus mofcomp
This is Security Command Line Confusion
TrendMicro POWELIKS AUG 2014
Microsoft: Powercfg command-line options
Volexity PowerDuke November 2016
Cybereason PowerLess February 2022
MalwareTech Power Loader Aug 2013
Powerpnt.exe - LOLBAS Project
Sophos PowerShell Command History Forensics
Microsoft PowerShell CLM
SensePost PS DDE May 2016
Powersploit
PowerShellMagazine PowerSploit July 2014
PowerSploit Documentation
GitHub PowerSploit May 2012
byt3bl33d3r NTLM Relaying
U.S. CISA Volt Typhoon February 7 2024
Zimbra Preauth
Microsoft Preauthentication Jul 2012
Elastic Predicting DGA
WithSecure SystemBC May 10 2021
URI
Presentationhost.exe - LOLBAS Project
Microsoft Sub Takeover 2020
Microsoft Preventing SMB
Palo Alto Prince of Persia
PrintBrm.exe - LOLBAS Project
Print.exe - LOLBAS Project
PrivateLoader: The first step in many malware schemes | Intel471
Rhino Google Cloud Privilege Escalation
Rhingo Security Labs GCP Privilege Escalation
FireEye APT19
Anomali Static Kitten February 2021
sus mofcomp dos
Procdump.exe - LOLBAS Project
Microsoft Process Creation Flags May 2018
hasherezade Process Doppelgänging Dec 2017
Microsoft Processes and Threads
ProcessHacker Github
Leitch Hollowing
Korean FSI TA505 2020
Microsoft Profiling Mar 2017
Microsoft Win32
CameraShy
Unit 42 ProjectM March 2016
Threatpost Sauron
Kaspersky ProjectSauron Blog
Kaspersky TajMahal April 2019
DarkReading FireEye FIN5 Oct 2015
Talos Promethium June 2020
Intel471 Pro-Russian Hacktivist 2022
TechNet Credential Guard
Microsoft Protected Users Security Group
CISA Remote Monitoring and Management Software
Protecting Microsoft 365 From On-Premises Attacks
SANS PsExec
Docker Daemon Socket Protect
Malwarebytes Emotet Dec 2017
ProtocolHandler.exe - LOLBAS Project
cybereason osx proton
Provlaunch.exe - LOLBAS Project
FBI Proxies Credential Stuffing
Sysdig Proxyjacking
Password Protected Word Docs
Github PSAttack
PsExec Russinovich
SANS UAC Bypass
GitHub PSPKIAudit
Psr.exe - LOLBAS Project
Microsoft PsSetCreateProcessNotifyRoutine routine
PTRACE man
Wikipedia Public Key Crypto
SingHealth Breach Jan 2019
pubprn
Pubprn.vbs - LOLBAS Project
PaloAlto EncodedCommand March 2017
Anomali Linux Rabbit 2018
anomali-linux-rabbit
CrowdStrike PUNK SPIDER
Menlo Security PureCrypter February 2023
BleepingComputer Snowflake June 11 2024
Free Trial PurpleUrchin
Cylance Putter Panda
Oddvar Moe ADS1 Jan 2018
Oddvar Moe ADS2 Apr 2018
Moran RDPieces
PuTTY Download Page
Wikipedia pwdump
DFIR Pysa Nov 2020
NHS Digital Pysa Oct 2020
oletools toolkit
GitHub PoshC2
Trend Micro Qakbot December 2020
Cyberint Qakbot May 2021
Kroll Qakbot June 2020
Trend Micro Qakbot May 2020
K7 QakBot Returns January 4 2024
Kaspersky QakBot September 2021
Red Canary Qbot
qr-phish-agriculture
TheEclecticLightCompany Quarantine and the flag
GitHub QuasarRAT
0DAY IN {REA_TEAM} Pikabot January 6 2024
DidierStevens SelectMyParent Nov 2009
Microsoft - Azure AD App Registration - May 2019
Microsoft Azure Key Vault
Google Command Center Dashboard
Trend Micro R980 2016
Costa AvosLocker May 2022
Sekoia.io Raccoon Stealer June 28 2022
DOJ Iran Indictments March 2018
Sophos Ragnar May 2020
GitHub Raindance
Symantec RAINDROP January 2021
Eset Ramsay May 2020
Rancor WMI
Rancor Unit42 June 2018
BroadcomSW June 5 2024
FBI-ransomware
IBM Ransomware Trends September 2020
DHS/CISA Ransomware Targeting Healthcare October 2020
FireEye Ransomware Disrupt Industrial Production
FireEye Ransomware Feb 2020
Check Point Pay2Key November 2020
Microsoft Ransomware as a Service
Www.invictus-ir.com 1 11 2024
McAfee Maze March 2020
Sophos SystemBC December 16 2020
Fortinet Play Ransomware December 22 2022
TrendMicro Akira October 5 2023
Trend Micro AvosLocker Apr 2022
Trend Micro Black Basta Spotlight September 2022
Trend Micro BlackCat October 27 2022
Trend Micro LockBit Spotlight February 08 2023
Trend Micro Play Spotlight July 21 2023
Group IB Ransomware May 2020
GitHub ransomwatch
PyPI RAR
WinRAR Homepage
Aquino RARSTONE
Rasautou.exe - LOLBAS Project
Red Canary Raspberry Robin May 2022
Microsoft Security Raspberry Robin October 2022
Dragos Raspite Aug 2018
RATANKBA
TrendMicro RawPOS April 2015
Rclone
Rclone Wars
rcsi.exe - LOLBAS Project
RDP Hijacking Medium
RDPWrap Github
rdrleakdiag.exe - LOLBAS Project
blog.vincss.net 1 13 2021
ESET RTM Feb 2017
FireEye Sunshop Campaign May 2013
Mandiant golang stripped binaries explanation
reagentc_cmd
Microsoft DART Case Report 001
Sans ARP Spoofing Aug 2003
Github CLI Create Webhook
Kaspersky Cloud Atlas August 2019
Talos MuddyWater May 2019
Mandiant Pulse Secure Update May 2021
Free Desktop Entry Keys
Recorded Future APT3 May 2017
Trend Micro Daserf Nov 2017
Red Canary SocGholish March 2024
RHEL auditd
Red Hat System Auditing
Recorded Future RedHotel August 2023
Cylance Redirect to SMB
Black Hills Red Teaming MS AD Azure, 2018
OutFlank System Calls
US-CERT TA17-156A SNMP Abuse 2017
Cloudflare ReflectionDoS May 2017
Trend Micro
Microsoft Reg
LOLBAS Regasm
MSDN Regasm
Microsoft RegDelNull July 2016
Regedit.exe - LOLBAS Project
Reg.exe - LOLBAS Project
Microsoft Reghide NOV 2006
Regini.exe - LOLBAS Project
Register-cimprovider.exe - LOLBAS Project
Microsoft Registry
Tilbury 2014
Microsoft COR_PROFILER Feb 2013
Microsoft Registry Auditing Aug 2016
Registry Key Security
MSDN Registry Key Security
Microsoft Registry Drivers
Microsoft System Wide Com Keys
LOLBAS Regsvcs
MSDN Regsvcs
LOLBAS Regsvr32
Fortinet Remcos Feb 2017
Mandiant Remediation and Hardening Strategies for Microsoft 365
Mandiant Defend UNC2452 White Paper
Remediation and Hardening Strategies for Microsoft 365 to Defend Against UNC2452
TechNet Remote Desktop Services
Remote.exe - LOLBAS Project
Microsoft Remote Use of Local
SigmaHQ
disable_win_evt_logging
Microsoft Replace Process Token
Replace.exe - LOLBAS Project
Bugcrowd Replay Attack
Mac Forwarding Rules
GitHub Reptile
AWS Temporary Security Credentials
ARS Technica China Hack SK April 2017
Wired SandCat Oct 2019
Vincens AcidPour 2024
MSitPros CMSTP Aug 2017
sentinellabs resource named fork 2020
GitHub Responder
Mandiant UNC2589 March 2022
CrowdStrike BGH Ransomware 2021
Google - Restore Cloud Snapshot
Google Instances Resource
Secureworks IRON LIBERTY July 2019
Palo Alto Retefe
AWS Secrets Manager
Directory Services Internals DPAPI Backup Keys Oct 2015
