Threat Hunter Playbook
Knowledge Library
Windows
Pre-Hunt Activities
Data Management
Campaign Notebooks
ATT&CK Evaluations
Targeted Notebooks
Windows
Execution
Remote Service creation
WMI Win32_Process Class and Create Method for Remote Execution
Remote WMI Wbemcomn DLL Hijack
Basic PowerShell Execution
Service Creation
Alternate PowerShell Hosts
WMI Module Load
PowerShell Remote Session
Persistence
WMI Eventing
Remote WMI ActiveScriptEventConsumers
Privilege Escalation
Remote WMI ActiveScriptEventConsumers
Defense Evasion
DLL Injection via CreateRemoteThread and LoadLibrary
Wuauclt CreateRemoteThread Execution
Extended NetNTLM Downgrade
Enable Remote Desktop Conections Registry
WDigest Downgrade
Active Directory Replication User Backdoor
Credential Access
Domain DPAPI Backup Key Extraction
SAM Registry Hive Handle Request
Active Directory Replication From Non-Domain-Controller Accounts
Remote Interactive Task Manager LSASS Dump
LSASS Access from Non System Account
Discovery
SAM Registry Hive Handle Request
SysKey Registry Keys Access
Remote Service Control Manager Handle
Lateral Movement
Remote Service creation
WMI Win32_Process Class and Create Method for Remote Execution
Remote WMI ActiveScriptEventConsumers
SMB Create Remote File
Remote WMI Wbemcomn DLL Hijack
Remote DCOM IErtUtil DLL Hijack
PowerShell Remote Session
Collection
Access to Microphone Device
Tutorials
Jupyter Notebooks
.md
.pdf
repository
open issue
suggest edit
Contents
Lateral Movement
ΒΆ
Remote Service Control Manager Handle
Remote Service creation
