diff --git a/.github/latest_archiver_output.md b/.github/latest_archiver_output.md
index 8f70a8df5ce..5ed2f1c7bfd 100644
--- a/.github/latest_archiver_output.md
+++ b/.github/latest_archiver_output.md
@@ -1,590 +1,614 @@
 # Reference Archiver Results
 
-Last Execution: 2026-01-15 02:17:25
+Last Execution: 2026-03-15 04:13:05
 
 ### Archiver Script Results
 
 
 #### Newly Archived References
 
-- https://web.archive.org/web/20210725081645/https://github.com/cube0x0/CVE-2021-36934
-- https://web.archive.org/web/20231210115125/http://www.xuetr.com/
-- https://www.atomicredteam.io/atomic-red-team/atomics/T156001#atomic-test-46---aws---guardduty-suspension-or-deletion
+- https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
 
 #### Already Archived References
 
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4661
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_arithmetic_operators?view=powershell-5.1
-- https://enterprise.arcgis.com/en/server/12.0/administer/windows/inside-an-arcgis-server-site.htm
-- https://www.loobins.io/binaries/launchctl/
-- https://www.atomicredteam.io/atomic-red-team/atomics/T1048.003#atomic-test-8---python3-httpserver
-- https://medium.com/@redfanatic7/running-kali-linux-on-windows-51ad95166e6e
-- https://medium.com/@NullByteWht/hacking-macos-how-to-dump-1password-keepassx-lastpass-passwords-in-plaintext-723c5b1c311b
-- https://x.com/nas_bench/status/1868639048484425963
-- https://learn.microsoft.com/en-us/windows/win32/shell/launch
-- https://manpages.debian.org/unstable/ecasound/ecasound.1.en.html
-- https://strontic.github.io/xcyclopedia/library/dialer.exe-0B69655F912619756C704A0BF716B61F.html
-- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
-- https://www.huntress.com/blog/the-unwanted-guest
+- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
+- https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
+- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
+- https://juggernaut-sec.com/capabilities/#cap_setuid
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
+- https://github.com/amidaware/tacticalrmm
+- https://huntress.com/blog/esxi-vm-escape-exploit
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
+- https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
+- https://www.scip.ch/en/?labs.20240523
+- https://docs.microsoft.com/en-us/sql/tools/bcp-utility
+- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
+- https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
+- https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
 
 #### Error While Archiving References
 
-- https://www.cyberciti.biz/faq/how-force-kill-process-linux/
-- https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
+- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
+- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+- https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+- https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
+- https://tria.ge/231212-r1bpgaefar/behavioral2
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
+- https://megatools.megous.com/
 - https://www.howtogeek.com/137270/50-file-extensions-that-are-potentially-dangerous-on-windows
-- https://www.cyberciti.biz/faq/linux-remove-user-command/
-- https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
-- https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123
-- https://github.com/rtecCyberSec/BitlockMove
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
-- https://x.com/Max_Mal_/status/1826179497084739829
-- https://man7.org/linux/man-pages/man2/syslog.2.html
-- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
-- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
-- https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
-- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
-- https://trustedsec.com/blog/command-line-underdog-wmic-in-action
-- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
-- https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/
-- https://www.fortiguard.com/psirt/FG-IR-22-398
-- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
-- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
-- https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
-- https://www.group-ib.com/resources/threat-research/red-curl-2.html
+- https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
+- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
+- https://learn.microsoft.com/en-us/windows/security/hardware-security/enable-virtualization-based-protection-of-code-integrity
+- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
+- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
 - https://www.microsoft.com/en-us/security/blog/2025/10/06/investigating-active-exploitation-of-cve-2025-10035-goanywhere-managed-file-transfer-vulnerability/
-- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
-- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
+- https://lolbas-project.github.io/#/download
+- https://www.hexacorn.com/blog/2025/06/14/wpr-exe-boottrace-phantom-dll-axeonoffhelper-dll-lolbin/
+- https://securelist.com/passiveneuron-campaign-with-apt-implants-and-cobalt-strike/117745/
+- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
+- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
+- https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
+- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
+- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
+- https://tria.ge/231023-lpw85she57/behavioral2
+- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
+- https://tria.ge/240731-jh4crsycnb/behavioral2
+- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
+- https://man7.org/linux/man-pages/man8/setcap.8.html
+- https://tria.ge/241231-j9yatstqbm/behavioral1
+- https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html
+- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
+- https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
+- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
+- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Privileged%20container/
+- https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml
+- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
+- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
+- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/
+- https://learn.microsoft.com/en-us/windows/wsl/install
+- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
+- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
+- https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
+- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
+- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
+- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
+- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
+- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
+- https://localtonet.com/documents/supported-tunnels
+- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
+- https://gtfobins.github.io/gtfobins/curl/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/start
+- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
+- https://github.com/rtecCyberSec/SpeechRuntimeMove
+- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
+- https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
+- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
+- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
+- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
+- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
+- https://github.com/TwoSevenOneT/EDR-Freeze
+- https://pwn.guide/free/web/crushftp
+- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
+- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
+- https://www.man7.org/linux/man-pages/man1/systemctl.1.html
 - https://pentestlab.blog/2022/03/21/unconstrained-delegation/
-- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
-- https://x.com/0x534c/status/1944694507787710685
+- https://x.com/Threatlabz/status/1879956781360976155
+- https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
+- https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952
+- https://docs.aws.amazon.com/AWSEC2/latest/APIReference/API_DeleteFlowLogs.html
+- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
+- https://x.com/Wietze/status/1933495426952421843
+- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
+- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector
+- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon
+- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
+- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
+- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
+- https://www.trendmicro.com/en_us/research/25/f/water-curse.html
+- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
+- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
+- https://cert.gov.ua/article/6284080
+- https://docs.microsoft.com/en-us/windows/win32/amsi/antimalware-scan-interface-portal
+- https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
+- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
+- https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/
+- https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
+- https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
+- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
+- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
+- https://tria.ge/241015-l98snsyeje/behavioral2
+- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
+- https://gtfobins.github.io/gtfobins/gawk/#shell
+- https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
+- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
 - https://github.com/varwara/CVE-2024-35250
-- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
-- https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
-- https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004
-- https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
-- https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
-- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
-- https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
-- https://github.com/msanft/CVE-2025-55182
-- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
-- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
-- https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation
-- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
-- https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
+- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
 - https://www.welivesecurity.com/2020/03/05/guildma-devil-drives-electric/
-- https://news.sophos.com/en-us/2025/08/26/velociraptor-incident-response-tool-abused-for-remote-access/
-- https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
-- https://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
+- https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
+- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
+- https://linux.die.net/man/8/auditct
+- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef
+- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
+- https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
+- https://trustedsec.com/blog/command-line-underdog-wmic-in-action
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
+- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service
+- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
+- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
+- https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
+- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
+- https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting
+- https://labs.yarix.com/2025/06/doppelganger-an-advanced-lsass-dumper-with-process-cloning/
+- https://gtfobins.github.io/gtfobins/rsync/#shell
+- https://unit42.paloaltonetworks.com/chromeloader-malware/
+- https://github.com/DambergC/SaveFolder/blob/90e945eba80fae85f2d54b4616e05a44ec90c500/Cygate%20Installation%20tool%206.22/Script/OSD/OSDeployment-CredentialGuardDisable.ps1#L50
+- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
+- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
+- https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
+- https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/
+- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
+- https://www.coreycburton.com/blog/driploader-case-study
+- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16
+- https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
 - https://github.com/TwoSevenOneT/WSASS/blob/2c8fd9fa32143e7bc9f066e9511c6f8a57bc64b5/WSASS.cpp#L251
-- https://www.virustotal.com/gui/file/d2a4f52a9923336f119a52e531bbb1e66f18322fd8efa9af1a64b94f4d36dc97
-- https://www.scip.ch/en/?labs.20240523
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
+- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
+- https://manual.cs50.io/2/personality
+- https://dfir.ch/posts/linux_capabilities/
+- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+- https://www.welivesecurity.com/2020/07/16/mac-cryptocurrency-trading-application-rebranded-bundled-malware/
+- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
+- https://www.loobins.io/binaries/xattr/
+- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
+- https://redcanary.com/blog/threat-detection/process-masquerading/
+- https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
+- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
+- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
+- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038
 - https://labs.watchtowr.com/palo-alto-putting-the-protecc-in-globalprotect-cve-2024-3400/
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wkst/55118c55-2122-4ef9-8664-0c1ff9e168f3
-- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
-- https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
-- https://github.com/mulwareX/CVE-2025-6218-POC
-- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
-- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
+- https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
+- https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
+- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
+- https://docs.microsoft.com/en-us/powershell/module/appx/add-appxpackage
+- https://www.cve.org/CVERecord?id=CVE-2024-1709
+- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
+- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
+- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
+- https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
+- https://www.group-ib.com/resources/threat-research/red-curl-2.html
+- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
+- https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415
+- https://www.cyberciti.biz/faq/linux-remove-user-command/
 - https://www.softperfect.com/products/networkscanner/
-- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication
-- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
-- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
-- https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
-- https://www.binarly.io/blog/design-issues-of-modern-edrs-bypassing-etw-based-solutions
-- https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
-- https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png
-- https://github.com/0xthirteen/SharpMove/
+- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
+- https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
+- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
+- https://github.com/rapid7/metasploit-framework/issues/11337
+- https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
+- https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c
+- https://github.com/msanft/CVE-2025-55182
+- https://ss64.com/nt/schtasks.html
 - https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/390485493/config-system-admin
-- https://www.trendmicro.com/en_us/research/25/i/unmasking-the-gentlemen-ransomware.html
-- https://gtfobins.github.io/gtfobins/curl/
-- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
-- https://man7.org/linux/man-pages/man1/dmesg.1.html
-- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
-- https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
-- https://docs.datadoghq.com/security/default_rules/719-39f-9cd/
-- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
-- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
-- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
-- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
-- https://github.com/rtecCyberSec/SpeechRuntimeMove
-- https://asec.ahnlab.com/en/40263/
-- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/
-- https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
+- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
+- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
+- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
+- https://medium.com/@poudelswachchhanda123/preventing-lnk-and-fakecaptcha-threats-a-system-hardening-approach-2f7b7ed2e493
+- https://unit42.paloaltonetworks.com/cve-2025-59287/