Malwarebytes RokRAT VBA January 2021
TCC Database
jRAT Symantec Aug 2018
Sygnia Emperor Dragonfly October 2022
Morphisec Snip3 May 2021
Microsoft DUBNIUM June 2016
Microsoft DUBNIUM Flash June 2016
Microsoft DUBNIUM July 2016
CSRB LAPSUS$ July 24 2023
Intel 471 REvil March 2020
BleepingComputer REvil 2021
Secureworks REvil September 2019
Secureworks GandCrab and REvil September 2019
Enigma Reviving DDE Jan 2018
GitHub Revoke-Obfuscation
FireEye Revoke-Obfuscation July 2017
HC3 Analyst Note Rhysida Ransomware August 2023
SentinelOne Rhysida June 29 2023
Prodaft RIG February 2023
Microsoft XorDdos Linux Stealth 2022
httrack_unhcr
US-CERT Alert TA13-175A Risks of Default Passwords on the Internet
ROADtools Github
Harmj0y Roasting AS-REPs Jan 2017
Anomali Rocke March 2019
Talos Rocke August 2018
Check Point Rocket Kitten
NCCGroup RokRat Nov 2018
Talos ROKRAT 2
Kubernetes RBAC
Google Cloud Service Account Authentication Roles
BBC-Ronin
Wikipedia Root Certificate
Wikipedia Rootkit
Sekoia HideDRV Oct 2016
RotaJakiro 2021 netlab360 analysis
netlab360 rotajakiro vs oceanlotus
TechNet Route
U.S. HHS Royal & BlackCat Alert
Kroll Royal Deep Dive February 2023
Trend Micro Royal Linux ESXi February 2023
Cybereason Royal December 2022
Royal Rumble: Analysis of Royal Ransomware
Rpcping.exe - LOLBAS Project
Threatpost New Op Sharpshooter Data March 2019
GCN RSA June 2011
RSA Shell Crew
GitHub Rubeus March 2023
SOCPrime DoubleExtension
SensePost Ruler GitHub
Microsoft Cloud App Security
Microsoft Run Key
Microsoft RunAs
Microsoft runas - Duplicate
Wikipedia Run Command
Secpod Winexe June 2017
Rundll32.exe - LOLBAS Project
Attackify Rundll32.exe Obscurity
Runexehelper.exe - LOLBAS Project
ELC Running at startup
Powershell Remote Commands
AutoIT
Runonce.exe - LOLBAS Project
Apple Developer Doco Archive Run-Path
Runscripthelper.exe - LOLBAS Project
Microsoft Run Command
McAfee APT28 DDE2 Nov 2017
Security Affairs DustSquad Oct 2018
SecurityWeek Nomadic Octopus Oct 2018
U.S. Federal Bureau of Investigation 2 27 2024
U.S. CISA SVR TeamCity Exploits December 2023
U.S. CISA Star Blizzard December 2023
NSA/FBI Drovorub August 2020
Cybersecurity Advisory GRU Brute Force Campaign July 2021
BleepingComputer Ebury March 2017
Russian 2FA Push Annoyance - Cimpanu
Unit42 Redaman January 2019
Russians Exploit Default MFA Protocol - CISA March 2022
CISA MFA PrintNightmare
US-CERT TA18-106A Network Infrastructure Devices 2018
alert_TA18_106A
UK GOV FSB Factsheet April 2022
Unit 42 Gamaredon February 2022
Wired Russia Cyberwar
RyanW3stman Tweet October 10 2023
Ryte Wiki
DFIR Ryuk in 5 Hours October 2020
ANSSI RYUK RANSOMWARE
Bleeping Computer - Ryuk WoL
DFIR Ryuk 2 Hour Speed Run November 2020
DFIR Ryuk's Return October 2020
Rhino S3 Ransomware Part 1
Rhino S3 Ransomware Part 2
S3Recon GitHub
Dell Sakula
Wine API samlib.dll
Sophos SamSam Apr 2018
Symantec SamSam Oct 2018
Talos SamSam Jan 2018
NSA Sandworm 2020
Mandiant Sandworm November 9 2023
Mandiant-Sandworm-Ukraine-2022
ANSSI Sandworm January 2021
iSIGHT Sandworm 2014
DOJ - Cisco Insider
SANS 1
SANS 2
ATT ScanBox
Mandiant SCANdalous Jul 2020
Securelist ScarCruft May 2019
Sysdig ScarletEel 2.0 2023
Sysdig ScarletEel 2.0
Sysdig Scarleteel February 28 2023
Scarlet Mimic Jan 2016
U.S. CISA Scattered Spider November 16 2023
CrowdStrike Scattered Spider Profile
CrowdStrike Scattered Spider BYOVD January 2023
Trellix Scattered Spider MO August 2023
Sc.exe - LOLBAS Project
TechNet Forum Scheduled Task Operational Setting
Kifarunix - Task Scheduling in Linux
TechNet Schtasks
Schtasks.exe - LOLBAS Project
Secplicity Rhysida May 23 2023
Wikipedia Screensaver
CobaltStrike Scripted Web Delivery
Cobalt Strike DCOM Jan 2017
Scriptrunner.exe - LOLBAS Project
Scrobj.dll - LOLBAS Project
Microsoft SDelete July 2016
Sean Metcalf Twitter DNS Records
AWS CloudTrail Search
Group IB Cobalt Aug 2017
GitHub SHB Credential Guard
Secure Host Baseline EMET
TechNet Secure Boot Process
Securing bash history
Microsoft Securing Privileged Access
Berkley Secure
Cisco Securing SNMP
ADSecurity Windows Secure Baseline
Morphisec ShellTea June 2019
Carbon Black Obfuscation Sept 2016
Havana authentication bug
Proofpoint TA450 Phishing March 2024
Microsoft Trust Considerations Nov 2014
AWS Sec Groups VPC
Microsoft SID
Schneider Electric USB Malware
Electron 3
Apple Dev SecurityD
Microsoft Security Subsystem
CISA IDN ST05-016
Azure AD Federation Vulnerability
AADInternals zure AD Federated Domain
ESET Sednit July 2015
ESET Sednit USBStealer 2014
ESET Sednit 2017 Activity
ESET Zebrocy Nov 2018
Symantec MuddyWater Dec 2018
SanDisk SMART
SELinux official
Microsoft SendNotifyMessage function
DFIR Report Gootloader
MalwareBytes SEO
Sophos Attachment
ProofPoint Serpent
Wikipedia SMB
Wikipedia Server Message Block
Proofpoint TA505 Jan 2019
Kubernetes Service Accounts Security
GCP Service Accounts
Microsoft Service Control Manager
Rapid7 Service Persistence 22JUNE2016
Microsoft SPN
Microsoft SetSPN
Twitter Service Recovery Nov 2017
Tweet Registry Perms Weakness
TechNet Services
Krebs Access Brokers Fortune 500
Session Management Cheat Sheet
Medium Authentication Tokens
Microsoft Set-InboxRule
Setres.exe - LOLBAS Project
Microsoft Process Wide Com Keys
SettingSyncHost.exe - LOLBAS Project
Petri Logon Script AD
AWS Setting Up Run Command
VNC Authentication
MacOS VNC software for Remote Desktop
Setupapi.dll - LOLBAS Project
Microsoft Service Recovery Feb 2013
Microsoft SetWindowLong function
Securelist ShadowPad Aug 2017
Kaspersky ShadowPad Aug 2017
Palo Alto Shamoon Nov 2016
Unit 42 Shamoon3 2018
McAfee Shamoon December19 2018
McAfee Shamoon December 2018
TechNet Shared Folder
AWS EBS Snapshot Sharing
Linux Shared Libraries
TLDP Shared Libraries
Phrack halfdead 1997
Wikipedia Shared Resource
Sharepoint Sharing Events
GitHub GhostPack Certificates
Shdocvw.dll - LOLBAS Project
Securelist Turla Oct 2018
Shell32.dll - LOLBAS Project
Cylance Shell Crew Feb 2017
Magento
Trend Micro TA505 June 2019
Shimgvw.dll - LOLBAS Project
FireEye Shining A Light on DARKSIDE May 2021
Telekom Security DarkGate August 25 2023
NCC Group Black Basta June 2022
Trustwave Cherry Picker
File obfuscation
Shlayer jamf gatekeeper bypass 2021
Shodan
Shortcut for Persistence
Unprotect Shortcut
Sleep, shut down, hibernate
show_clock_detail_cisco_cmd
show_processes_cisco_cmd
show_run_config_cmd_cisco
