jstnk9
							
						 
					 | 
					
						
						
							
						
						00bc9177bd
					 | 
					
						
						
							
							Added new sigma rule and references
						
						
						
						
						
						
						
						Added new sigma rule and references 
						
						
					 | 
					
						2022-05-15 16:42:44 +02:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						2b20998371
					 | 
					
						
						
							
							Remove redundant powershell command from comsvcs entry
						
						
						
						
						
						
					 | 
					
						2022-05-05 11:18:39 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						b92ee99627
					 | 
					
						
						
							
							Addressing @bohops's feedback
						
						
						
						
						
						
					 | 
					
						2022-05-05 11:12:22 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								bohops
							
						 
					 | 
					
						
						
							
						
						d93539bf9b
					 | 
					
						
						
							
							Quick fix for syntax and removed IOC
						
						
						
						
						
						
					 | 
					
						2022-04-29 23:06:41 -04:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								cr1sp4
							
						 
					 | 
					
						
						
							
						
						666e6e8645
					 | 
					
						
						
							
							Update Desk.yml (#210)
						
						
						
						
						
						
						
						Added Sigma rules. 
						
						
					 | 
					
						2022-04-29 22:52:57 -04:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						619aafbfa2
					 | 
					
						
						
							
							Adding extra contributor to Desk.cpl entry
						
						
						
						
						
						
					 | 
					
						2022-04-28 13:01:35 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						4a8bdf4844
					 | 
					
						
						
							
							Fix casing on Desk.cpl entry
						
						
						
						
						
						
					 | 
					
						2022-04-27 11:20:13 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								LuxNoBu!!shit
							
						 
					 | 
					
						
						
							
						
						6ed0fb9326
					 | 
					
						
						
							
							Create Desk.cpl (#207)
						
						
						
						
						
						
						
						Co-authored-by: Wietze <wietze@users.noreply.github.com> 
						
						
					 | 
					
						2022-04-27 11:15:15 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						e4261b1f02
					 | 
					
						
						
							
							Fixing typo
						
						
						
						
						
						
					 | 
					
						2022-04-26 16:59:14 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						5c46dd63f5
					 | 
					
						
						
							
							Giving Hexacorn the proper credit
						
						
						
						
						
						
					 | 
					
						2022-04-07 15:50:39 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						4df2e43c82
					 | 
					
						
						
							
							Adding Conhost.exe LOLBAS
						
						
						
						
						
						
					 | 
					
						2022-04-05 18:46:58 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						55a7ea9a81
					 | 
					
						
						
							
							Fixing wlrmdr entry
						
						
						
						
						
						
					 | 
					
						2022-02-16 21:02:24 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Moshe Kaplan
							
						 
					 | 
					
						
						
							
						
						12c85eb8f0
					 | 
					
						
						
							
							Create wlrmdr.yml (#194)
						
						
						
						
						
						
						
						Co-authored-by: Wietze <wietze@users.noreply.github.com> 
						
						
					 | 
					
						2022-02-16 20:41:14 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								akshat pradhan
							
						 
					 | 
					
						
						
							
						
						a7f7ec2cc2
					 | 
					
						
						
							
							Changing ATT&CK TID of wuauclt.exe entry (#193)
						
						
						
						
						
						
					 | 
					
						2022-01-23 22:24:59 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Andrew Kisliakov
							
						 
					 | 
					
						
						
							
						
						e40a6432a0
					 | 
					
						
						
							
							Merge branch 'LOLBAS-Project:master' into master
						
						
						
						
						
						
					 | 
					
						2022-01-17 08:16:16 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Andrew Kisliakov
							
						 
					 | 
					
						
						
							
						
						ada7f7f6c3
					 | 
					
						
						
							
							Microsoft Teams as a LOLbin
						
						
						
						
						
						
					 | 
					
						2022-01-17 08:11:47 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						085aaa37b1
					 | 
					
						
						
							
							Adding more missed-out entries
						
						
						
						
						
						
					 | 
					
						2021-12-15 11:50:18 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						52302853c9
					 | 
					
						
						