+- https://redcanary.com/blog/threat-intelligence/msix-installers/
+- https://blog.axelarator.net/hunting-for-edr-freeze/
+- https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc
+- https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
 - https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/what-is-applocker
-- https://www.pwndefend.com/2022/01/07/log4shell-exploitation-and-hunting-on-vmware-horizon-cve-2021-44228/
-- https://www.trendmicro.com/en_us/research/25/c/windows-shortcut-zero-day-exploit.html
-- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
-- https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-33053
-- https://x.com/cyberfeeddigest/status/1887041526397587859
-- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
-- https://medium.com/@ninnesoturan/detecting-ipv6-dns-takeover-a54a6a88be1f
-- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-windowsai#disableaidataanalysis
-- https://localtonet.com/documents/supported-tunnels
-- https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
-- https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/
-- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
-- https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
-- https://www.youtube.com/watch?v=uSYvHUVU8xY
-- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
-- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
-- https://tria.ge/240731-jh4crsycnb/behavioral2
-- https://learn.microsoft.com/en-us/sysinternals/downloads/microsoft-store
-- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#password-spray
-- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local
-- https://www.dsinternals.com/en/dpapi-backup-key-theft-auditing/
-- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/
-- https://developer.broadcom.com/xapis/esxcli-command-reference/7.0.0/namespace/esxcli_system.html
-- https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today
-- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
+- https://github.com/The-Viper-One/Invoke-PowerDPAPI/
+- https://www.greynoise.io/blog/new-scraper-botnet-concentrated-in-taiwan
+- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36
+- https://www.elastic.co/guide/en/security/current/unusual-file-modification-by-dns-exe.html
+- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44547/44547-logid-event-config-objattr
+- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
+- https://github.com/CheraghiMilad/bypass-Neo23x0-auditd-config/blob/f1c478a37911a5447d5ffcd580f22b167bf3df14/sysinfo-syscall/README.md
+- https://www.cyberciti.biz/faq/how-force-kill-process-linux/
+- https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
+- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
+- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
+- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
 - https://redcanary.com/blog/threat-intelligence/intelligence-insights-may-2025/
-- https://learn.microsoft.com/en-us/troubleshoot/windows-client/installing-updates-features-roles/system-registry-no-backed-up-regback-folder
-- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
-- https://learn.microsoft.com/en-us/visualstudio/debugger/debug-using-the-just-in-time-debugger?view=vs-2019
+- https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
+- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
+- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
+- https://moonlock.com/amos-backdoor-persistent-access
+- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
 - https://github.com/TwoSevenOneT/WSASS
-- https://docs.python.org/3/library/http.server.html
-- https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
-- https://x.com/wietze/status/1958302556033065292?s=12
-- https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468
-- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
-- https://gladinetsupport.s3.us-east-1.amazonaws.com/gladinet/securityadvisory-cve-2005.pdf
-- https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3
-- https://hawktrace.com/blog/CVE-2025-59287-UNAUTH
-- https://sysdig.com/blog/detecting-and-mitigating-cve-2024-12084-rsync-remote-code-execution/
-- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
-- https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
-- https://thehackernews.com/2025/03/unpatched-windows-zero-day-flaw.html
-- https://github.com/TwoSevenOneT/EDR-Freeze/blob/a7f61030b36fbde89871f393488f7075d2aa89f6/EDR-Freeze.cpp#L53
-- https://thedfirreport.com/2025/06/30/hide-your-rdp-password-spray-leads-to-ransomhub-deployment/
-- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
-- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
-- https://adsecurity.org/?p=3377
-- https://www.group-ib.com/blog/apt41-world-tour-2021/
-- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
-- https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/
-- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
-- https://github.com/CoreyCBurton/DripLoaderNG
-- https://adsecurity.org/?p=1785
-- https://www.attackiq.com/2023/09/20/emulating-rhysida/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4616
+- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-with-memcm
+- https://github.com/trufflesecurity/trufflehog
+- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
+- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
+- https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
+- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/aws_login_failure/aws_cloudtrail_events.json
+- https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
+- https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
+- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
+- https://twitter.com/th3_protoCOL/status/1536788652889497600
+- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
+- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
+- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
+- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
 - https://www.jamf.com/blog/infostealers-pose-threat-to-macos/
-- https://www.loobins.io/binaries/xattr/
-- https://www.chrisfarris.com/post/effective-aws-ransomware/
-- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently
-- https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html
-- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
-- https://restic.net/
-- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
-- https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
-- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
-- https://www.cisa.gov/stopransomware/ransomware-guide
-- https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
-- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
-- https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
-- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country
-- https://github.com/amidaware/tacticalrmm
-- https://web.archive.org/web/20230929023836/http://powershellhelp.space/commands/set-netfirewallrule-psv5.php
-- https://medium.com/@boutnaru/the-windows-foreniscs-journey-run-mru-run-dialog-box-most-recently-used-57375a02d724
-- https://news.ycombinator.com/item?id=29504755
-- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
-- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
-- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
-- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
-- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
-- https://thedfirreport.com/2024/09/30/nitrogen-campaign-drops-sliver-and-ends-with-blackcat-ransomware/#exfiltration
-- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
-- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/Start-Process?view=powershell-5.1&viewFallbackFrom=powershell-7
+- https://cloud.google.com/logging/docs/audit/understanding-audit-logs
+- https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2
+- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump
+- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
+- https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/reagentc-command-line-options?view=windows-11
+- https://x.com/Max_Mal_/status/1826179497084739829
+- https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
+- https://github.com/arttoolkit/arttoolkit.github.io/blob/16d6230d009e58fd6f773f5317fd4d14c1f26004/_wadcoms/AMSI-Bypass-Jscript_amsienable.md
+- https://www.rapid7.com/blog/post/tr-crimson-collective-a-new-threat-group-observed-operating-in-the-cloud/
+- https://github.com/JohnHammond/recaptcha-phish
+- https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
+- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
 - https://blu.org/mhonarc/discuss/2001/04/msg00285.php
-- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-identity-roles.html
-- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
-- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
-- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
-- https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-terminalservices-rdp-winstationextensions-securitylayer
-- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
-- https://outpost24.com/blog/crushftp-auth-bypass-vulnerability/
-- https://unit42.paloaltonetworks.com/cve-2025-59287/
-- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
-- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
-- https://naikordian.github.io/blog/posts/brute-force-aws-console/
-- https://cert.gov.ua/article/6284080
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
+- https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
+- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
+- https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
+- https://ptsecurity.com/research/pt-esc-threat-intelligence/striking-panda-attacks-apt31-today
+- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
+- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
+- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
+- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
+- https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
+- https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action
+- https://research.checkpoint.com/2025/stealth-falcon-zero-day/
+- https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
+- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/333889629/config-firewall-policy
+- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
+- https://fourcore.io/blogs/threat-hunting-browser-credential-stealing
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
+- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
+- https://learn.microsoft.com/en-us/windows/compatibility/ntvdm-and-16-bit-app-support
+- https://www.fortiguard.com/psirt/FG-IR-22-398
 - https://github.com/grayhatkiller/SharpExShell
-- https://learn.microsoft.com/en-us/sysinternals/downloads/autoruns
-- https://research.splunk.com/endpoint/3742ebfe-64c2-11eb-ae93-0242ac130002
-- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
-- https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html
-- https://github.com/netero1010/EDRSilencer/blob/0e73a7037ec65c52894d8208e6f605a7da0a34a6/EDRSilencer.c
-- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
-- https://github.com/TwoSevenOneT/EDR-Freeze
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials
+- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
+- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc731935(v=ws.11)
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
+- http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/design/microsoft-recommended-driver-block-rules
+- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
+- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/109120963/config-user-local
+- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
+- https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
+- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/
+- https://docs.github.com/en/authentication/keeping-your-account-and-data-secure/security-log-events
+- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
+- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html
+- https://asec.ahnlab.com/en/40263/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
+- https://www.crowdstrike.com/en-us/blog/4-ways-adversaries-hijack-dlls/
+- https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
+- https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
+- https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
+- https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71
+- https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
+- https://x.com/wietze/status/1958302556033065292?s=12
+- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
+- https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior
+- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-table-transact-sql?view=sql-server-ver16
+- https://ss64.com/nt/set.html
+- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
+- https://www.fortiguard.com/psirt/FG-IR-24-535
+- https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
+- https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/
+- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
+- https://www.attackiq.com/2023/09/20/emulating-rhysida/
+- https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/configure
+- https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
+- https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml
+- https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
+- https://www.virustotal.com/gui/file/29837d0d3202758063185828c8f8d9e0b7b42b365c8941cc926d2d7c7bae2fb3
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
+- https://www.hexacorn.com/blog/2025/06/14/wermgr-exe-boot-offdmpsvc-dll-lolbin/
 - https://docs.python.org/2/library/simplehttpserver.html
-- https://megatools.megous.com/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
-- https://www.esentire.com/security-advisories/netsupport-rat-clickfix-distribution
-- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
-- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
-- https://feeds.alphasoc.net/bad-etlds.txt
+- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
+- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
+- https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/
+- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
+- https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3
+- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html
+- https://redcanary.com/blog/threat-intelligence/intelligence-insights-october-2024/
+- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/4/html/reference_guide/s3-proc-sys-kernel
+- https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
+- https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
+- https://www.loobins.io/binaries/pbpaste/
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
+- https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
+- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
+- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
+- https://www.loobins.io/binaries/nscurl/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
+- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
+- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
+- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
+- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
+- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
+- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
+- https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
+- https://firecompass.com/crushftp-vulnerability-cve-2025-54309-securing-file-transfer-services/
+- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
+- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
+- https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled
+- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
+- https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
+- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/306021697/config-firewall-address
 - https://informationsecuritybuzz.com/the-real-danger-behind-a-simple-windows-shortcut/
+- https://github.com/clearvector/lambda-spy
+- https://github.com/dsnezhkov/TruffleSnout/blob/7c2f22e246ef704bc96c396f66fa854e9ca742b9/TruffleSnout/Docs/USAGE.md
+- https://man7.org/linux/man-pages/man1/dmesg.1.html
 - https://awscli.amazonaws.com/v2/documentation/api/2.14.0/reference/account/enable-region.html
-- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
-- https://cardinalops.com/blog/the-art-of-anomaly-hunting-patterns-detection/
-- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
-- https://app.any.run/tasks/ae3c4ded-fd6a-43ed-8215-ba0ba574ad33
+- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
+- https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4625
+- https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/
+- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
+- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
+- https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
+- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
+- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
+- https://docs.aws.amazon.com/AmazonS3/latest/API/API_DeleteBucket.html
+- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
+- https://bazaar.abuse.ch/sample/7bde840c7e8c36dce4c3bac937bcf39f36a6f118001b406bfbbc25451ce44fb4/
+- https://cloud.hacktricks.xyz/pentesting-cloud/aws-security/aws-privilege-escalation/aws-rds-privesc#rds-modifydbinstance
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
 - https://unicornofhunt.com/2025/05/22/When-Unicorns-Go-Quiet-BITS-Jobs-and-the-Art-of-Stealthy-Transfers/
-- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
-- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
-- https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist
-- https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection
-- https://apophis133.medium.com/powershell-script-tactical-rmm-installation-45afb639eff3
-- https://web.archive.org/web/20211001064856/https://github.com/snovvcrash/DInjector
-- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/winrs
-- https://tria.ge/240521-ynezpagf56/behavioral1
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/dnscmd
-- https://learn.microsoft.com/en-us/windows/win32/setupapi/run-and-runonce-registry-keys
-- https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
-- https://blog.axelarator.net/hunting-for-edr-freeze/
-- https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/
-- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
-- https://app.any.run/tasks/ea944b89-69d8-49c8-ac1f-5c76ad300db2
-- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
-- https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis
-- https://www.zscaler.fr/blogs/security-research/threat-actors-exploit-cve-2017-11882-deliver-agent-tesla
-- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
-- https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm
-- https://manual.cs50.io/2/personality
 - https://any.run/report/6eea2773c1b4b5c6fb7c142933e220c96f9a4ec89055bf0cf54accdcde7df535/a407f006-ee45-420d-b576-f259094df091
-- https://securelist.com/forumtroll-apt-hacking-team-dante-spyware/117851/
-- https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
-- https://reliaquest.com/blog/threat-spotlight-inside-flax-typhoons-arcgis-compromise/
-- https://learn.microsoft.com/de-de/sysinternals/downloads/adexplorer
-- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
-- https://pwn.guide/free/web/crushftp
-- https://labs.nettitude.com/blog/introducing-sharpwsus/
-- https://nvd.nist.gov/vuln/detail/CVE-2025-2825
-- https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
-- https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py
-- https://blog.talosintelligence.com/understanding-the-phobos-affiliate-structure/
-- https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/
-- https://www.joesandbox.com/analysis/1467354/0/html
 - https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
-- https://github.com/nasbench/Misc-Research/blob/fc46f6da34ff7e0076da28fd3e66d6e1100f1c2f/ETW/Microsoft-Windows-SMBClient.md
-- https://research.checkpoint.com/2024/raspberry-robin-keeps-riding-the-wave-of-endless-1-days/
-- https://github.com/logangoins/Krueger/tree/main
-- https://docs.prismacloud.io/en/enterprise-edition/policy-reference/aws-policies/aws-general-policies/ensure-aws-guardduty-detector-is-enabled
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4732
-- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
-- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
-- https://learn.microsoft.com/en-us/dotnet/framework/tools/regasm-exe-assembly-registration-tool
-- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
-- https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
-- https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
-- https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
-- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
-- https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
-- https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository
-- https://research.splunk.com/sources/5d8bd475-c8bc-4447-b27f-efa508728b90/
-- https://stackoverflow.com/questions/66011412/how-to-clear-a-event-log-in-powershell-7
-- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
-- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
-- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
-- https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm
+- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
+- https://docs.datadoghq.com/security/default_rules/719-39f-9cd/
+- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
+- https://man7.org/linux/man-pages/man2/syslog.2.html
+- https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
+- https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/
+- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
+- https://taggart-tech.com/evildeno/
+- https://communities.vmware.com/t5/VMware-Workstation-Pro/VMCI-driver-issues/td-p/2866060
+- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
 - https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.management/reset-computermachinepassword?view=powershell-5.1
-- https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
-- https://suktech24.com/2025/07/17/aws-threat-detection-rule-guardduty-detector-disabled-or-suspended/
-- https://bazaar.abuse.ch/browse/tag/one/
-- https://research.checkpoint.com/2025/cve-2025-24054-ntlm-exploit-in-the-wild/
-- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
-- https://ngrok.com/blog-post/new-ngrok-domains
-- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_UpdateDetector.html
-- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
-- https://www.vaadata.com/blog/what-is-command-injection-exploitations-and-security-best-practices/
-- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
-- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
-- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpwritedump
-- https://cert.gov.ua/article/6277849
-- https://redcanary.com/blog/threat-detection/process-masquerading/
-- https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#non-compliant-device-sign-in
-- https://blog.sekoia.io/scattered-spider-laying-new-eggs/
-- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
-- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/s3api/delete-bucket.html
-- https://securelist.com/key-group-ransomware-samples-and-telegram-schemes/114025/
-- https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/
-- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
-- https://github.com/The-Viper-One/Invoke-PowerDPAPI/
-- https://blog.checkpoint.com/research/filefix-the-new-social-engineering-attack-building-on-clickfix-tested-in-the-wild/
-- https://www.electronjs.org/docs/latest/tutorial/native-code-and-electron
-- https://ss64.com/nt/schtasks.html
-- https://thedfirreport.com/2023/04/03/malicious-iso-file-leads-to-domain-wide-ransomware
-- https://learn.microsoft.com/en-us/windows/package-manager/winget/install#local-install
-- https://gtfobins.github.io/gtfobins/capsh/#shell
-- https://ss64.com/osx/sw_vers.html
-- https://www.huntress.com/blog/silencing-the-edr-silencers
+- https://www.vectra.ai/blog/undermining-microsoft-teams-security-by-mining-tokens
 - https://intel.thedfirreport.com/eventReports/view/57
-- https://github.com/redcanaryco/atomic-red-team/blob/5f866ca4517e837c4ea576e7309d0891e78080a8/atomics/T1040/T1040.md#atomic-test-16---powershell-network-sniffing
-- https://github.com/nasbench/EVTX-ETW-Resources/blob/f1b010ce0ee1b71e3024180de1a3e67f99701fe4/ETWProvidersManifests/Windows10/1903/W10_1903_Pro_20200714_18362.959/WEPExplorer/Microsoft-Windows-WindowsUpdateClient.xml
-- https://docs.aws.amazon.com/guardduty/latest/APIReference/API_DeleteDetector.html
-- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
-- https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
-- https://learn.microsoft.com/en-us/powershell/module/dism/enable-windowsoptionalfeature?view=windowsserver2022-ps
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
-- https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service
-- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
-- https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md
-- https://docs.github.com/en/pages/getting-started-with-github-pages/creating-a-github-pages-site
-- https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Delete%20K8S%20events/
-- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-5038
-- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
-- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
-- https://github.com/pr0xylife/Pikabot/blob/fc58126127adf0f65e78f4eec59675523f48f086/Pikabot_22.12.2023.txt
-- https://github.com/trufflesecurity/trufflehog
-- https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html
-- https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
-- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
-- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
-- https://www.securityhq.com/blog/malicious-isatap-tunneling-unearthed-on-windows-server/
-- https://linux.die.net/man/8/auditct
-- https://jgspiers.com/audit-group-policy-changes/
-- https://cloud.google.com/logging/docs/audit/understanding-audit-logs
-- https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
-- https://web.archive.org/web/20230329163438/https://blog.menasec.net/2019/02/threat-hunting-5-detecting-enumeration.html
-- https://research.splunk.com/endpoint/7215831c-8252-4ae3-8d43-db588e82f952
-- https://blog.eclecticiq.com/china-nexus-nation-state-actors-exploit-sap-netweaver-cve-2025-31324-to-target-critical-infrastructures
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-credentials
-- https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639
-- https://learn.microsoft.com/en-us/previous-versions/dotnet/framework/data/wcf/wcf-data-service-client-utility-datasvcutil-exe
-- https://web.archive.org/web/20230331181619/https://blog.dylan.codes/evading-sysmon-and-windows-event-logging/
-- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-failed-unusual-sign-ins
-- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
-- https://www.coreycburton.com/blog/driploader-case-study
-- https://learn.microsoft.com/en-us/windows/wsl/install
-- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
-- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
-- https://learn.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-monitor-federation-changes
-- https://www.loobins.io/binaries/nscurl/
-- https://cloud.google.com/blog/topics/threat-intelligence/apt41-innovative-tactics
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#service-principal-assigned-to-a-role
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-r2-and-2008/dd364427(v=ws.10)
-- https://ss64.com/nt/set.html
-- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
-- https://learn.microsoft.com/en-us/iis/configuration/system.webserver/httplogging
-- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
-- https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/
-- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
-- https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
-- https://docs.microsoft.com/en-us/sql/tools/bcp-utility
-- https://www.bleepingcomputer.com/news/security/centrestack-rce-exploited-as-zero-day-to-breach-file-sharing-servers/
-- https://taggart-tech.com/evildeno/
-- https://medium.com/@poudelswachchhanda123/preventing-lnk-and-fakecaptcha-threats-a-system-hardening-approach-2f7b7ed2e493
-- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
-- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
-- https://github.com/clearvector/lambda-spy
-- https://github.com/wietze/HijackLibs/tree/dc9c9f2f94e6872051dab58fbafb043fdd8b4176/yml/3rd_party/python
-- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/deploy-appcontrol-policies-using-group-policy
-- https://www.zerosalarium.com/2025/09/Dumping-LSASS-With-WER-On-Modern-Windows-11.html
-- https://www.fortiguard.com/psirt/FG-IR-24-535
-- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L36
-- https://www.safetycli.com/blog/shai-hulud-npm-attack-runs-malicious-github-action
-- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
-- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
-- https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1
-- https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
-- https://twitter.com/th3_protoCOL/status/1536788652889497600
-- https://research.checkpoint.com/2023/rhadamanthys-v0-5-0-a-deep-dive-into-the-stealers-components/
-- https://learn.microsoft.com/en-us/powershell/module/defender/set-mppreference
-- https://paper.seebug.org/1495/
-- https://www.huntress.com/blog/know-thy-enemy-a-novel-november-case-on-persistent-remote-access
-- https://github.com/ossec/ossec-hids/blob/f6502012b7380208db81f82311ad4a1994d39905/etc/rules/syslog_rules.xml
-- https://portswigger.net/daily-swig/vmware-horizon-under-attack-as-china-based-ransomware-group-targets-log4j-vulnerability
-- https://www.scpx.com.au/2025/11/16/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
-- https://www.pentestpartners.com/security-blog/living-off-the-land-gpo-style/
-- https://app.any.run/tasks/69c5abaa-92ad-45ba-8c53-c11e23e05d04/
+- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
+- https://www.nextron-systems.com/2025/07/29/detecting-the-most-popular-mitre-persistence-method-registry-run-keys-startup-folder/
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-infrastructure
+- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
+- https://www.kernel.org/doc/html/v4.10/_sources/admin-guide/sysrq.txt
+- https://www.youtube.com/watch?v=uSYvHUVU8xY
 - https://docs.aws.amazon.com/kms/latest/developerguide/ct-importkeymaterial.html
-- https://www.zscaler.com/blogs/security-research/deepseek-lure-using-captchas-spread-malware
-- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-31324
-- https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-event-reference-aws-console-sign-in-events.html
-- https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
-- https://github.com/EvotecIT/TheDashboard/blob/481a9ce8f82f2fd55fe65220ee6486bae6df0c9d/Examples/RunReports/PingCastle.ps1
-- https://reliaquest.com/blog/threat-spotlight-reliaquest-uncovers-vulnerability-behind-sap-netweaver-compromise/
+- https://itm4n.github.io/cdpsvc-dll-hijacking/
+- https://redfoxsec.com/blog/ipv6-dns-takeover/
+- https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
+- https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites
+- https://help.fortinet.com/fsiem/Public_Resource_Access/7_4_0/rules/PH_RULE_AWS_GuardDuty_Detector_Deletion.htm
+- https://adsecurity.org/?p=3377
+- https://bazaar.abuse.ch/browse/tag/one/
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::IZ_UNCAsIntranet
+- https://learn.microsoft.com/en-us/dotnet/api/system.directoryservices.accountmanagement?view=net-8.0
+- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/398/event
 - https://community.openvpn.net/openvpn/wiki/ManagingWindowsTAPDrivers
-- https://learn.microsoft.com/en-us/dotnet/api/system.identitymodel.tokens.kerberosrequestorsecuritytoken?view=netframework-4.8.1
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4741
-- https://cloud.google.com/blog/topics/threat-intelligence/unc3944-targets-saas-applications
-- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/configure-logging-in-iis
-- https://www.security.com/threat-intelligence/medusa-ransomware-attacks
-- https://www.hackingarticles.in/defense-evasion-windows-event-logging-t1562-002/
-- https://www.geeksforgeeks.org/how-to-kill-processes-on-the-linux-desktop-with-xkill/
-- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
-- https://hijacklibs.net/entries/microsoft/built-in/mpsvc.html
+- https://securelist.com/apt41-in-africa/116986/
+- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
+- https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/
+- https://beierle.win/2024-12-20-Weaponizing-WDAC-Killing-the-Dreams-of-EDR/
+- https://medium.com/@boutnaru/the-windows-foreniscs-journey-run-mru-run-dialog-box-most-recently-used-57375a02d724
+- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
+- https://dear-territory-023.notion.site/WebDav-Share-Testing-e4950fa0c00149c3aa430d779b9b1d0f?pvs=4
+- https://www.fortinet.com/blog/threat-research/newly-discovered-function-in-darkside-ransomware-variant-targets-disk-partitions
+- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
+- https://tria.ge/240521-ynezpagf56/behavioral1
+- https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
+- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/set_1
+- https://www.hexacorn.com/blog/2024/10/12/the-sweet16-the-oldbin-lolbin-called-setup16-exe/
+- https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes
+- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
+- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
+- https://www.trendmicro.com/en_us/research/24/j/edrsilencer-disrupting-endpoint-security-solutions.html
+- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4771
+- https://web.archive.org/web/20220319032520/https://blog.redbluepurple.io/offensive-research/bypassing-injection-detection
+- https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
+- https://www.splunk.com/en_us/blog/security/threat-update-awfulshred-script-wiper.html
+- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
+- https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventlog.clear
+- https://www.splunk.com/en_us/blog/security/msix-weaponization-threat-detection-splunk.html
+- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/328136827/config-user-group
 - https://thedfirreport.com/2025/01/27/cobalt-strike-and-a-pair-of-socks-lead-to-lockbit-ransomware/
-- https://x.com/Threatlabz/status/1879956781360976155
-- https://man7.org/linux/man-pages/man2/personality.2.html
-- https://www.virustotal.com/gui/search/behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CSysWOW64%255C%255Cmore.com%2522%2520behaviour_processes%253A%2522C%253A%255C%255CWindows%255C%255CMicrosoft.NET%255C%255CFramework%255C%255Cv4.0.30319%255C%255Cvbc.exe%2522/files
 - https://cloud.google.com/blog/topics/threat-intelligence/alphv-ransomware-backup/
+- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
+- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
+- https://learn.microsoft.com/en-us/entra/id-protection/howto-identity-protection-configure-mfa-policy
+- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
+- https://www.hexacorn.com/blog/2018/04/24/extexport-yet-another-lolbin/
+- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/113121765/config-vpn-ssl-web-portal
+- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
+- https://feeds.alphasoc.net/bad-etlds.txt
+- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
+- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
+- https://github.com/0xBruno/WSUSploit.NET/tree/e239bce9d6b5f46a346e1e4c4d5e0a2a20d5c639
 - https://www.virustotal.com/gui/file/54d60fd58d7fa3475fa123985bfc1594df26da25c1f5fbc7dfdba15876dd8ac5/behavior
 - https://darkatlas.io/blog/medusa-ransomware-group-opsec-failure
-- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
-- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
-- https://www.sentinelone.com/blog/exploiting-repos-6-ways-threat-actors-abuse-github-other-devops-platforms
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-granted-highly-privileged-permissions
-- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
-- https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
-- https://www.cyberciti.biz/faq/show-all-running-processes-in-linux/
-- https://moonlock.com/amos-backdoor-persistent-access
-- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
-- https://learn.microsoft.com/fr-fr/windows-server/administration/windows-commands/fsutil-behavior
-- https://reliaquest.com/blog/threat-spotlight-cve-2025-54309-crushftp-exploit/
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
-- https://news.sophos.com/en-us/2024/08/07/sophos-mdr-hunt-tracks-mimic-ransomware-campaign-against-organizations-in-india/
-- https://web.archive.org/web/20231015205935/https://githubmemory.com/repo/FunctFan/JNDIExploit
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd299871(v=ws.10)
-- https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-database-transact-sql?view=sql-server-ver16
-- https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/integrations/aws/defense_evasion_ec2_flow_log_deletion
-- https://learn.microsoft.com/en-us/windows/win32/shell/shell-and-managed-code
-- https://github.com/JohnHammond/recaptcha-phish
-- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-tsch/d1058a28-7e02-4948-8b8d-4a347fa64931
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/assoc
-- https://tria.ge/241015-l98snsyeje/behavioral2
-- https://lolbas-project.github.io/lolbas/OtherMSBinaries/Vshadow/
-- https://intel.thedfirreport.com/eventReports/view/70
-- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
-- https://www.microsoft.com/en-us/security/blog/2022/12/12/iis-modules-the-evolution-of-web-shells-and-how-to-detect-them/
-- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
-- https://web.archive.org/web/20200601000524/https://cyberx-labs.com/blog/gangnam-industrial-style-apt-campaign-targets-korean-industrial-companies/
-- https://www.bleepingcomputer.com/news/security/hackers-exploit-windows-smartscreen-flaw-to-drop-darkgate-malware/
-- https://mrd0x.com/filefix-clickfix-alternative/
-- https://www.virustotal.com/gui/file/14e722855605ba78dc1d21153f0e1be90e7528149f2cd2d7d6eba8ef27534bdc/behavior
-- https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
-- https://www.huntress.com/blog/blackcat-ransomware-affiliate-ttps
-- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/ec2/delete-flow-logs.html
-- https://winaero.com/how-to-delete-scan-with-windows-defender-from-context-menu-in-windows-10/
-- https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
-- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
-- https://www.loobins.io/binaries/pbpaste/
-- https://gtfobins.github.io/gtfobins/rsync/#shell
-- https://msrc.microsoft.com/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770/
-- https://github.com/Azure/Azure-Sentinel/blob/master/Solutions/Amazon%20Web%20Services/Analytic%20Rules/AWS_GuardDutyDisabled.yaml
-- https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025
-- https://syedhasan010.medium.com/forensics-analysis-of-an-lnk-file-da68a98b8415
-- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
-- https://redfoxsec.com/blog/ipv6-dns-takeover/
-- https://research.splunk.com/endpoint/395ed5fe-ad13-4366-9405-a228427bdd91/
-- https://docs.aws.amazon.com/accounts/latest/reference/API_EnableRegion.html
-- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
-- https://viz.greynoise.io/tags/hello-world-scraper-botnet?days=30
-- https://gtfobins.github.io/gtfobins/gawk/#shell
-- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
-- https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44
-- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
-- https://www.hexacorn.com/blog/2024/01/01/1-little-known-secret-of-hdwwiz-exe/
-- https://fourcore.io/blogs/threat-hunting-browser-credential-stealing
+- https://github.com/rtecCyberSec/BitlockMove
+- https://www.picussecurity.com/resource/blog/as-rep-roasting-attack-explained-mitre-attack-t1558.004
+- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
+- https://rapid7.com/blog/post/2019/02/19/stack-based-buffer-overflow-attacks-what-you-need-to-know/
+- https://learn.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
+- https://cardinalops.com/blog/living-off-winrm-abusing-complexity-in-remote-management/
 - https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#atypical-travel
-- https://www.virustotal.com/gui/file/e96a0c1bc5f720d7f0a53f72e5bb424163c943c24a437b1065957a79f5872675
-- https://cloud.google.com/blog/topics/threat-intelligence/russia-targeting-signal-messenger/
-- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
-- https://medium.com/r3d-buck3t/red-teaming-in-cloud-leverage-azure-frontdoor-cdn-for-c2-redirectors-79dd9ca98178
-- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
-- https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
-- https://docs.github.com/en/enterprise-cloud@latest/admin/monitoring-activity-in-your-enterprise/reviewing-audit-logs-for-your-enterprise/audit-log-events-for-your-enterprise#migration
-- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
-- https://www.linkedin.com/posts/huntress-labs_when-a-sketchy-incident-hits-your-network-activity-7304940371078238208-Th_l/?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAJTlRcB28IaUtg03HUU-IdliwzoAL1flGc
-- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
-- https://bazaar.abuse.ch/sample/5cb9876681f78d3ee8a01a5aaa5d38b05ec81edc48b09e3865b75c49a2187831/
-- https://www.linkedin.com/posts/mauricefielenbach_sharepoint-incidentresponse-windowssecurity-activity-7352653907363303425-bL2f
-- https://learn.microsoft.com/en-us/windows/win32/vss/vshadow-tool-and-sample
-- https://tria.ge/231212-r1bpgaefar/behavioral2
-- https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
-- https://medium.com/falconforce/soaphound-tool-to-collect-active-directory-data-via-adws-165aca78288c
-- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4776
-- https://www.cve.org/CVERecord?id=CVE-2024-1709
-- https://threatbook.io/blog/Analysis-of-APT-C-60-Attack-on-South-Korea
