Eric Conrad 2eecc65698 New Sliver and Metasploit EVTX files including cmd.exe writing to ADMIN$, and suspicious remote threads

2023-06-28 16:33:55 -04:00

..

disablestop-eventlog.evtx

Add detector and event log to watch for Event Log Service stop/start as an indicator or event log tampering with eventlogedit

2019-04-28 14:23:23 -04:00

eventlog-dac.evtx

Update to catch services.exe DAC permission change to hide services

2020-09-14 16:37:59 -04:00

many-events-application.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

many-events-security.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

many-events-system.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

metasploit-psexec-native-target-security.evtx

Add files via upload

2016-09-21 00:03:48 -04:00

metasploit-psexec-native-target-system.evtx

Add files via upload

2016-09-20 23:58:54 -04:00

metasploit-psexec-powershell-target-security.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

metasploit-psexec-powershell-target-system.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

metasploit-psexec-pwshpayload.evtx

Disable Metasploit psexec detect due to false-positive conflict with MS Exchange; revise alert for _Multiple admin logons for one account_ to show attempt count instead of unique event IDs

2019-05-06 14:34:31 -04:00

metasploit-sysmon.evtx

New Sliver and Metasploit EVTX files including cmd.exe writing to ADMIN$, and suspicious remote threads

2023-06-28 16:33:55 -04:00

mimikatz-privesc-hashdump.evtx

Add Event ID 4673 Sensitive Privilege Use detection for Mimikatz

2019-04-30 14:38:43 -04:00

mimikatz-privilegedebug-tokenelevate-hashdump.evtx

Add more Mimikatz detection, focusing on token::elevate as a non-admin user

2019-05-03 06:33:20 -04:00

new-user-security.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

password-spray.evtx

Add password spray detection, sample evtx

2019-04-30 17:11:56 -04:00

Powershell-Invoke-Obfuscation-encoding-menu.evtx

Added Invoke-Obfuscation sample evtx files

2017-08-30 15:49:46 -04:00

Powershell-Invoke-Obfuscation-many.evtx

Added Invoke-Obfuscation sample evtx files

2017-08-30 15:49:46 -04:00

Powershell-Invoke-Obfuscation-string-menu.evtx

Added Invoke-Obfuscation sample evtx files

2017-08-30 15:49:46 -04:00

powersploit-security.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

powersploit-system.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

psattack-security.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

sliver-security.evtx

New Sliver and Metasploit EVTX files including cmd.exe writing to ADMIN$, and suspicious remote threads

2023-06-28 16:33:55 -04:00

sliver-sysmon.evtx

New Sliver and Metasploit EVTX files including cmd.exe writing to ADMIN$, and suspicious remote threads

2023-06-28 16:33:55 -04:00

smb-password-guessing-security.evtx

Add files via upload

2016-09-20 15:35:54 -04:00

wmi-event-filter-persistance.evtx

Added code to support flagging suspicious wmi filter events, also added sample log file

2021-09-16 13:55:34 +01:00