							
							Merge branch 'master' into windows_11_sprint
						
						
						
						
						
						
					 | 
					
						2021-12-14 17:39:36 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						e51caad3dd
					 | 
					
						
						
							
							Adding Windows 11 reference to missed-out executables
						
						
						
						
						
						
					 | 
					
						2021-12-14 16:57:56 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						6793a7d238
					 | 
					
						
						
							
							Fixing various issues identified
						
						
						
						
						
						
					 | 
					
						2021-12-14 16:50:22 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						adf171d089
					 | 
					
						
						
							
							Applying minor format changes (incorrectly formatted dates, typos, etc.)
						
						
						
						
						
						
					 | 
					
						2021-12-14 15:53:03 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						754a451e76
					 | 
					
						
						
							
							Updating entries that have been confirmed to be working on Windows 11 (21H2)
						
						
						
						
						
						
					 | 
					
						2021-12-14 15:51:43 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						39d4e815af
					 | 
					
						
						
							
							Minor formatting changes (redudant backslashes, incorrect dates, typos, etc.)
						
						
						
						
						
						
					 | 
					
						2021-12-14 14:57:32 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								whickey-r7
							
						 
					 | 
					
						
						
							
						
						18bceb7639
					 | 
					
						
						
							
							Create Unregmp2.yml
						
						
						
						
						
						
						
						Added a new lolbin, unregmp2.exe, used for proxying execution. 
						
						
					 | 
					
						2021-12-06 12:13:24 -05:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								frack113
							
						 
					 | 
					
						
						
							
						
						17899acbb0
					 | 
					
						
						
							
							Adding Sigma references to ConfigSecurityPolicy, Diantz, ExtExport & Extrac32 (#184)
						
						
						
						
						
						
					 | 
					
						2021-12-06 11:19:01 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								frack113
							
						 
					 | 
					
						
						
							
						
						2d28767c04
					 | 
					
						
						
							
							Adding new Sigma references (AppInstaller, AspnetCompiler, Bash, Certreq) (#183)
						
						
						
						
						
						
					 | 
					
						2021-11-25 09:42:26 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						f7b30775a4
					 | 
					
						
						
							
							Odbcconf realign to T1218.008, hh.exe to T1218.001
						
						
						
						
						
						
					 | 
					
						2021-11-16 14:09:37 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								bohops
							
						 
					 | 
					
						
						
							
						
						23dd0236ae
					 | 
					
						
						
							
							Detection Resources and Other Updates (#179)
						
						
						
						
						
						
						
						* Add detection links for scripts
* Add detection links for OtherMSBins. Fixed and updated as needed.
* Add detection links for MSBins. Fixed and updated as needed.
* Add detection links for oslibraries
* Updating template for Detections
* Removing empty Detection:Sigma entries
* Remove redundant blank line
* Replacing commit URL with file URL
Co-authored-by: root <root@DESKTOP-5CR935D.localdomain>
Co-authored-by: Wietze <wietze@users.noreply.github.com> 
						
						
					 | 
					
						2021-11-15 08:19:03 -05:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						4860585fb7
					 | 
					
						
						
							
							Adding CustomShellHost.exe LOLBAS
						
						
						
						
						
						
					 | 
					
						2021-11-14 23:26:39 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								akshat pradhan
							
						 
					 | 
					
						
						
							
						
						2031916b1a
					 | 
					
						
						
							
							ATT&CK realignment, typo fixes (#178)
						
						
						
						
						
						
						
						* Corrected Mitre TID for pnputil
* Fixed Command misspells 
						
						
					 | 
					
						2021-11-14 17:27:17 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								akshat pradhan
							
						 
					 | 
					
						
						
							
						
						53a4070205
					 | 
					
						
						
							
							Fixed formating
						
						
						
						
						
						
					 | 
					
						2021-11-09 08:16:34 +05:30 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								akshat pradhan
							
						 
					 | 
					
						
						
							
						
						33a8da933c
					 | 
					
						
						
							
							Added AWL Bypass to Ssh.yml
						
						
						
