From 29550b452401666ef174d804773a936e9b6882c1 Mon Sep 17 00:00:00 2001 From: Michel de CREVOISIER <52909656+mdecrevoisier@users.noreply.github.com> Date: Wed, 15 Jan 2025 22:04:13 +0100 Subject: [PATCH] Update ID541-DNS server auditing changed.evtx --- .../ID541-DNS server auditing changed.evtx | Bin 69632 -> 69632 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/TA0005-Defense Evasion/T1562.002-Disable Windows Event Logging/ID541-DNS server auditing changed.evtx b/TA0005-Defense Evasion/T1562.002-Disable Windows Event Logging/ID541-DNS server auditing changed.evtx index 5a0851210110fc5217c1259eb77debf5164336da..05cfa0f10a1ddcc8ab3ad5740df3e1f0e362c36b 100644 GIT binary patch literal 69632 zcmeI534Bf0zQ@>LnAxR0L ziAnK9z1XrFGT~fDED3SZshj-M*ZUUe4*t_CsaQcp4^;F(MGsW;Kt&H!^gu-qRP;ba z4^;F(MGsW;Kt&H!^uXWkfsmwxpkXN^;5B~vV#ChW*E8Yv>rR9WaUtZlE*+|{X8-UR zU4QR;lQ$Z#zzd2uwIk$_HPo^)z6aXE?H%AS#Q$|U@pm4xls#cDs7aTnto>f>2)Jzt z+?Jrq(-E$hS{NQeYN~1^vvtvXzhIZULfcSS=XTY4%GXf-zb!mREtdu?uW=1uUqbBQ zU=Q*>J;%GOR?H=xvrb1GbR7oVE5=9B%b!}@?Dy`a{H9w^SiW2d&xE!La3wi#kv>7X zY%j*Hhv4W@IefmjdT4NOSnt3NAG#ZQ=j;|1LjTam_+k zR(2g&A-B|CHl!yR4{J_0R3yYApscJP8=3eDbSEgnbP8g*7U35NR`!pVki za&$F~F4~jsu!?BtvP5|LiG~QY>zu5JjfImXv9Z!sCUxNk+|p}QvL(G)vqb2r6u8gA zsWP#$0>-uB3U1=DwRAMGCzv=OlQLBi&re%95c5N@VM%O7H~68G?^76e`CXMsom7 zLbKSPtHie1SZFvJ{;?Ex#LkAQm7>jRX9qnzjP)&cfKw%6XQ^{BY)(|hbeRg9Xb`lF zh7BpjkefntAv!BvIW%fD3eG>p&d^cGuqn`R@`) z&0?S@#z5nyh8{^FwEqL4E{Zu9_6R-U{#a-=igha?-q6AZ9i5=JA#cO;q!rn7bs$wN zt(;tmj}>u)rm#60PO$Y7dZLRRafg$u;j$H6q9;3IZ)oR9%6D*Yz%>`*OakHDUgraC z?1>k388vmM)$2Aqp{|UpLC8*fLb4qUD}!>-%dl9x!+(dX$5x-zx_{*xW8ci|1>MvY zo`X_oO`vC}$l{mrMTOnmz%Gg-^WGo*8H1ksa5wudfEy&Z-$F>&rFx#DRd)5!3P@# zL^Rw^-Ps1t>7JTyi?dR#;EB+IOYf}?CmZTaYn`p(nNjJ}XFZfyIKqP|b|3a=+V`xj zHMFIJG!6Q~!V$92c2ohhipO8=?4ZZuq4#=2vGVQ7!qEa+ThX^Jh$BFUYlc%uMtn-T zK6R)*J|jMt0k5Tw_p&f&zawYt z_niOOey5^=JqNsGFz$CYt1&R4|CR3s@pX=NoqXtKxHYvi>)79^*OFKT@-q z;gt;CJJE?t`8=P_C>(SX>STTATA5BI;j<7hC9Ga_%uC-rENF(0&)$SJR=eTmlWc$X z9h^640yn_&@JNTqvC-<+)4c7hd|FvPC#40{b5fYn8rB#G5$OFB;k>$Ge`Z0dSkqXB zB@-)pKh`y=S?jWXzWwz@(+aK!