Symantec Shuckworm January 2022
Microsoft Shutdown Oct 2017
MalwareBytes SideCopy Dec 2021
Rewterz Sidewinder APT April 2020
Cyble Sidewinder September 2020
Microsoft Sigcheck May 2017
Linux Signal Man
f-secure janicab
Group IB Silence Aug 2019
SecureList Silence Nov 2017
Cyber Forensicator Silence Jan 2019
Group IB Silence Sept 2018
CrowdStrike Silent Chollima Adversary September 2021
Malwarebytes Silent Librarian October 2020
Phish Labs Silent Librarian
GitHub SILENTTRINITY Modules July 2019
Unit 42 Siloscape Jun 2021
Unit42 SilverTerrier 2016
Unit42 SilverTerrier 2018
Timac DYLD_INSERT_LIBRARIES
SIM Swapping and Abuse of the Microsoft Azure Serial Console
EduardosBlog SIPs July 2008
Anonymous Hackers Deface Russian Govt Site
Dell Skeleton
Command Five SK 2011
Trend Micro Skidmap
Detectify Slack Tokens
Huntress ScreenConnect 2 23 2024
GitHub Sliver C2
GitHub Sliver C2 DNS
GitHub Sliver Download
GitHub Sliver File System August 2021
GitHub Sliver HTTP
GitHub Sliver Ifconfig
GitHub Sliver Netstat
GitHub Sliver Screen
GitHub Sliver Encryption
GitHub Sliver Upload
Zdnet Ngrok September 2018
NCSC GCHQ Small Sieve Jan 2022
SmartMontools
CME Github September 2018
US-CERT SMB Security
SMLoginItemSetEnabled Schroeder 2013
Malwarebytes SmokeLoader 2016
Talos Smoke Loader July 2018
FireEye SMOKEDHAM June 2021
nccgroup Smuggling HTA 2017
Environmental Keyed HTA
Accenture SNAKEMACKEREL Nov 2018
Sophos Snatch Ransomware 2019
AdSecurity SID History Sept 2015
ADSecurity GPO Persistence 2016
Telefonica Snip3 December 2021
Cybereason SocGholish Zloader April 2022
ReliaQuest SocGholish
SocGholish-update
SentinelOne SocGholish Infrastructure November 2022
SentinelLabs SocGholish November 2022
Proofpoint November 21 2022
Rapid7 Blog 5 10 2024
Security Joes Sockbot March 09 2022
Kaspersky Sodin July 2019
Kaspersky Sofacy
Unit 42 Sofacy Feb 2018
Unit 42 Sofacy Nov 2018
Unit42 Cannon Nov 2018
Palo Alto Sofacy 06-2018
F-Secure Sofacy 2015
Sofacy Komplex Trojan
Sofacy DealersChoice
Unit 42 SolarStorm December 2020
Symantec Sunburst Sending Data January 2021
Carnegie Mellon University Supernova Dec 2020
SolarWinds Advisory Dec 2020
solution_monitor_dhcp_scopes
Sophos X-Ops Tweet September 13 2023
Source Manual
FireEye Southeast Asia Threat Landscape March 2015
Symantec Sowbug Nov 2017
NIST 800-63-3
Threatpost Hancitor
CheckPoint SpeakUp Feb 2019
Cyfirma Kimsuky Spear Phishing
Palo Alto Unit 42 OutSteel SaintBot February 2022
Zscaler Bazar September 2020
Reaqta MSXSL Spearphishing MAR 2018
FireEye Regsvr32 Targeting Mongolian Gov
FireEye admin@338 March 2014
Microsoft File Handlers
GTFO split
split man page
Spoofing credential dialogs
Infosecinstitute RTLO Technique
BBC-malvertising
NSA Spotting
Villeneuve 2014
Sqldumper.exe - LOLBAS Project
sqlmap Introduction
Sqlps.exe - LOLBAS Project
SQLToolsPS.exe - LOLBAS Project
Squirrel.exe - LOLBAS Project
ZScaler Squirrelwaffle Sep 2021
Netskope Squirrelwaffle Oct 2021
Clockwork SSH Agent Hijacking
Symantec SSH and ssh-agent
ssh.exe - LOLBAS Project
SSH Secure Shell
SSH Tunneling
SSLShopper Lookup
Ubuntu SSSD Docs
Stantinko Botnet
StarBlizzard
Amazon AWS
Docker Systemd
Startup Items
Microsoft Safe Mode
Mandiant APT41
Twitter SquiblyTwo Detection APR 2018
MSFT-AI
Mandiant Endpoint Evading 2019
Sekoia.io Stealc February 20 2023
Sekoia.io Stealc February 27 2023
AADInternals Azure AD Device Identities
O365 Blog Azure AD Device IDs
Carnal Ownage Password Filters Sept 2013
CSM Elderwood Sept 2012
DEFCON2016 Sticky Keys
The DFIR Report Stolen Images Conti
Netscout Stolen Pencil Dec 2018
FireEye VBA stomp Feb 2020
Stopping CloudTrail from Sending Events to CloudWatch Logs
McAfee Virtual Jan 2017
Checkpoint Dridex Jan 2021
U.S. CISA Akira April 18 2024
U.S. CISA ALPHV Blackcat December 2023
U.S. CISA AvosLocker October 11 2023
U.S. CISA BianLian Ransomware May 2023
U.S. CISA Black Basta May 10 2024
U.S. CISA CL0P CVE-2023-34362 Exploitation
U.S. CISA Cuba Ransomware October 2022
U.S. CISA Daixin Team October 2022
U.S. CISA LockBit 3.0 March 2023
U.S. CISA LockBit Citrix Bleed November 21 2023
U.S. CISA MedusaLocker August 11 2022
U.S. CISA Phobos February 29 2024
U.S. CISA Play Ransomware December 2023
U.S. CISA Rhysida Ransomware November 15 2023
CISA Royal AA23-061A March 2023
#StopRansomware: Royal Ransomware | CISA
U.S. CISA Vice Society September 2022
Stordiag.exe - LOLBAS Project
Pentestlab Stored Credentials
store_pwd_rev_enc
IBM Storwize
G Data Sodinokibi June 2019
Windows Blogs Microsoft Edge Sandbox
ComputerWeekly Strider
Symantec Strider Blog
Cybereason StrifeWater Feb 2022
Bitdefender StrongPity June 2020
welivesec_strongpity
Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020
ESET Stuxnet Under the Microscope
subTee .NET Profilers May 2017
SpectorOps Subverting Trust Sept 2017
Symantec Suckfly March 2016
sudo man page 2018
FireEye SUNBURST Additional Details Dec 2020
CheckPoint Sunburst & Teardrop December 2020
Check Point Sunburst Teardrop December 2020
CrowdStrike SUNSPOT Implant January 2021
Kaspersky Superfish
Unit42 SUPERNOVA Dec 2020
Guidepoint SUPERNOVA Dec 2020
00sec Droppers
FireEyeSupplyChain
Moran 2013
4 - appv
Dell Threat Group 2889
Mandiant UNC3890 Aug 2022
Suspected Russian Activity Targeting Government and Business Entities Around the Globe
NCSC et al APT29 2024
U.S. CISA APT29 Cloud Access
Recorded Future Turla Infra 2020
Microsoft Sxstrace
Alienvault Sykipot DOD Smart Cards
SecureList SynAck Doppelgänging May 2018
6 - appv
SyncAppvPublishingServer.exe - LOLBAS Project
5 - appv
Syncappvpublishingserver.vbs - LOLBAS Project
Mac Time Sync
Mandiant - Synful Knock
sysdig
Sysmon EID 9
Microsoft Sysmon v6 May 2017
Syssetup.dll - LOLBAS Project
System and kernel extensions in macOS
Linux man-pages: systemd January 2014
FreeDesktop Journal
Ubuntu Manpage systemd rc
Systemd Service Units
freedesktop systemd.service
systemdsleep Linux
Freedesktop.org Linux systemd 29SEP2018
archlinux Systemd Timers Aug 2020
TechNet Systeminfo
Peripheral Discovery macOS
MSDN System Time
linux system time
atomic-red proc file system
T1562.002_redcanaryco
Palo Alto T9000 Feb 2016
US-CERT TA18-068A 2018
Browers FriarFox
Proofpoint TA416 November 2020
NCC Group TA505
ProofPoint SettingContent-ms July 2018
IBM TA505 April 2020
Proofpoint TA505 October 2019
Proofpoint TA505 June 2018