						
						
						
					 | 
					
						2021-11-09 08:14:43 +05:30 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								akshat pradhan
							
						 
					 | 
					
						
						
							
						
						dfc7d40b1f
					 | 
					
						
						
							
							Create Ssh
						
						
						
						
						
						
					 | 
					
						2021-11-08 22:21:37 +05:30 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						2380c506d4
					 | 
					
						
						
							
							LSASS realign to T1003.001
						
						
						
						
						
						
					 | 
					
						2021-11-05 20:35:58 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						df8c88f4ca
					 | 
					
						
						
							
							Remaping NTDS entries to T1003.003
						
						
						
						
						
						
					 | 
					
						2021-11-05 20:32:44 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						8257d60aad
					 | 
					
						
						
							
							Realigning .ps1 scripts to T1216
						
						
						
						
						
						
					 | 
					
						2021-11-05 20:29:07 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						bc51cb4e03
					 | 
					
						
						
							
							More changes (mainly changing some T1218 instances to T1202)
						
						
						
						
						
						
					 | 
					
						2021-11-05 20:19:39 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						2577066af9
					 | 
					
						
						
							
							More changes (mainly changing generic T1218 to dev-specific T1127)
						
						
						
						
						
						
					 | 
					
						2021-11-05 20:06:57 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						8286677dac
					 | 
					
						
						
							
							Applying more specific subtechniques to Verclsid
						
						
						
						
						
						
					 | 
					
						2021-11-05 19:38:21 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						80e3f67e44
					 | 
					
						
						
							
							Applying more specific subtechniques to At/Schtasks, closes LOLBAS-Project/LOLBAS#113
						
						
						
						
						
						
					 | 
					
						2021-11-05 19:33:59 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						4f7ec8d2af
					 | 
					
						
						
							
							MITRE ATT&CK realignment sprint
						
						
						
						
						
						
					 | 
					
						2021-11-05 18:58:26 +00:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Ensar Şamil
							
						 
					 | 
					
						
						
							
						
						97f5042a58
					 | 
					
						
						
							
							Update Certoc.yml (#168)
						
						
						
						
						
						
						
						Co-authored-by: Wietze <wietze@users.noreply.github.com> 
						
						
					 | 
					
						2021-10-27 10:02:52 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Oddvar Moe
							
						 
					 | 
					
						
						
							
						
						5db35bb397
					 | 
					
						
						
							
							Updated msbuild with logger technique
						
						
						
						
						
						
					 | 
					
						2021-10-26 00:27:35 +02:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Oddvar Moe
							
						 
					 | 
					
						
						
							
						
						7aeed60864
					 | 
					
						
						
							
							Updated msbuild with logger technique
						
						
						
						
						
						
					 | 
					
						2021-10-26 00:19:57 +02:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Oddvar Moe
							
						 
					 | 
					
						
						
							
						
						b91c7ddab5
					 | 
					
						
						
							
							Updated msbuild with logger technique
						
						
						
						
						
						
					 | 
					
						2021-10-26 00:17:08 +02:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						ca11578655
					 | 
					
						
						
							
							Archiving off legacy LOLUtilz
						
						
						
						
						
						
					 | 
					
						2021-10-25 21:32:59 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						fa3ff39cac
					 | 
					
						
						
							
							Update Nvudisp.yml
						
						
						
						
						
						
					 | 
					
						2021-10-25 12:33:19 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						d411d9572b
					 | 
					
						
						
							
							Create Finger.exe (#154)
						
						
						
						
						
						
						
						Closes #24, #123 
						
						
					 | 
					
						2021-10-25 12:30:32 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						eafc1982f0
					 | 
					
						
						
							
							Website update
						
						
						
						
						
						
					 | 
					
						2021-10-25 12:28:09 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 | 
				
			
				
					
						
							
							
								 
								Wietze
							
						 
					 | 
					
						
						
							
						
						234eb99a7d
					 | 
					
						
						
							
							Formatting
						
						
						
						
						
						
					 | 
					
						2021-10-25 12:27:00 +01:00 | 
					
					
						
						
						
							
							
							
							
							
							
							
							
						
					 |