^sNR*Z)*OPjKI{6F4i=RIr{eh7tbACjy(*3nJ4W8 z+SQc|y)k|-A>AlHx_>+m=M5Rh-*yhtkfR^tm}ZCri3rKWiXx7fOmdD3cbB}D3@--g z@UeoKJ{=l#;fznplX9iw^fkscsq)F`rpLSfRpYZB=&VDX= z0lDW(;8jQwykf*;l5gh1ZPe~X$=`L?YW~CH zh!w*og(lxQ;~qZuZp-t}^li^fgZa-eIBvM2v0?uJdwz%qi=^`(%5ftcv{dgm12;DM z(#Nm#@CyBdlXJ@G_%zIeaKE{d_1=OyBSZT3(26T>zljyyS{yx9(lsHxphp$klM5W3 z?cnGueN~0YB8OeQ%`y5FSpTPmx+UZ+Hd&o9_#{5oYdQuKfmwZv6{mc(u>YPL2P0Q6&8*%fJFP}B96~FG_mMG~Tm~u95FfPxI+%&iO4?thVXTHct;lby@e8-RSyJ^@8>A)@Tk) z=rEb&T-Cl!xLr5**s_)(`DYJ4_IK#sN9EgfjHmyDxf=51`4%gRcw#cidGdXm5t4W5 zxUp})WE}67t<#Vr&$n1n#1WH8&QauB)A6bB?Rv&_ir0;AdzjU?SaD3@sQ9vJ;UT+T zn_YW)o!%cehqvaB!5aXWOmePj-|CAdOZ{P2|)?=&jVkSEW#SW(0ilS$5#@7obUJ6!u2`}QlwaY?148gk_M7AuN4Vlv4& zihOH2J{7+GnsJSq_rnseUgkWWfEBX`_o&|Q>Gwf79rg9E{yzR?2^_m^1-`{(l5TT^-(p1(M@%L;N0Dz$$EU)#n;F-7%XWSHwOM_O6$e(g4c)x>M(5ebKfUdA z!*7EFe8{3PeC`&LNzPU6TZbvFAJ~*7cFF9Yd1-jr4%j&<=C@lI&zSB9HRQ?jEmjoq z#AK554SDi>ixovYF`48%`MxbqavAl)*ta_v$JlLcHRQr~N(NJ=_X@fvp67 zP6d-m&Q7eIZwWC z{gO_F78v{X8^+O1XXmKhxa9d3D~dQ`GRZlLd}}&B6~5iaxL&SS;u+f8oby|(c%{iH z?_KSpgT7k#d(W3shnKeUf$x{W36n|ARqfkJUIT07r1uZqy6nVM-ztN9t9-kk@x0&j zg@!zNzQu|no|sH>o_yaviCTO8fw6B7FpeqxJiN3UmptEMMG;3#COJouZ%xOi!nX$* z*M_C@Gt$lKTdX*3@Z#HBehrV<(k*my$+R<*a_SPY7mnXzGRe8BeH*gmbV&8q`#-!l zeBZ`@`O}gC#=bqoI5wKKUqg;O-(p1( zM@%L;N0Dz$$EU)#-!ZN`PP&9S_c7=E7AwB~(MNf&cGi!`y76_>`hmr1nf2iF3E*5z zCOKENZ&O~Lsuwpcu4_^KfTGMF_k^l^dzkTDn^8kUo;=@TMG;R-COJ>OZ&w6;?cdDU zw?