TrendMicro TA505 Aug 2019
Unit 42 TA551 Jan 2021
Proofpoint February 23 2023
TA571
IBM TA577 OneNote Malspam
Proofpoint TA577 NTLM March 4 2024
Cobalt Strike TTPs Dec 2017
Reuters Taiwan BlackTech August 2020
Microsoft Process Snapshot
Lacework TeamTNT May 2021
Datadog ECS January 19 2024
Splunk Kovar Certificates 2017
Dragos TALONITE
Talos Sodinokibi April 2019
Medium Event Tracing Tampering 2018
Tar.exe - LOLBAS Project
NGLite Trojan
Netskope GCP Redirection
AhnLab Andariel Subgroup of Lazarus June 2018
Sood and Enbody
dharma_ransomware
Targeted SSL Stripping Attacks Are Real
CFR Vaccine Development Threats
Tarrask scheduled task
Microsoft Tasklist
Microsoft Tasks
TechNet Task Scheduler Security
tau bundlore erika noerenberg 2020
CarbonBlack Conti July 2020
CarbonBlack LockerGoga 2019
GitHub Turla Driver Loader
S1 Old Rat New Tricks
Teams.exe - LOLBAS Project
TeamTNT Cloud Enumeration
Intezer TeamTNT Explosion September 2021
AquaSec TeamTNT 2023
Talos TeamTNT
Cisco Talos Intelligence Group
Cado Security TeamTNT Worm August 2020
ATT TeamTNT Chimaera September 2020
OSX Coldroot RAT
Kaspersky ProjectSauron Technical Analysis
McAfee Babuk February 2021
Crytox Ransomware
McAfee Cuba April 2021
McAfee Dianxun March 2021
Zscaler Pikabot May 24 2023
Technical Analysis of PureCrypter | Zscaler Blog
Crowdstrike WhisperGate January 2022
Apple TN2459 Kernel Extensions
fb_arid_viper
GovCERT Carbon May 2016
Palo Alto Office Test Sofacy
te.exe - LOLBAS Project
ESET Telebots June 2017
SANS Brian Wiltse Template Injection
Amazon AWS Temporary Security Credentials
Elastic Process Injection July 2017
TestWindowRemoteAgent.exe - LOLBAS Project
Sygnia Elephant Beetle Jan 2022
Cloudflare February 5 2024
Domain_Steal_CC
Kali Hydra
Adventures of a Keystroke
ThreatConnect Anthem
Talos Cobalt Strike September 2020
wardle chp2 persistence
wardle artofmalware volume1
ArtOfMemoryForensics
STIG Audit Kernel Modules
Medium Metamorfo Apr 2020
Gigamon Berserk Bear October 2021
Kaspersky Emotet Jan 2019
Symantec Black Vine
Group IB GrimAgent July 2021
RSA Carbanak November 2017
Picus Emotet Dec 2018
Medium Ali Salem Bumblebee April 2022
Avira XWorm April 2023
MSDN COM Elevation
Microsoft Component Object Model
SANS Conficker
Trellix Darkgate 2023
Symantec DDoS October 2014
BlackBerry CostaRicto November 2020
Invictus IR DangerDev 2024
Www.invictus-ir.com 1 31 2024
SecureWorks Mia Ash July 2017
Trustwave IIS Module 2013
CloudSploit - Unused AWS Regions
Dormann Dangers of VHD 2019
Kaspersky Darkhotel
ESET ForSSHe December 2018
Zscaler 2 12 2024
Binary Reverse Engineering Blog 9 6 2023
Securelist Dropping Elephant
F-Secure The Dukes
Kaspersky Duqu 2.0
Symantec Elderwood Sept 2012
Kaspersky Turla Aug 2014
Kaspersky Turla
FireEye EPS Awakens Part 2
Symantec Emotet Jul 2018
SilentBreak Offensive PS Dec 2015
CrowdStrike Evolution of Pinchy Spider July 2021
ATT Felismus
Proofpoint Ransomware Initial Access June 2021
Kaspersky Flame
Unit 42 CARROTBAT November 2018
Palo Alto Gamaredon Feb 2017
GNU Acct
GLIBC
Trustwave GoldenSpy June 2020
Proofpoint TA416 Europe March 2022
Red Canary Gootloader April 2023
Unit 42 Gorgon Group Aug 2018
Trend Micro HeartBeat Campaign January 2013
FireEye Hikit Rootkit
FireEye HIKIT Rootkit Part 2
Proofpoint Human Factor
TechNet Blogs Credential Protection
dhs_threat_to_net_devices
Triton-EENews-2017
sentinelone_israel_hamas_war
PWC KeyBoys Feb 2017
Securelist Kimsuky Sept 2013
ClearSky Kittens Back 2 Oct 2019
ClearSky Kittens Back 3 August 2020
Kubernetes API
GitHub LaZagne Dec 2018
GitHub LaZange Dec 2018
Dell P2P ZeuS
Cylera Kwampirs 2022
Linux Kernel API
Linux Kernel Programming
The DFIR Report Dharma Ransomware June 2020
Villeneuve 2011
Microsoft BlackCat Jun 2022
Talos Nyetya MEDoc 2017
PegasusCitizenLab
Securelist MiniDuke Feb 2013
Harmj0y SeEnableDelegationPrivilege Right
Baumgartner Naikon 2015
SentinelLabs Metador Sept 2022
Baumgartner Golovkin Naikon 2015
Cofense NanoCore Mar 2018
Kaspersky NetTraveler
Unit42 OceanLotus 2017
CyberArk Labs Discord
Gh0stRAT ATT March 2019
Palo Alto OilRig May 2016
STIG krbtgt reset
Haq 2014
Kaspersky Turla Penquin December 2014
FireEye PLA
Kaspersky ProjectSauron Full Report
McMillan Pwn March 2012
FireEye Application Shimming
Kaspersky Regin
The Remote Framebuffer Protocol
Malwarebytes Heroku Skimmers
Electron 1
ELC Extended Attributes
FireEye WMI SANS 2015
Nviso Spoof Command Line 2020
Zscaler Higaisa 2020
Check Point Research Rhysida August 08 2023
DigiTrust Agent Tesla Jan 2017
Cofense Agent Tesla
ATT QakBot April 2021
ESET Telebots Dec 2016
SEI SSL Inspection Risks
SourceForge rkhunter
Campbell 2014
Proofpoint Domain Shadowing
Symantec Shamoon 2012
Spring Dragon Jun 2015
Check Point APT31 February 2021
System Information Discovery Technique
UCF STIG Elevation Account Enumeration
TrendMicro Taidoor
SpectorOPs SettingContent-ms Jun 2018
Securelist Brazilian Banking Malware July 2020
Symantec Trojan.Hydraq Jan 2010
Fidelis Turbo
USDOJ Sandworm Feb 2020
Securelist Ventir
Symantec Waterbug
Windows NT Command Shell
Malwarebytes The Windows Vault
Microsoft JScript 2007
ntlm_relaying_kerberos_del
trendmicro xcsset xcode project 2020
Sophos New Ryuk Attack October 2020
RSA EU12 They're Inside
APT29 Deep Look at Credential Roaming
ZDNet Ransomware Backups 2020
Microsoft Unidentified Dec 2018
iPhone Charging Cable Hack
Mandiant APT41 Global Intrusion
FireEye APT41 March 2020
Proofpoint Bumblebee April 2022
Code Injection on Linux and macOS
TrendMicros ScreenConnect February 27 2024
FireEye Fin8 May 2016
Proofpoint TA407 September 2019
Proofpoint TA505 Sep 2017
Cyble 4 26 2023
U.S. CISA CVE-2023-3519 Exploits
U.S. CISA CVE-2023-35078 Exploits
U.S. CISA Ivanti Exploits February 2024
Microsoft Security Blog 5 15 2024
Atlas SEO
Cybereason TA505 April 2019
Cisco CaddyWiper March 2022
Carbon Black Squiblydoo Apr 2016
Aqua Build Images on Hosts
Aqua Kinsing April 2020
Segurança Informática URSA Sophisticated Loader 2020
Palo Alto Networks Black Basta August 2022
Unit42 Clop April 2021
Palo Alto Unit 42 EKANS
UNIT 42 LAPSUS Mar 2022
Unit 42 WhisperGate January 2022
Unit 42 DGA Feb 2019
Dell TG-3390
SecureWorks TG-4127
McAfee APT28 DDE1 Nov 2017
Unit 42 9 15 2023
Awake Security Avaddon
Detecting Command & Control in the Cloud
Awake Security C2 Cloud
Threat Matrix for Kubernetes
SecureWorks BRONZE MOHAWK n.d.
