🌐
Mitre
attack.mitre.org › techniques › T1547 › 008
Boot or Logon Autostart Execution: LSASS Driver, Sub-technique T1547.008 - Enterprise | MITRE ATT&CK®
Adversaries may modify or add LSASS drivers to obtain persistence on compromised systems. The Windows security subsystem is a set of components that manage and enforce the security policy for a computer or domain. The Local Security Authority (LSA) is the main component responsible for local ...
🌐
Securitm
service.securitm.ru › mitre › techniques › T1547
MITRE ATTCK Техника Автозапуск при загрузке или входе в систему SECURITM
Управление рисками, угрозами, уязвимостями, активами, защитными мерами, задачами, соответствием требованиям по безопасности
🌐
GitHub
github.com › redcanaryco › atomic-red-team › blob › master › atomics › T1547.015 › T1547.015.yaml
atomic-red-team/atomics/T1547.015/T1547.015.yaml at master · redcanaryco/atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK. - atomic-red-team/atomics/T1547.015/T1547.015.yaml at master · redcanaryco/atomic-red-team
Author: redcanaryco
🌐
reddit
reddit.com › r › netsec › comments › ifmamn › windows_persistence_via_printer_port_monitors
r/netsec - Windows Persistence via Printer Port Monitors - T1547.010
August 16, 2020 - 453k members in the netsec community. /r/netsec is a community-curated aggregator of technical information security content. Our mission is to …
🌐
GitHub
github.com › redcanaryco › atomic-red-team › actions › runs › 5578082837
Added test for T1547.012 · redcanaryco/atomic-red-team@2a98464
Small and highly portable detection tests based on MITRE's ATT&CK. - Added test for T1547.012 · redcanaryco/atomic-red-team@2a98464
Author: redcanaryco
🌐
Gnupg
dev.gnupg.org › T1537
⚓ T1537 gpgv does not handle expired or revoked keys
gpgv is meant as a tool that does stricter key verification · It currently does not seem to handle revoked or expired GPG keys, returned SUCCESS for verification with them
🌐
Mitre
attack.mitre.org › techniques › T1547 › 009
Boot or Logon Autostart Execution: Shortcut Modification, Sub-technique T1547.009 - Enterprise | MITRE ATT&CK®
Adversaries may create or modify shortcuts that can execute a program during system boot or user login. Shortcuts or symbolic links are used to reference other files or programs that will be opened or executed when the shortcut is clicked or executed by a system startup process · Adversaries ...
🌐
ZeroDollarSoc
zerodollarsoc.com › home › 2021 › april › 5 › [t1547.002] authentication package - persistence, privilege escalation
[T1547.002] Authentication Package – Persistence, Privilege Escalation - ZeroDollarSoc
April 5, 2021 - Adversaries may abuse authentication packages to execute DLLs when the system boots. Windows authentication package DLLs are loaded by the Local Security Authority (LSA) process at system start. They provide support for multiple logon processes and multiple security protocols to the operating ...
🌐
GitHub
github.com › redcanaryco › atomic-red-team › blob › master › atomics › T1547.005 › T1547.005.yaml
atomic-red-team/atomics/T1547.005/T1547.005.yaml at master · redcanaryco/atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK. - atomic-red-team/atomics/T1547.005/T1547.005.yaml at master · redcanaryco/atomic-red-team
Author: redcanaryco
🌐
Atomic Red Team
atomicredteam.io › defense-evasion › T1548.001
T1548.001 - Atomic Red Team
July 28, 2024 - Abuse Elevation Control Mechanism: Setuid and Setgid
🌐
Mitre
attack.mitre.org › techniques › T1548 › 005
Abuse Elevation Control Mechanism: Temporary Elevated Cloud Access, Sub-technique T1548.005 - Enterprise | MITRE ATT&CK®
Adversaries may abuse permission configurations that allow them to gain temporarily elevated access to cloud resources. Many cloud environments allow administrators to grant user or service accounts permission to request just-in-time access to roles, impersonate other accounts, pass roles onto ...
🌐
GitHub
github.com › redcanaryco › atomic-red-team › blob › master › atomics › T1548.002 › T1548.002.md
atomic-red-team/atomics/T1548.002/T1548.002.md at master · redcanaryco/atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK. - atomic-red-team/atomics/T1548.002/T1548.002.md at master · redcanaryco/atomic-red-team
Author: redcanaryco
🌐
Lab Pro Inc
labproinc.com › products › l-tryptophanol-1g-t1537-1g
L-(-)-Tryptophanol, 1G - T1537-1G - Lab Pro Inc
L-(-)-Tryptophanol, 1G - T1537-1G - PROPERTIES - Purity: Min. 97.0 (T) Size: 1G Unit: EA Molecular Formula/Molecular Weight: C11H14N2O=190.25 CAS No: 2899-29-8 Physical State: Solid Color: White Melting Point: n/a Condition to Avoid: n/a Refractive Index: n/a Specific Gravity: n/a MDL No: ...
🌐
Gitbook
dmcxblue.gitbook.io › red-team-notes-2-0 › red-team-techniques › credential-access › t1557-man-in-the-middle
T1557: Man-in-the-Middle | Red Team Notes 2.0
Red Team Notes 2.0 · SearchCtrl + K · Introduction · Red Team · Red Team Techniques · Initial Access · T1190: Exploit Public-Facing Applications · Rejetto HTTP File Server (HFS) 2.3 · T1133: External Remote Services · SMB/Windows Admin Shares
🌐
Mitre
attack.mitre.org › techniques › T1547 › 007
Boot or Logon Autostart Execution: Re-opened Applications, Sub-technique T1547.007 - Enterprise | MITRE ATT&CK®
Adversaries may modify plist files to automatically run an application when a user logs in. When a user logs out or restarts via the macOS Graphical User Interface (GUI), a prompt is provided to the user with a checkbox to "Reopen windows when logging back in".[1] When selected, all applications ...
🌐
Gitbook
dmcxblue.gitbook.io › red-team-notes-2-0 › red-team-techniques › privilege-escalation › t1548-abuse-elevation-control-mechanism
T1548: Abuse Elevation Control Mechanism | Red Team Notes 2.0
Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific ...
🌐
GitHub
github.com › redcanaryco › atomic-red-team › blob › master › atomics › T1548.003 › T1548.003.md
atomic-red-team/atomics/T1548.003/T1548.003.md at master · redcanaryco/atomic-red-team
Small and highly portable detection tests based on MITRE's ATT&CK. - atomic-red-team/atomics/T1548.003/T1548.003.md at master · redcanaryco/atomic-red-team
Author: redcanaryco