Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Nterl0k - T1649 - ESC1 abuse with certify/certipy toolkits #809

Closed
wants to merge 16 commits into from
Closed

Nterl0k - T1649 - ESC1 abuse with certify/certipy toolkits #809

wants to merge 16 commits into from

Commits on May 25, 2023

  1. ESC! abuse files

    @nterl0k
    nterl0k authored May 25, 2023
    Configuration menu
    Copy the full SHA
    fff22c3 View commit details
    Browse the repository at this point in the history

  2. Rename certipy_esc1_abuse.txt to certipy_esc1_abuse.log

    @nterl0k
    nterl0k authored May 25, 2023
    Configuration menu
    Copy the full SHA
    532fad3 View commit details
    Browse the repository at this point in the history

Commits on Jun 3, 2023

  1. Add ESC1 authentication artifact

    @nterl0k
    nterl0k authored Jun 3, 2023
    Configuration menu
    Copy the full SHA
    5bd6d68 View commit details
    Browse the repository at this point in the history

Commits on Jun 10, 2023

  1. Rename files/folders

    @nterl0k
    nterl0k authored Jun 10, 2023
    Configuration menu
    Copy the full SHA
    2b3b729 View commit details
    Browse the repository at this point in the history

  2. Delete certify_esc1_abuse.log 

    update with more events
    @nterl0k
    nterl0k authored Jun 10, 2023
    Configuration menu
    Copy the full SHA
    febdaac View commit details
    Browse the repository at this point in the history

  3. Add files via upload 

    Add additional certify / certipy logs
    @nterl0k
    nterl0k authored Jun 10, 2023
    Configuration menu
    Copy the full SHA
    7fad6c5 View commit details
    Browse the repository at this point in the history

  4. Rename certify_esc1_abuse.txt to certify_esc1_abuse.log 

    renaming to log
    @nterl0k
    nterl0k authored Jun 10, 2023
    Configuration menu
    Copy the full SHA
    308af91 View commit details
    Browse the repository at this point in the history

Commits on Jun 13, 2023

  1. correct log entry

    @nterl0k
    nterl0k authored Jun 13, 2023
    Configuration menu
    Copy the full SHA
    2d32584 View commit details
    Browse the repository at this point in the history

Commits on Jul 13, 2023

  1. Added yml file

    @nterl0k
    nterl0k authored Jul 13, 2023
    Configuration menu
    Copy the full SHA
    fcacdf2 View commit details
    Browse the repository at this point in the history

Commits on Jul 28, 2023

  1. Splitting detections across sourcetypes.

    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    8bea853 View commit details
    Browse the repository at this point in the history

  2. Update and rename certify_esc1_abuse_powershell.txt to certify_esc1_a… 

    …buse_powershell.log
    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    0e60283 View commit details
    Browse the repository at this point in the history

  3. Update and rename certify_esc1_abuse_sysmon.txt to certify_esc1_abuse… 

    …_sysmon.log
    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    9b2555a View commit details
    Browse the repository at this point in the history

  4. Update and rename certify_esc1_abuse_winsecurity.txt to certify_esc1_… 

    …abuse_winsecurity.log
    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    3f0a011 View commit details
    Browse the repository at this point in the history

  5. Update certify_esc_1_abuse.yml 

    updating for split sourcetype logs
    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    a78d50a View commit details
    Browse the repository at this point in the history

  6. Update certify_esc_1_abuse.yml

    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    a25cff2 View commit details
    Browse the repository at this point in the history

  7. Delete certify_esc1_abuse.log 

    removing combined sourcetype log
    @nterl0k
    nterl0k authored Jul 28, 2023
    Configuration menu
    Copy the full SHA
    ac4c753 View commit details
    Browse the repository at this point in the history