ESET T3 Threat Report 2021
BlackBerry Amadey 2020
CiscoAngler
Talos IPFS 2022
Cisco Group 72
Talos ZxShell Oct 2014
Infinitum IT LockBit 3.0
BlackBerry SystemBC June 10 2021
DOJ North Korea Indictment Feb 2021
Symantec Thrip June 2018
FireEye Bootkits
SpecterOps AWS Traffic Mirroring
Ossmann Star Feb 2011
Trend Micro April 05 2022
Symantec Tick Apr 2016
TightVNC Software Project Page
AnyRun TimeBomb
Microsoft TimeProvider
Talos TinyTurla September 2021
Kaspersky ToddyCat Check Logs October 2023
Pentestlab Token Manipulation
Token tactics
Langer Stuxnet
TrendMicro Tonto Team October 2020
NorthSec 2015 GData Uroburos Tools
Cider Security Top 10 CICD Security Risks
Dingledine Tor The Second-Generation Onion Router
FireEye FIN7 Shim Databases
LOLBAS Tracker
BushidoToken Akira 2023
BushidoToken Scattered Spider August 16 2023
Lateral Movement Payne
Unit 42 KerrDown February 2019
Trend Micro TeamTNT
Okta HAR Files Incident Notice
SANS Windshift August 2018
Microsoft TxF
Rclone-mega-extortion_05_2021
JScrip May 2018
tt_obliqueRAT
Talos Transparent Tribe May 2021
Cisco Talos Transparent Tribe Education Campaign July 2022
tt_httrack_fake_domains
Securelist Trasparent Tribe 2020
Kaspersky Transparent Tribe August 2020
Microsoft TransportAgent Jun 2016
Trap Manual
Red Canary Netwire Linux 2022
Cyberciti Trap Statements
Dept. of Treasury Iran Sanctions September 2020
Treasury EvilCorp Dec 2019
Treasury North Korean Cyber Groups September 2019
Mandiant APT29 Trello
Mandiant Trending Evil Q1 2022
Trend Micro - Int SP
Malicious Chrome Extension Numbers
Triage 23893f035f8564dfea5030b9fdd54120d96072bb
Triage e82c11612c0870e8175eafa8c9c5f9151d0b80d7
exatrack bpf filters passive backdoors
Malwarebytes TrickBot Sep 2019
TrendMicro Trickbot Feb 2019
Eclypsium Trickboot December 2020
IBM X-Force ITG23 Oct 2021
Trend Micro Trickbot Nov 2018
Joe Sec Trickbot
Fortinet TrickBot
Trickbot VNC module July 2021
Fidelis TrickBot Oct 2016
Bromium Ursnif Mar 2017
IBM TrickBot Nov 2016
TrendMictro Phishing
Trimarc Detecting Password Spraying
Emotet Deploys TrickBot
Dragos TRISIS
FireEye TRITON 2019
FireEye TEMP.Veles JSON April 2019
FireEye TEMP.Veles 2018
Palo Alto MoonWind March 2017
CyberESI GTALK
Symantec Hydraq Jan 2010
Symantec Security Center Trojan.Kwampirs
Symantec Naid June 2012
Symantec Pasam May 2012
Microsoft TrojanSpy:Win32/Ursnif.gen!I Sept 2017
Symantec Ushedix June 2008
Symantec Volgmer Aug 2014
FSecure Lokibot November 2019
Microsoft Totbrick Oct 2017
Ciubotariu 2014
TrendMicro TROJ-FAKEAV OCT 2012
troj_zegost
TrendMicro Tropic Trooper May 2020
TrendMicro Tropic Trooper Mar 2018
Unit 42 Tropic Trooper Nov 2016
paloalto Tropic Trooper 2016
Microsoft Conditional Access Policy Changes
GitHub truffleHog
TCG Trusted Platform Module
Microsoft Trusts
SSHjack Blackhat
Trend Micro Totbrick Oct 2016
Ttdinject.exe - LOLBAS Project
ttint_rat
Tttracer.exe - LOLBAS Project
Invincea XTunnel
Sysadmins of the North April 28 2015
ThreatGeek Derusbi Converge
Mandiant Suspected Turla Campaign February 2023
ESET Crutch December 2020
ESET LightNeuron May 2019
ESET Turla Mosquito May 2018
ESET Turla August 2018
Accenture HyperStack October 2020
Gmail Delegation
Google Cloud Privilege Escalation
SSH in Windows
Microsoft NEODYMIUM Dec 2016
Twitter Richard WMIC
Twitter Nick Carr APT10
Crowdstrike KRYPTONITE PANDA August 2018
Two New Monero Malware Attacks Target Windows and Android Users
Trend Micro Pawn Storm April 2017
Almond COR_PROFILER Apr 2019
Github UACMe
ZScaler SEO
PaloAlto UBoatRAT Nov 2017
UK NSCS Russia SolarWinds April 2021
UK Gov Malign RIS Activity April 2021
UK Gov UK Exposes Russia SolarWinds April 2021
UK NCSC Olympic Attacks October 2020
Cisco Ukraine Wipers January 2022
Symantec Ukraine Wipers February 2022
Bleepingcomputer Gamardeon FSB November 2021
Leonard TAG 2023
Qualys Hermetic Wiper March 2022
GitHub Ultimate AppLocker Bypass List
Okta HAR Files RCA
UCF STIG Symbolic Links
FireEye FiveHands April 2021
Mandiant APT29 Eye Spy Email Nov 22
Google Cloud June 10 2024
Mandiant UNC961 March 23 2023
Trend Micro DRBControl February 2020
Checkpoint MosesStaff Nov 2021
bencane blog bashrc
Juniper DAI 2020
Understanding BumbleBee Loader The Delivery - VMRay 9 1 2023
Understanding BumbleBee The malicious behavior - VMRay 9 1 2023
Google Cloud IAM Policies
Juniper Traffic Mirroring
U.S. CISA Understanding LockBit June 2023
Auth0 Understanding Refresh Tokens
Huntress ScreenConnect 2 19 2024
baeldung Linux proc map 2022
Talos Phobos November 17 2023
Mandiant APT44 April 17 2024
FireEye KEGTAP SINGLEMALT October 2020
Wikipedia UEFI
New DragonOK
Unit 42 Playbook Dec 2017
Unit 42 SeaDuke 2015
3OHA double-fork 2022
Flashpoint Anonymous Sudan Timeline
AADInternals Azure AD On-Prem to Cloud
Adsecurity Mimikatz Guide
InfoSec Write-ups 7 23 2023
Cyble Akira May 10 2023
Kaspersky Lamberts Toolkit April 2017
CrowdStrike Grim Spider May 2019
Unregmp2.exe - LOLBAS Project
TrendMicro Patchwork Dec 2017
Kaspersky Careto
NKAbuse SL
Cymmetria Patchwork
Orange Residential Proxies
The DFIR Report Ursnif January 2023
Rapid7G20Espionage
Unit 42 BackConfig May 2020
Secureworks Karagany July 2019
Update.exe - LOLBAS Project
Microsoft - Update or Repair Federated domain
Trendmicro Evolving ThiefQuest 2020
AWS Update Trail
Unit 42 Pirpi July 2015
PaperCut MF/NG vulnerability bulletin
URI Use
Url.dll - LOLBAS Project
SCILabs Malteiro Threat Overlap 2023
NJCCIC Ursnif Sept 2016
TrendMicro Ursnif Mar 2015
Proofpoint August 29 2016
US Coast Guard Killnet August 17 2022
USCYBERCOM SLOTHFULMEDIA October 2020
win10_asr
Azure AD Conditional Access Exclusions
Docker Bind Mounts
Chrome Roaming Profiles
Ars Technica GRU indictment Jul 2018
Remote Management MDM macOS
Securelist Denis April 2017
Microsoft UAC
TechNet Inside UAC
User Approved Kernel Extension Pike’s
Adlice Software IAT Hooks Oct 2014
cisco_username_cmd
Jamf User Password Policies
MacOS Email Rules
Microsoft 365 Sharing Auditing
Kickstart Apple Remote Desktop commands
Microsoft Windows Event Forwarding FEB 2018
Google Workspace Data Loss Prevention
Apple ZShell
Kuberentes ABAC
Cisco Umbrella DGA Brute Force
Exploit Monday Mitigate Device Guard Bypases
Microsoft DsAddSidHistory
AWS Instance Profiles
Microsoft 365 Defender Solorigate
TechNet Netsh
Demaske Netsh Persistence
CrowdStrike Outlook Forms
Red Hat PAM
Varonis Power Automate Data Exfiltration
Microsoft Disable NTLM Nov 2012
Microsoft SMB Packet Signing
Microsoft Using Software Restriction
TechNet Applocker vs SRP
OSX Keychain Schaumann
AutoHotKey
USNYAG IranianBotnet March 2016
UtilityFunctions.ps1 - LOLBAS Project
Kernel.org Restrict Kernel Module
SentinelOne Valak June 2020
Cybereason Valak May 2020
Walmart Roberts Oct 2018
vbc.exe - LOLBAS Project
Veil_Ref
HC3 Analyst Note Venus Ransomware November 2022
LOLBAS Verclsid
WinOSBite verclsid.exe
Unit 42 VERMIN Jan 2018
Unit 42 Vice Society December 6 2022
Minerva Labs Vidar Stealer Evasion
Amnesty Intl. Ocean Lotus February 2021
FireEye APT32 April 2020
Slack Help Center Access Logs
Azure Activity Logs
DOJ GRU Indictment Jul 2018
MalwareTech VFS Nov 2014
Virtualization/Sandbox Evasion
Ars Technica Pwn2Own 2017 VM Escape
Google VM
Microsoft Virutal Machine API
Azure Update Virtual Machines
Azure Virtual Network TAP
Google VPC Overview
Volexity Virtual Private Keylogging
VirusTotal Behavior def.exe
VirusTotal FAQ
Visa RawPOS March 2015
ESET Recon Snake Nest
VB Microsoft
Wikipedia VBA
VB .NET Mar 2020
VisualUiaVerifyNative.exe - LOLBAS Project
Carbon Black HotCroissant April 2020
Offensive Security VNC Authentication Check
Trend Micro Void Rabisu May 30 2023
CheckPoint Volatile Cedar March 2015
Microsoft Volt Typhoon May 2023
Microsoft Volt Typhoon May 24 2023
VSDiagnostics.exe - LOLBAS Project
Vshadow.exe - LOLBAS Project
VSIISExeLauncher.exe - LOLBAS Project
vsjitdebugger.exe - LOLBAS Project
vsls-agent.exe - LOLBAS Project
vstest.console.exe - LOLBAS Project
Kanthak Sentinel
Vulnerability and Exploit Detector
Electron Security 3
Technet MS14-068
vxunderground debug
Symantec W32.Duqu
Symantec W.32 Stuxnet Dossier
w32.tidserv.g
Github W32Time Oct 2017
Symantec Chernobyl W95.CIH
Wab.exe - LOLBAS Project
GitLab WakeOnLAN
FireEye WannaCry 2017
BfV North Korea February 17 2024
Trend Micro War of Crypto Miners
Check Point Warzone Feb 2020
Uptycs Warzone UAC Bypass November 2020
Dragos WASSONITE
NCC Group WastedLocker June 2020
Sentinel Labs WastedLocker July 2020
Intezer Doki July 20
Trend Micro Waterbear December 2019
Symantec Waterbug Jun 2019
ESET DazzleSpy Jan 2022
win_wbadmin_delete_catalog
SecureWorks WannaCry Analysis
Aleks Weapons Nov 2015
NIST Web Bug
Didier Stevens WebDAV Traffic
Checkmarx Webhooks
Push Security SaaS Attacks Repository Webhooks
acunetix Server Secuirty
Microsoft Well Known SIDs Jun 2017
PWC WellMess C2 August 2020
Cofense Astaroth Sept 2018
Microsoft wevtutil Oct 2017
Wevtutil Microsoft Documentation
Wfc.exe - LOLBAS Project
Crowdstrike Downgrade
Chrome Extensions Definition
StackExchange Hooks Jul 2012
macOS APT Activity Bradley
okta
Norton Botnet
Microsoft DLL
Cloudflare DNSamplficationDoS
Amazon AWS VPC Guide
Cloudflare HTTPflood
Cloudflare NTPamplifciationDoS
Microsoft Primary Refresh Token
Comparitech Replay Attack
Corero SYN-ACKflood
Cloudflare SynFlood
Amazon VM
RedHat Webhooks
AWS System Manager
Microsoft Azure Virtual Network Overview
CrowdStrike-BEC
Microsoft Conditional Access
PAN DNS Tunneling
Proofpoint-spoof
magnusviri emond Apr 2016
Microsoft - Azure AD Federation
What Is FormBook Malware?
