lsa, hidden account, winrm

mdecrevoisier · Jan 26, 2022 · 12b5e33 · 12b5e33
1 parent 2bb4d6b
commit 12b5e33
Show file tree

Hide file tree

Showing 7 changed files with 0 additions and 0 deletions.
diff --git a/TA0002-Execution/T1059.001-PowerShell/ID4103-4104-Payload download via PowerShell.evtx b/TA0002-Execution/T1059.001-PowerShell/ID4103-4104-Payload download via PowerShell.evtx
diff --git a/TA0003-Persistence/T1136-Create account/ID472, 4728 Hidden user creation.evtx b/TA0003-Persistence/T1136-Create account/ID472, 4728 Hidden user creation.evtx
diff --git a/...D4-LSA Protect mode enabled RunAsPPL.evtx → ...12-LSA Protect mode enabled RunAsPPL.evtx b/...D4-LSA Protect mode enabled RunAsPPL.evtx → ...12-LSA Protect mode enabled RunAsPPL.evtx
diff --git a/TA0004-Privilege Escalation/T1134-Access Token Manipulation/ID4648-4624-RunAsCS login.evtx b/TA0004-Privilege Escalation/T1134-Access Token Manipulation/ID4648-4624-RunAsCS login.evtx
diff --git a/...edential Access/T1003-Credential dumping/ID1-12-13-Wdigest authentication activation.evtx b/...edential Access/T1003-Credential dumping/ID1-12-13-Wdigest authentication activation.evtx
diff --git a/...58-Steal or Forge Kerberos Tickets/ID4768-Kerberos proxiable ticket (CVE-2021-42287).evtx b/...58-Steal or Forge Kerberos Tickets/ID4768-Kerberos proxiable ticket (CVE-2021-42287).evtx
diff --git a/...vement/T1021.006-Windows Remote Management/ID4656-WS Management listener enumeration.evtx b/...vement/T1021.006-Windows Remote Management/ID4656-WS Management listener enumeration.evtx