Skip to content

Issues: OTRF/detection-hackathon-apt29

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

49 Open 1 Closed
49 Open 1 Closed
Author
Filter by author
Loading
Label
Filter by label
Loading
Use alt + click/return to exclude labels
or ⇧ + click/return for logical OR
Projects
Filter by project
Loading
Milestones
Filter by milestone
Loading
Assignee
Filter by who’s assigned
Sort
Sort by
Newest Oldest Most commented Least commented Recently updated Least recently updated Best match
Most reactions
👍 👎 😄 🎉 😕 ❤️ 🚀 👀

Issues list

How do I know which Sysmon events are involved in each step?Can the dataset annotate the malicious logs?
#54 opened Dec 17, 2020 by xiaodupi-zyq
20.B) Pass the Ticket, Windows Remote Management, Create Account
#48 opened May 2, 2020 by Cyb3rWard0g
18
20.A) Rundll32, Windows Management Instrumentation Event Subscription, PowerShell
#47 opened May 2, 2020 by Cyb3rWard0g
19.C) File Deletion, Process Injection
#46 opened May 2, 2020 by Cyb3rWard0g
19.B) File Deletion, Process Injection
#45 opened May 2, 2020 by Cyb3rWard0g
19.A) File Deletion, Process Injection
#44 opened May 2, 2020 by Cyb3rWard0g
18.A) Web Service, Exfiltration Over Alternative Protocol
#43 opened May 2, 2020 by Cyb3rWard0g
17.C) Data Compressed, Obfuscated Files or Information
#42 opened May 2, 2020 by Cyb3rWard0g
17.B) Data from Local System, Data Staged
#41 opened May 2, 2020 by Cyb3rWard0g
16.D) Remote File Copy, Credential Dumping
#40 opened May 2, 2020 by Cyb3rWard0g
16.C) Next, the attacker uses the previously dumped credentials (T1078) to create a remote PowerShell session to the domain controller (T1028).
#39 opened May 2, 2020 by Cyb3rWard0g
16.B) System Owner/User Discovery, Execution through API
#38 opened May 2, 2020 by Cyb3rWard0g
16.A) Remote System Discovery
#37 opened May 2, 2020 by Cyb3rWard0g
11
15.A) Windows Management Instrumentation Event Subscription, System Owner/User Discovery
#36 opened May 2, 2020 by Cyb3rWard0g
14.B) Windows Management Instrumentation, Remote File Copy, Credential Dumping, Obfuscated Files or Information, Process Discovery, Deobfuscate/Decode Files or Information
#35 opened May 2, 2020 by Cyb3rWard0g
14.A) Component Object Model Hijacking, Bypass User Account Control
#34 opened May 2, 2020 by Cyb3rWard0g
13.D) Process Discovery
#33 opened May 2, 2020 by Cyb3rWard0g
13.C) System Owner/User Discovery
#32 opened May 2, 2020 by Cyb3rWard0g
13.B) Domain Name Enumeration
#31 opened May 2, 2020 by Cyb3rWard0g
13.A) System Information Discovery
#30 opened May 2, 2020 by Cyb3rWard0g
12.C) Query Registry
#29 opened May 2, 2020 by Cyb3rWard0g
12.B) Security Software Discovery
#28 opened May 2, 2020 by Cyb3rWard0g
12.A) Timestomp, File and Directory Discovery
#27 opened May 2, 2020 by Cyb3rWard0g
11.A) Initial Breach
#26 opened May 2, 2020 by Cyb3rWard0g
10.B) Registry Run Keys / Startup Folder
#25 opened May 2, 2020 by Cyb3rWard0g
3
ProTip! Adding no:label will show everything without a label.