What is FormBook Malware? - Check Point Software
grsecurity official
VDSO Aug 2005
what_is_mmc
Microsoft NET - Duplicate
Pastebin EchoSec
Microsoft Protected View
TechNet RPC
IOKit Fundamentals
Baeldung LD_PRELOAD
Microsoft VBScript
VEC
Proofpoint Vishing
taxonomy_downgrade_att_tls
ESET Emotet July 6 2023
FireEye fxsst June 2011
Krebs Capital One August 2019
Symantec ADS May 2009
BH Manul Aug 2016
Dragos Heroku Watering Hole
SpectorOps Bifrost Kerberos macOS 2019
Palo Alto Brute Ratel July 2022
Trend Micro When Phishing Starts from the Inside 2017
Microsoft Where to use TxF
Brining MimiKatz to Unix
Dell Lateral Movement
Secureworks - AT.exe Scheduled Task
Cybereason WhisperGate February 2022
RecordedFuture WhisperGate Jan 2022
Symantec Whitefly March 2019
Accenture Lyceum Targets November 2021
Who Hid My Desktop
Krebs-Anna
CrowdStrike Ember Bear Profile March 2022
WHOIS
Meyers Numbered Panda
CrowdStrike PIONEER KITTEN August 2020
SECURELIST Bright Star 2015
Trend Micro Privileged Container
Mandiant UNC3944 September 14 2023
Mandiant UNC3944 SMS Phishing 2023
Electron Security 2
Auth0 - Why You Should Always Use Access Tokens to Secure APIs Sept 2019
Securelist Digital Certificates
Crowdstrike DNS Hijack 2019
Browser Adrozek
Wi-Fi Password of All Connected Networks in Windows/Linux
Wikipedia Exe Compression
ESET Carberp March 2012
ESET Industroyer
Microsoft Kasidet
ESET Ebury Oct 2017
Microsoft AMSI June 2015
Davidson Windows
IRED API Hashing
TrendMicro WindowsAppMac
Windows Commands JPCERT
Amplia WCE
Microsoft Windows Defender Application Control
Microsoft Operation Wilysupply
PassLib mscache
ProjectZero File Write EoP Apr 2018
DBAPPSecurity BITTER zero-day Feb 2021
EyeofRa Detecting Hooking June 2017
Passcape LSA Secrets
Windows Malware Infecting Android
MSDN WMI
FireEye WMI 2015
win_msc_files_overview
Hill NT Shell
passcape Windows Vault
Malware Archaeology PowerShell Cheat Sheet
TechNet PowerShell
Windows Privilege Escalation Guide
SploitSpren Windows Priv Jan 2018
SecurityBoulevard Unquoted Services APR 2018
Windows Unquoted Services
Windows Process Injection KernelCallbackTable
Modexp Windows Process Injection
Wikipedia Windows Registry
Cylance Reg Persistence Sept 2013
Microsoft WinRM
Symantec Windows Rootkits
insecure_reg_perms
Microsoft Windows Scripts
Microsoft Security Event 4670
Windows Log Events
winser19_file_overwrite_bug_twitter
Windows Server Containers Are Open
Sysinternals AppCertDlls Oct 2007
Russinovich Sysinternals
Microsoft System Services Fundamentals
Microsoft W32Time May 2017
Technet Windows Time Service
Microsoft W32Time Feb 2018
Microsoft CVE-2021-1732 Feb 2021
win_xml_evt_log
Winexe Github Sept 2013
Microsoft WinExec
winget.exe - LOLBAS Project
PreKageo Winhook Jul 2011
Novetta Winnti April 2015
Chronicle Winnti for Linux May 2019
WinRAR Website
winrm.vbs - LOLBAS Project
Microsoft WinVerifyTrust
Winword.exe - LOLBAS Project
WinZip Homepage
Dell Wiper
WireLurker
Lab52 WIRTE Apr 2019
Kaspersky WIRTE November 2021
Cofense RevengeRAT Feb 2019
CrowdStrike Wizard Spider October 2020
Wlrmdr.exe - LOLBAS Project
WMI 1-3
Microsoft WMI Architecture
WMI 7,8
LOLBAS Wmic
Microsoft WMI System Classes
MalwareBytes WoodyRAT Aug 2022
WorkFolders.exe - LOLBAS Project
Confluence Logs
AppInit Registry
Kubernetes Workload Management
ESF_filemonitor
Writing Bad Malware for OSX
Wscript.exe - LOLBAS Project
Enigma0x3 PubPrn Bypass
Wsl.exe - LOLBAS Project
Wsreset.exe - LOLBAS Project
wt.exe - LOLBAS Project
wuauclt.exe - LOLBAS Project
XAgentOSX 2017
XAgentOSX
Unit42 Xbash Sept 2018
xCmd
xcopy Microsoft
Dragos Xenotime 2018
gist Arch package compromise 10JUL2018
Cyble July 01 2022
SentinelOne 8 21 2023
Trend Micro Exposed Docker Server
Microsoft xp_cmdshell 2017
Microsoft XSLT Script Mar 2017
Xwizard.exe - LOLBAS Project
Linux kernel Yama
Red Canary Yellow Cockatoo June 2022
PwC Yellow Liderc
PwC Yellow Liderc October 25 2023
Mandiant APT29 Microsoft 365 2022
BlackHat Mac OSX Rootkit
Malwarebytes DarkComet March 2018
FireEye Mail CDS 2018
US District Court Indictment GRU Unit 74455 October 2020
Sophos ZeroAccess
Mandiant MOVEit Transfer June 2 2023
Kaspersky RTLO Cyber Crime
DOJ APT10 Dec 2018
District Court of NY APT10 Indictment December 2018
Zipfldr.dll - LOLBAS Project
Zlib Github
Microsoft Zone.Identifier 2020
Sysdig Kinsing November 2020
Tidal software
Tidal software
Tidal Software
Tidal tactic
Tidal tactic
Tidal Tactic
Tidal technique
Tidal technique
Tidal Technique
Tmss
Tmss
Threat Matrix for storage services
Tool
Tool
Tool
Uavs
Uavs
UAVs/UCAVs
Ukhsa culture collections
Ukhsa culture collections
UKHSA Culture Collections
Table of contents
D3Secutrity CTI Feeds
Linux Logs
Netspi PowerShell Execution Policy Bypass
Mandiant-leaks
Tilbury Windows Credentials
CWE top 25
CrowdStrike 2015 Global Threat Report
Prolific OSX Malware History
CERN Windigo June 2019
CrowdStrike GTR 2019
Crowdstrike GTR2020 Mar 2020
RecordedFuture 2021 Ad Infra
Red Canary 2021 Threat Detection Report March 2021
ACSC BlackCat Apr 2022
Internet crime report 2022
RC PowerShell
20 macOS Common Tools and Techniques
Microsoft GPP Key
Microsoft _VBA_PROJECT Stream
Microsoft Learn
Hybrid Analysis Icacls2 May 2018
Microsoft Wow6432Node 2018
DOJ-DPRK Heist
ITWorld Hard Disk Health Dec 2014
Microsoft 4657 APR 2017
Microsoft 4697 APR 2017
Microsoft User Creation Event
Microsoft User Modified Event
Microsoft 4768 TGT 2017
HIPAA Journal S3 Breach, 2017
Slack Security Risks
PurpleSec Data Loss Prevention
7zip Homepage
VMWare 8Base June 28 2023
Acronis 8Base July 17 2023
MicroFocus 9002 Aug 2016
CISA AA21-200A APT40 July 2021
AADInternals
AADInternals Documentation
AADInternals Github
Gigamon BADHATCH Jul 2019
bad_luck_blackcat
Cybereason Bazar July 2020
Red Canary Hospital Thwarted Ryuk October 2020
CyberCX Anonymous Sudan June 19 2023
Netskope Cloud Phishing
Microsoft O365 Admin Roles
Microsoft Atom Table
Microsoft About BITS
Microsoft About Event Tracing 2018
Microsoft PowerShell Command History
Microsoft List View Controls
Microsoft PowerShell Logging
Apple About Mac Scripting 2016
PowerShell About 2019
Microsoft PowerShellB64
Microsoft Profiles