`PqQJ33j$dTt;tSI7$$t33}@~!FkRQUENRYUM^x#PMO2hqv3ZL`{ zJ5y)#i7PO-y#gO|!eo+jRr|K{ha+pXJ8)>qUB^}5d|2Bae& zixovYF`48%`M%v5x~###P^Va3%Y`<~*K&75n>IKiOhmKYVV_g172DK~()rm=*3Sx_@I%`E zsh#br!ViPO=Wj8YQ~xD>|5|&4*UqT!nZ#%o6K7V_balG^-SwoII-(p1(M@%L;N0Dz$$EU)#=NQ-b_YSyq)~vq8 zidiZ9?QWkL9hSR(Y3H4@TsjrO@mm7(TTCW7SG8}$3Op7ba(IxuDkES{;D{jjewo6z z=NZr9K`|Qg_w5VU7ZA0(FZzr6GKS_unK z$dTt;tSI7$$t33}@~!FkRQUF1#`V_V&W}Gct8cNQ{n$?W&$Ai^=S=80uK%JHRolaN z9WueUm`rl6YTt$x-G4ZGZ==knl^?!ik@84Azx@TrX?CQBJbAvI&MJy{Vlv5j@_oBC zU}|^8-*>poIKJ4Gp&>_}Z?U3?BPNraqsX_W<5S_=V#d|s$B88^`wvRi+Z+X8e8LUl~uA zc3B$oWRi0f`POuNDt!Ap zRYVnb|5Fjsml)$JN=(Lp0j;}dnx>V=py(TZA>OPSG8}WK7M;($>f_g zUmnpp9UV~*KA)iQ?G?uJ{_L+bbL>RYU6acl8spSP(O^ts29?S5H(Moffb30vX& zWtdEIu4>=5`Dl&Lx(+eJu`}R8HczyL=4LS0Bixov2F`48XMZPs1p9AMp@yBXW)MH<-^uJY|o#&bpo9}Ri( ze2W!DJTaN%Jo&y23g3Nbv9WJ&F^+8(=r!cX^DR~sal~Yja}@d3bbKm&dz*31zEKqM ztyz7G6?=VLynjZ=wUG-3e?GTe|2E@`;rQ(__zW&4lboyCw|)h^JPu{F3*Pp{=!?G)Lm_8#ME***E`3$ywbD?YWhnt9gqQOLIB-QANo_yafnEKiNhQ_{qz&H*W zlB*#{o^P?Dh$AMGoTJFMrsGrL+lP#6nfI|V^9Gvpcmh_O@BI3hZp9IS1xJU}%!~MA z)=7A;jQ)KGOeQ&3wQv3GSKhxiBQ)^C$X6dZyLI|THNSntcv>wytszgIZ?U3?Cnl4e zC*QZ(L92f`W9-`!#?gAt0}VOye2W!D95I>X97Vo09iIx{K4x6qxxOL!La}Vnq>8OeQ%`zHf^!j(x+?*tbs^$HUQeMr$`NdA`MpB953$a*iV3nvPF} zZ%Y~1q$xLZ`wlYa{1z+vHe7e;kK5V7U%vb0#*MpT_3i5r@)LaL0h3A2Rqfl;bBj)d zx@`~qJT^IX=z;e}z?Ywmefx~@e9+{PhCF$`#fl=Hm`rk>eBbtq+R(t?*tgFa$9s2N z^Rye6Jl|qP5l2iWIY*IiIpg!Zju2np@^Sitakc5<`Nw>-`W7pewppEj@kX17oF(I2 z@~hQyrGMWcAO3zBCX<}2+P9IL-SRef&MJ;dU0c%f&Eb)Rq#OJ8Psa0!PdyEJ@_dUG zMLaQ?Us@1@_dUGMI14i=TnOU55#WOE-)znrsi=*Aw zsC-+-crGn<(vT<5w^&ic6O&2KlkeNXp@rQQ@0XD#@WKU_H8q=P$dTt;tSI7$$t33} z@~!FkRQOiMxc>gm;k7-?>RYUsIWo!pe7(Z(go$t35h_U&x1k+X*spAFeq!>{Ln;H!^SzO`mN*R=K3kSEW#SW(0ilS$5# z@7p^+v{>V6>{}bgaa*eh4LS0Bixov2F`48XMZPs1p92qu%9tJ=5vnKS3@xzH`#n?$|&o_CgB$C6 zF0gKqS$&HYhn~B1ywoWmc;$g_2RMYS8Pm5uAywgo$t35h_HEgKn0Id!rUrje*nIcX zHsj!}PsQ7ubzmIxypuHK$nz~$6mi64 zl5-UK)^vO-eCx=#cB|T9+HJG?7Aszg={w?+w7=;yZ`TTN%)Y;HFSxcn{0s{wlboyC zw*gz+-BU7#>{&6u!~0l}Pk_p|PK;;&vq2j2^{iDB_68B!cy(Jf46R&(3LF_ot!30b6>$Ri&ld z%s<1xx6R!N!DNziRr}W4@qyRas2!2B%QjxSI_mubm2X`c&)jRV8uH}%7AuN)Vlv5j z@_pO7W@9hK_siTE$JL#tXvmT0TdXMJh{+`9DDti8_*D3|3gf!