ION28/BLUESPAWN issues and pull requests

#34 - T1035 Hunt Service Execution

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/services, priority/low, module/event-logs

#34 - T1035 Hunt Service Execution

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/services, priority/low, module/event-logs

#33 - T1031 Hunt for service changes

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/services, priority/high, in progress, difficulty/hard, module/event-logs

#33 - T1031 Hunt for service changes

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/services, priority/high, in progress, difficulty/hard, module/event-logs

#32 - Create Services Base

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, module/services, priority/high, difficulty/hard

#31 - T1050 Hunt for new services

Issue - State: closed - Opened by ION28 over 5 years ago - 3 comments
Labels: type/enhancement, module/configuration, module/services, priority/high, difficulty/hard, module/event-logs

#31 - T1050 Hunt for new services

Issue - State: closed - Opened by ION28 over 5 years ago - 3 comments
Labels: type/enhancement, module/configuration, module/services, priority/high, difficulty/hard, module/event-logs

#30 - T1100 Hunt for any webshells

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, in progress, module/file-system, difficulty/easy

#30 - T1100 Hunt for any webshells

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, in progress, module/file-system, difficulty/easy

#29 - T1084 Hunt WMI Event Subscriptions

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, priority/high, difficulty/easy, module/event-logs, lang/c++

#29 - T1084 Hunt WMI Event Subscriptions

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, priority/high, difficulty/easy, module/event-logs, lang/c++

#28 - File System Function to retrieve contents of a file

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/file-system, difficulty/easy

#27 - File System Function to check signature of exe/dll

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, module/file-system, difficulty/hard

#26 - Develop File System Base

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, in progress, module/file-system, difficulty/hard

#25 - T1015 - Accessibility Features

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/configuration, priority/high, in progress, module/file-system, difficulty/hard

#24 - Implement Menu / Command Line Options

Issue - State: closed - Opened by ION28 over 5 years ago - 7 comments
Labels: type/enhancement, in progress

#23 - Refactor code in Registry to hunt by ATT&CK Technique

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/bug, type/enhancement, priority/high, difficulty/easy

#22 - T1128 - Catch Netsh Helper DLL Persistence

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/configuration, priority/high, in progress, module/file-system, difficulty/easy, lang/c++, mode/hunt

#21 - Catch Winlogon Helper DLL Persistence

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, difficulty/easy

#20 - Secure the LSA (T1101 and T1131)

Issue - State: closed - Opened by ION28 over 5 years ago - 3 comments
Labels: type/enhancement, module/configuration, difficulty/hard

#19 - Look into realtime detection

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, difficulty/hard

#18 - Identify any Application Shimming

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, priority/low, in progress

#17 - Catch AppCert_DLLs Persistence

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, in progress

#16 - T1060 - Full coverage for startup persistence

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/bug, type/enhancement, module/file-system, difficulty/easy

#15 - Recursive Registry (Sub)Key Enumeration for Reporting

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/bug, module/configuration, priority/low, difficulty/hard

#14 - Catch Registry Runkeys / Startup

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, in progress

#13 - Catch AppInit Dlls Persistence

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, in progress

#12 - T1053 Analyze Scheduled Tasks

Issue - State: closed - Opened by ION28 over 5 years ago - 4 comments
Labels: type/enhancement, module/configuration, priority/high, difficulty/hard, module/event-logs, lang/c++

#11 - T1077 Analyze Windows Admin Shares

Issue - State: closed - Opened by ION28 over 5 years ago - 2 comments
Labels: type/enhancement, module/configuration, priority/low, difficulty/hard, lang/c++

#10 - Create MITRE Attack Matrix to visualize coverage and progress

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, in progress

#9 - Make a defs file that contains all definitions

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: priority/low, difficulty/easy

#8 - Add ability to auto fix registry keys to their correct value

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, module/configuration, difficulty/hard

#7 - Support reporting all subkeys/values in a particular registry path

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/enhancement, module/configuration, priority/high, in progress

#6 - Split registry analysis into known persistence keys and other

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, in progress

#5 - Support checking non REG_SZ keys in Registry.h

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/bug, module/configuration, in progress

#4 - come up with a new/better name

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: priority/low

#3 - Examine old sysinternals source code

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, priority/low, difficulty/hard

#2 - Add computer IP to collectinfo

Issue - State: closed - Opened by ION28 over 5 years ago - 1 comment
Labels: type/bug, priority/low

#1 - Import lots of bad reg keys

Issue - State: closed - Opened by ION28 over 5 years ago
Labels: type/enhancement, module/configuration, priority/low

GitHub / ION28/BLUESPAWN issues and pull requests