Microsoft About Profiles
Microsoft Remote Desktop Services
systemsetup mac time
MSDN Clipboard
Microsoft HTML Help Executable Program
About UEFI
Microsoft Window Classes
Picus Sodinokibi January 2020
Application Bundle Manipulation Brandon Dalton
NCC Group Chimera January 2021
Electron 2
Harmj0y Abusing GPO Permissions
Retwin Directory Share Pivot
BOHOPS Abusing the COM Registry
abusing_com_reg
Rhino Security Labs AWS VPC Traffic Mirroring
Narrator Accessibility Abuse
Intezer ACBackdoor
AccCheckConsole.exe - LOLBAS Project
CyberScoop APT28 Nov 2018
Microsoft Azure Kubernetes Service Service Accounts
CrowdStrike Access Brokers
Microsoft Access Control Lists May 2018
Auth0 Access Tokens
BSidesSLC 2020 - LNK Elastic
Mythic SpecterOps
FireEye Chinese Espionage October 2019
Unit42 AcidBox June 2020
AcidRain JAGS 2022
acroread package compromised Arch Linux Mail 8JUL2018
Microsoft Actinium February 2022
Wikipedia Active Directory
Microsoft AD Accounts
Microsoft AD Admin Tier Model
Microsoft AD CS Overview
Microsoft Get-ADUser
Active Directory Enumeration with LDIFDE
Microsoft SID-History Attribute
Volexity Ivanti Zero-Day Exploitation January 2024
ActiveMalwareEnergy
Klein Active Setup 2010
Dark Vortex Brute Ratel C4
ad_blocker_with_miner
Microsoft Support O365 Add Another Admin, October 2019
Amazon AWS IMDS V2
Adding Login Items
MRWLabs Office Persistence Add-ins
AddinUtil.exe - LOLBAS Project
Microsoft - Add-MailboxPermission
AddMonitor
Microsoft Azure AD Users
Microsoft Office Add-ins
Microsoft AddPrintProcessor May 2018
RFC1918
Microsoft Exchange Address Lists
Microsoft AD DS Getting Started
Akamai DGA Mitigation
Keychain Decryption Passware
Trend Micro Deep Dive Into Defacement
Talos Lokibot Jan 2021
Malwarebytes Saint Bot April 2021
SecurityScorecard CredoMap September 2022
Krebs DNS Hijack 2019
Reaqta MuddyWater November 2017
ESET Turla PowerShell May 2019
Kubernetes Admission Controllers
Krebs Adobe
Github AD-Pentest-Script
adplus.exe - LOLBAS Project
Microsoft ADV170021 Dec 2017
FireEye APT Groups
Mandiant Advanced Persistent Threats
Mandiant APT Groups List
Advanced_sec_audit_policy_settings
Adversaries Hijack DLLs
CrowdStrike Richochet Chollima September 2021
Elastic - Hunting for Persistence Part 1
NCSC APT29 July 2020
Advpack.dll - LOLBAS Project
Kaspersky Adwind Feb 2016
Bitdefender Trickbot VNC module Whitepaper 2021
Mac Backdoors are back
SentinelOne January 30 2023
Trend Micro March 26 2024
Kaspersky MSSQL Aug 2019
Securelist Agent.btz
ThreatExpert Agent.btz
AgentExecutor.exe - LOLBAS Project
SentinelLabs Agent Tesla Aug 2020
LogPoint Agent Tesla March 23 2023
ATT Sidewinder January 2021
Harmj0y Domain Trusts
airwalk backdoor unix systems
Wired Lockergoga 2019
ZDNET Selling Data
ESET Zebrocy May 2019
Kersten Akira 2023
Akira Ransomware Analysis August 2023
Sophos Akira May 9 2023
Microsoft AKS Azure AD 2023
Okta DPoP 2023
US-CERT SamSam 2018
CISA MSS Sep 2020
CISA Lokibot September 2020
CISA_AA21_200B
cisa_malware_orgs_ukraine
US-CERT Ransomware 2016
US-CERT WannaCry 2017
US-CERT HIDDEN COBRA June 2017
US-CERT NotPetya 2017
US-CERT APT Energy Oct 2017
US-CERT FALLCHILL Nov 2017
US-CERT Volgmer Nov 2017
US-CERT TA18-074A
US-CERT-TA18-106A
US-CERT Emotet Jul 2018
AlKhaser Debug
Fysbis Palo Alto Analysis
Medium KONNI Jan 2020
Unit 42 Palo Alto Ransomware in Public Clouds 2022
Cyber Centre ALPHV/BlackCat July 25 2023
Mandiant ALPHV Affiliate April 3 2023
Microsoft ADS Mar 2014
XPNSec PPID Nov 2017
Microsoft AlwaysInstallElevated 2018
ASEC BLOG July 21 2022
Amazon Snapshots
Amazon AMI
Amazon S3
Trend Micro S3 Exposed PII, 2017
Recorded Future Beacon Certificates
Botnet Scan
Trend Micro Ngrok September 2020
CIRCL PlugX March 2013
Apple Unified Log Analysis Remote Login and Screen Sharing
Medium S2W WhisperGate January 2022
Analysis of FG-IR-22-369
Graeber 2014
Fortinet Agent Tesla April 2018
Antiy CERT Ramsay April 2020
Storm-0558 techniques for unauthorized email access
ESET Telebots July 2017
EST Kimsuky SmokeScreen April 2019
Ukraine15 - EISAC - 201603
Check Point Havij Analysis
ESET Emotet Dec 2018
Rewterz Sidewinder COVID-19 June 2020
CISA AR18-352A Quasar RAT December 2018
CISA AR21-126A FIVEHANDS May 2021
JoeSecurity Egregor 2020
GDATA Zeus Panda June 2017
jstnk9.github.io June 01 2022
Analyzing CS Dec 2020
Objective_See 1 4 2024
Microsoft Security Blog 4 22 2024
Uperesia Malicious Office Documents
Unit42 OilRig Nov 2018
McAfee GhostSecret
Microsoft Analyzing Solorigate Dec 2020
Lastline PlugX Analysis
TrendMicro Sandworm October 2014
Dragos Crashoverride 2018
Anatomy of an hVNC Attack
Syscall 2014
SCADAfence_ransomware
ESET IIS Malware 2021
Medium Anchor DNS July 2020
NSA Joint Advisory SVR SolarWinds April 2021
Kaspersky Andariel Ransomware June 2021
Sophos X-Ops C-23
RFC826 ARP
HP SVCReady Jun 2022
SecureList Fileless
ESET Ebury Feb 2014
Welivesecurity Ebury SSH
Avertium Black Basta June 2022
Myers 2007
Linux Services Run Levels
Anomali Pirate Panda April 2020
AnonGhost Team Profile
AnonHBGary
Fortinet Metamorfo Feb 2020
MuddyWater TrendMicro June 2018
AlienVault Sykipot 2011
RiskIQ Newegg September 2018
Dell WMI Persistence
iDefense Rootkit Overview
Trend Micro Rhysida August 09 2023
Mandiant Ukraine Cyber Threats January 2022
Microsoft AMSI
Microsoft Anti Spoofing
Fox-It Anunak Feb 2015
Group-IB Anunak
Google TAG Ukraine Threat Landscape March 2022
Zairon Hooking Dec 2006
SentinelOne Aoqin Dragon June 2022
Apache Server 2018
Secureworks BRONZEUNION Feb 2019
AppArmor official
PenTestLabs AppDomainManagerInject
Rapid7 AppDomain Manager Injection
Mandiant APT1 Appendix
AppInit Secure Boot
AppInstaller.exe - LOLBAS Project
objectivesee osx.shlayer apple approved 2020
AppleDocs AuthorizationExecuteWithPrivileges
AppleDocs Scheduling Timed Jobs
CISA AppleJeus Feb 2021
Apple Remote Desktop Admin Guide 3.3
applescript signing
Microsoft Entra ID Service Principals
Microsoft App Domains
Corio 2008
Microsoft Application Lockdown
SANS Application Whitelisting
Beechey 2010
NSA MS AppLocker
Penetration Testing Lab MSXSL July 2017
Microsoft Requests for Azure AD Roles in Privileged Identity Management