}MO^xNv-%b*p8fN3 zfzvZx#O^CcpJc{{97}^^w<{|Vg2^Q3s`hQ**KSW;s&>D6YW9SV)(`yyRlcptcs{;7 zLPMTB-(p1(PfR8`Prh%z30ZV)mGS)6opHSScD9BbdA`MpB953$a*iV3nvPF}Z>uq` zu}%&356tRYtQc0e#nA6}H0rv()8nA&)!s=hf$uw{!EZ8RGRe8BeS5iC{GIDAIi1(1 zoeOE7S7*D*x78WX>iJDIgdluyHx%4*xv{_(0~w3 zCOKENZ!hHMl=)5{8MSQPf<9xdYVTF~wkG4bFnxiBJbAvwiXxtvOmd!l-!2NC8~VGk zZ)-7*eRdXV$dTt;tSI7$$t33}@~!FkRQT4Dac!L)y11%YeTx-4UYa}cg9FVYW)!EE zHfl4s+B92G2pmtqWRi1L`}X+ay^S|Gxp&D;tluzU{%Z637Atmh zndzC=dqL#xX5mi5qwB6h-(oV!xvG8paE;Z@{2TTGAAkCDzatx8yr=SQ9maFtVJ&&0 zZ>w0t=h4cSOspv4iOD4A$@i_de%G>xbbfo7kZ1JwFyM11qv`LQka#kRWRQ4gosKx@ zIt;j1+`s~Uf)no05i7&Vg4mGq6CrlQ9Zs&qg*d~#c7~H3u{X4HAXN;c;@}#+eeWjXWplI{=T;GQ8zG)X6kB$cF)Xp#g`=yvH^nP`*Cjy^qj%N%05 o4|{L;*Iu>4rxz4X*)ZOBGa;$8e@L96XPS{Hl4iKX%LmQ=3r|7@B>(^b delta 1993 zcmbVL4NOyK6uqx~rBErfXrV<41u9dDtc9X;6Dj@x5y3(ypdg?E3W5-UO?0M3(5Yit z%fkShjAFpwi4@eapsr3sX5wZis05W&Z3g~q+Qj)2H`#mdlUN(GEc=qz``Vs+&$;J* zS7*d^MqDq%7zWWAoF^Q&n5wm&#JDGaItJ)CM;-Mu1Hjb{fO)t0r9q(*QJA|Mv?J7C z6G!X<5K0($KCDz%fN0_tFTkLhLRfhcteL?0KG-Qj#4l$sT@BR*!~?#2Txcj+lnpRJ zI91eP`nYfy^TaT4$Lvp^WQUNn)S=$nmbGWtn)~c8+fV&u!~rN&EFT((IIqK)t;g<_ z#Ke{mG2YV1DWHK=NP`GS1O?22nUDwhPy(e84(nkxtRZ7Dtbz@I$BvKBC+jy8UwQ|T z`c8Y7Eb_nt0S69b6Q2BDhYA9V(+{rIufEVPC^ubtkU5ajYHgPOP+i9Fy zDWIcRc2QcJmzna!Vm#Ek{A-)m4|gTod!1lhj0ke=9Vnqau8SLFSy4PQ>au@T@9bjM zB$(uY&rLi;%W?w?UC1etFY?vpvAW0k4inI8_&N zDDbmCmhS2|qzAWzxE2q-k4rGh@CiX$Qr>x_Joi4ACJ3w__xIkpKy&)<^2CS96}z8d zIC&E$5&+7gP{+D%L=@y(c+h-lZ`!@|hzLcWy(!D(O+irlY6J^w>H0w_*EcP zy^6is9~L&}Iayj(ff6ip-;(eayyVXsy0CGcCn9(dx_ZCI^X#qbD-Z&zm6_)l!!!c+SK8lZlg3&R6~n&#Xr>hj2G=b4V!DAuBBvC`uz|Nk{vyW~Jo> z@396H-8XW5!PfzAjz_p$ALQ(`fip>d{rA&idhNDf+QJ%b903Rrp7I~SQiUw#?Lbjh z0Q;n!iP=jpbpLe{=lCn#g&=ew;8h}=(I8OQO)$@IEP%_*CW&W zAwgyz~LkgYtc=#i$U#KsF#j^5jNgDV1&gCMIH!dWE$jz|8J zBQUb6X#&eF9vveB@%pt3OH<`Oe*4n<#`g~~Sio{1cyxqAMrQk6RmMTUy7Q1nEl9wsb`zN2A30t@?T4sVvokOZpoEmoX