Apple App Security Overview
Tripwire AppUNBlocker
Appvlp.exe - LOLBAS Project
BlackHat Atkinson Winchester Token Manipulation
FireEye APT10 April 2017
Securelist APT10 March 2021
FireEye APT10 Sept 2018
NCC Group APT15 Alive and Strong
Mandiant APT1
Profero APT27 December 2020
FireEye APT28 January 2017
FireEye APT28
U.S. CISA APT28 Cisco Routers April 18 2023
Symantec APT28 Oct 2018
FireEye APT28 Hospitality Aug 2017
Bitdefender APT28 Dec 2015
FireEye APT29 Domain Fronting
FireEye APT29 Domain Fronting With TOR March 2017
FireEye APT30
Zscaler APT31 Covid-19 October 2020
sentinelone apt32 macOS backdoor 2020
FireEye APT33 Webinar Sept 2017
FireEye APT34 Webinar Dec 2017
DFIR Report APT35 ProxyShell March 2022
Check Point APT35 CharmPower January 2022
FireEye APT37 Feb 2018
FireEye APT38 Oct 2018
FireEye APT39 Jan 2019
APT3 Adversary Emulation Plan
evolution of pirpi
FireEye APT40 March 2019
Rostovcev APT41 2021
Mandiant APT42
NSA APT5 Citrix Threat Hunting December 2022
welivesecurity_apt-c-23
QiAnXin APT-C-36 Feb2019
360 Machete Sep 2020
Cycraft Chimera April 2020
CISA IT Service Providers
Securelist GCMAN
Proofpoint TA459 April 2017
Kaspersky ToddyCat June 2022
Securelist APT Trends April 2018
Kaspersky APT Trends Q1 2020
Kaspersky APT Trends Q1 April 2021
Securelist APT Trends Q2 2017
Wired ArcaneDoor April 24 2024
Cisco Talos ArcaneDoor April 24 2024
Wald0 Guide to GPOs
Lau 2011
Krebs-Booter
RSA Forfiles Aug 2017
FireEye Respond Webinar July 2017
Browser-updates
Sekoia.io AridViper
TechNet Arp
Cisco ARP Poisoning Mitigation 2016
ASEC Emotet 2017
ASERT Seven Pointed Dagger Aug 2015
Securelist Sofacy Feb 2018
THE FINANCIAL TIMES LTD 2019.
Aspnet_Compiler.exe - LOLBAS Project
Mandiant UNC2452 APT29 April 2022
Microsoft AssemblyLoad
Kubernetes Assigning Pods to Nodes
Microsoft Assoc Oct 2017
Rhino Security Labs Enumerating AWS Roles
Cybereason Astaroth Feb 2019
spamhaus-malvertising
Microsoft APC
Medium February 08 2023
AsyncRAT Crusade: Detections and Defense | Splunk
TechNet At
Die.net Linux at Man Page
Linux at
PWC Pirpi Scanbox
Atbroker.exe - LOLBAS Project
ESET Attor Oct 2019
LogRhythm WannaCry
Malwarebytes Dyreza November 2015
At.exe - LOLBAS Project
ENSIL AtomBombing Oct 2016
SentinelOne 5 3 2023
Malwarebytes 1 10 2024
FireEye TRITON 2018
The DFIR Report Truebot June 12 2023
att_def_ps_logging
Attack chain leads to XWORM and AGENTTESLA | Elastic
Intezer TeamTNT September 2020
Metcalf 2015
Cisco Blog Legacy Device Attacks
FireEye TRITON 2017
FireEye TRITON Dec 2017
Forbes GitHub Creds
GitHub Cloud Service Credentials
Unit 42 Unsecured Docker Daemons
Talos Roblox Scam 2023
Black Hills Attacking Exchange MailSniper, 2016
SANS Attacking Kerberos Nov 2014
NetSPI SQL Server CLR
Mandiant FIN5 GrrCON Oct 2016
Attacking VNC Servers PentestLab
Talos Template Injection July 2017
Lotus Blossom Dec 2015
Symantec Attacks Against Government Sector
Aqua Security Cloud Native Threat Report June 2021
CERT-FR PYSA April 2020
InsiderThreat NTFS EA Oct 2017
Microsoft ASR Obfuscation
Obfuscated scripts
TrendMicro Msiexec Feb 2018
GitHub ATTACK Empire
lambert systemd 2022
TechNet Credential Theft
AcidRain State Department 2022
Audit OSX
Microsoft Audit Logon Events
Cloud Audit Logs
Microsoft Scheduled Task Events Win10
auditpol
auditpol.exe_STRONTIC
Audit_Policy_Microsoft
TechNet Audit Policy
Microsoft Audit Registry July 2012
Security Affairs Elderwood Sept 2012
NIST Authentication
MSDN Authentication Packages
Microsoft Authenticode
K8s Authorization Overview
SSH Authorized Keys
Trend Micro njRAT 2018
Re-Open windows on Mac
TechNet Autoruns
Autoruns for Windows
Hornet Security Avaddon June 2020
Arxiv Avaddon Feb 2021
CISA Phishing
Malwarebytes AvosLocker Jul 2021
avoslocker_ransomware
Cisco Talos Avos Jun 2022
Awesome Executable Packing
ESET Kobalos Jan 2021
AWS Root User
GitHub AWS-ADFS-Credential-Generator
AWS GetPasswordPolicy
AWS Console Sign-in Events
AWS Describe DB Instances
AWS Get Bucket ACL
AWS Get Public Access Block
AWS Head Bucket
Rhino Security Labs AWS Privilege Escalation
AWS Lambda Redirector
Sysdig AMBERSQUID September 18 2023
Rhino Security Labs AWS S3 Ransomware
AWS Systems Manager Run Command
Pylos Xenotime 2019
objective-see ay mami 2018
Microsoft AZ CLI
Intezer Russian APT Dec 2020
az monitor diagnostic-settings
Microsoft Azure AD Security Operations for Devices
Microsoft Azure Active Directory security operations guide
Azure AD Connect for Read Teamers
Microsoft - Azure PowerShell
Azure Blob Storage
Microsoft Azure Instance Metadata 2021
Microsoft Azure Policy
SpecterOps Azure Privilege Escalation
Azure Products
Azure - Resource Manager API
Mandiant Azure Run Command 2021
Microsoft Azure security baseline for Azure Active Directory
Microsoft - Azure Sentinel ADFSDomainTrustMods
Azure Serial Console
Microsoft Azure Storage Security, 2019
Azure - Stormspotter
Medium Babuk February 2021
Sogeti CERT ESEC Babuk March 2021
Unit42 BabyShark Apr 2019
Symantec Briba May 2012
TrendMicro Squiblydoo Aug 2017
Symantec Darkmoon Aug 2005
ESET BackdoorDiplomacy Jun 2021
Backdooring an AWS account
Symantec Linfo May 2012
Symantec Backdoor.Mivast
Symantec Nerex May 2012
Symantec Backdoor.Nidiran
Symantec Remsec IOCs
Symantec Ristol May 2012
Symantec Vasport May 2012
FSecure Hupigon
Symantec Wiarp May 2012
Microsoft Lamin Sept 2017
Microsoft PoisonIvy 2017
Microsoft Win Defender Truvasys Sep 2017
Microsoft Wingbird Nov 2017
Microsoft BITS
NCC Group Research Blog August 19 2022
Tech Republic - Restore AWS Snapshots
Secureworks COBALT DICKENS August 2018
Cybereason Kimsuky November 2020
Proofpoint TA453 March 2021
Unit 42 BadPatch Oct 2017
ESET Bad Rabbit
Secure List Bad Rabbit
BlackBerry Bahamut
BaltimoreSun RobbinHood May 2019
ESET Research Bandook July 7 2021
CheckPoint Bandook Nov 2020
Banker Google Chrome Extension Steals Creds
Unit42 Banking Trojans Hooking 2022
Linux manual bash invocation
DieNet Bash
Bash.exe - LOLBAS Project
Bashfuscator Command Obfuscators
Microsoft Basic TxF Concepts
eSentire | BatLoader Continues to Abuse Google Search Ads to Deliver Vidar Stealer and Ursnif
BATLOADER: The Evasive Downloader Malware
Palo