-- https://www.deepwatch.com/labs/customer-advisory-fortios-ssl-vpn-vulnerability-cve-2022-42475-exploited-in-the-wild/
-- https://www.threatdown.com/blog/clipboard-hijacker-tries-to-install-a-trojan/
-- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
-- https://gtfobins.github.io/gtfobins/gcc/#shell
-- https://www.elastic.co/guide/en/security/current/potential-non-standard-port-ssh-connection.html
-- https://www.proofpoint.com/us/blog/threat-insight/phish-china-aligned-espionage-actors-ramp-up-taiwan-semiconductor-targeting
-- https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
 - https://www.trendmicro.com/en_gb/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
-- https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
-- https://www.microsoft.com/en-us/security/blog/2025/04/15/threat-actors-misuse-node-js-to-deliver-malware-and-other-malicious-payloads/
-- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
-- https://www.huntress.com/blog/attacking-mssql-servers-pt-ii
-- https://www.unicode.org/versions/Unicode5.2.0/ch02.pdf
-- https://learn.microsoft.com/en-us/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide
-- https://blog.appsecco.com/kubernetes-namespace-breakout-using-insecure-host-path-volume-part-1-b382f2a6e216
-- https://x.com/JangPr0/status/1932034543026065833
-- https://vmois.dev/query-signal-desktop-messages-sqlite/
-- https://web.archive.org/web/20220205033028/https://twitter.com/PythonResponder/status/1385064506049630211
+- https://app.any.run/tasks/9a8fd563-4c54-4d0a-9ad8-1fe08339cbc3/
+- https://nvd.nist.gov/vuln/detail/CVE-2025-2825
+- https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-srvs/accf23b0-0f57-441c-9185-43041f1b0ee9
+- https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
+- https://jgspiers.com/audit-group-policy-changes/
+- https://github.com/Arno0x/DNSExfiltrator/
+- https://ngrok.com/blog-post/new-ngrok-domains
+- https://github.com/Ylianst/MeshAgent/blob/52cf129ca43d64743181fbaf940e0b4ddb542a37/modules/win-dispatcher.js#L173
+- https://docs.python.org/3/library/http.server.html
+- https://learn.microsoft.com/en-us/iis/manage/provisioning-and-managing-iis/managing-iis-log-file-storage
+- https://www.joesandbox.com/analysis/1605063/0/html
+- https://blackpointcyber.com/blog/racing-to-exploit-centrestacks-cve-2025-30406/
+- https://www.sentinelone.com/labs/ranzy-ransomware-better-encryption-among-new-features-of-thunderx-derivative/
+- https://goodworkaround.com/2022/02/15/digging-into-azure-ad-certificate-based-authentication/
+- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
+- https://about.gitlab.com/blog/gitlab-discovers-widespread-npm-supply-chain-attack/
+- https://github.com/mulwareX/CVE-2025-6218-POC
+- https://web.archive.org/web/20200530031906/https://techtalk.pcmatic.com/2017/11/30/running-dll-files-malware-analysis/
+- https://www.elastic.co/security-labs/maas-appeal-an-infostealer-rises-from-the-ashes
+- https://www.virustotal.com/gui/file/6bb4cdbaef03b732a93559a58173e7f16b29bfb159a1065fae9185000ff23b4b
+- https://gtfobins.github.io/gtfobins/gcc/#shell
+- https://mrd0x.com/filefix-clickfix-alternative/
+- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
+- https://woshub.com/disable-credential-guard-windows/
+- https://www.fortinet.com/blog/threat-research/ms-office-files-involved-in-emotet-trojan-campaign-pt-one
+- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
+- https://unit42.paloaltonetworks.com/microsoft-sharepoint-cve-2025-49704-cve-2025-49706-cve-2025-53770/
+- https://www.mdsec.co.uk/2019/02/macros-and-more-with-sharpshooter-v2-0/
+- https://adsecurity.org/?p=1785
+- https://man7.org/linux/man-pages/man2/sysinfo.2.html
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.InternetExplorer::SecurityPage_AutoDetect
+- https://www.cisa.gov/stopransomware/ransomware-guide
 - https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
-- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1082/T1082.md
-- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/takeown
+- https://github.com/CoreyCBurton/DripLoaderNG
+- https://catalyst.prodaft.com/public/report/inside-the-latest-espionage-campaign-of-nebulous-mantis
+- https://gist.github.com/travisbgreen/82b68bac499edbe0b17dcbfa0c5c71b7
+- https://mostafayahiax.medium.com/hunting-for-amsi-bypassing-methods-9886dda0bf9d
+- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
+- https://thedfirreport.com/2025/05/19/another-confluence-bites-the-dust-falling-to-elpaco-team-ransomware/
+- https://github.com/splunk/security_content/blob/7283ba3723551f46b69dfeb23a63b358afb2cb0e/lookups/browser_app_list.csv?plain=1
 - http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/
-- https://tria.ge/241231-j9yatstqbm/behavioral1
-- https://sdmsoftware.com/general-stuff/launching-the-new-gp-management-editor-from-the-command-line/
-- https://unit42.paloaltonetworks.com/microsoft-cve-2025-59287/
-- http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
-- https://unit42.paloaltonetworks.com/chromeloader-malware/
-- https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix
-- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html
+- https://www.youtube.com/watch?v=52tAmVLg1KM&t=2070s
+- https://x.com/0x534c/status/1944694507787710685
 - https://www.zerosalarium.com/2025/09/EDR-Freeze-Puts-EDRs-Antivirus-Into-Coma.html
-- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-24054
-- https://www.joesandbox.com/analysis/1605063/0/html
-- https://www.nextron-systems.com/2024/03/22/unveiling-kamikakabot-malware-analysis/
-- https://detect.fyi/hunting-fileless-malware-in-the-windows-registry-1339ccde00ad
-- https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
-- https://gist.github.com/swachchhanda000/a0228130f86a2dedfbcebb415b47f870
-- https://github.com/nasbench/Misc-Research/blob/2f651ede832ab34027a7ba005b63bb78f1ade378/Other/React-Next-Child-Processes-Notes.md
-- https://www.welivesecurity.com/en/eset-research/update-winrar-tools-now-romcom-and-others-exploiting-zero-day-vulnerability/
-- https://blogs.blackberry.com/en/2024/07/akira-ransomware-targets-the-latam-airline-industry
-- https://research.checkpoint.com/2025/stealth-falcon-zero-day/
-- https://gist.github.com/Dump-GUY/8daef859f382b895ac6fd0cf094555d2
-- https://twitter.com/Kostastsale/status/1480716528421011458
-- https://nodejs.org/api/child_process.html#class-childprocess
-- https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
-- https://www.cisa.gov/known-exploited-vulnerabilities-catalog
+- https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/?123
+- https://docs.github.com/en/enterprise-cloud@latest/code-security/secret-scanning/push-protection-for-repositories-and-organizations
+- https://web.archive.org/web/20170909091934/https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis
+- https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#assignment-and-elevation
+- https://github.com/search?q=devcon+disable+VMWVMCIHOSTDEV
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-acl?view=powershell-7.4
+- https://research.nccgroup.com/2018/11/22/turla-png-dropper-is-back/
+- https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/
+- https://support.microsoft.com/en-us/office/data-security-and-python-in-excel-33cc88a4-4a87-485e-9ff9-f35958278327
+- https://github.com/logangoins/Krueger/tree/main
+- https://www.pcrisk.com/removal-guides/31853-funklocker-funksec-ransomware
+- https://github.com/swagkarna/Defeat-Defender-V1.2.0/tree/ae4059c4276da6f6303b8f53cdff085ecae88a91
+- https://strontic.github.io/xcyclopedia/library/vbc.exe-A731372E6F6978CE25617AE01B143351.html
+- https://learn.microsoft.com/en-us/entra/id-protection/concept-identity-protection-risks#new-country
+- https://cloud.google.com/blog/topics/threat-intelligence/apt41-initiates-global-intrusion-campaign-using-multiple-exploits/
+- https://linux-audit.com/linux-aslr-and-kernelrandomize_va_space-setting/
+- https://www.chrisfarris.com/post/effective-aws-ransomware/
+- https://github.com/redcanaryco/atomic-red-team/blob/75fa21076dcefa348a7521403cdd6bfc4e88623c/atomics/T1124/T1124.md
+- https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules
+- https://github.com/0xthirteen/SharpMove/
+- https://www.virustotal.com/gui/file/f9710b0ba4de5fa0e7ec27da462d4d2fc6838eba83a19f23f6617a466bbad457
+- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
+- https://wazuh.com/blog/how-to-detect-meshagent-with-wazuh/
+- https://github.com/redcanaryco/atomic-red-team/blob/dd526047b8c399c312fee47d1e6fb531164da54d/atomics/T1112/T1112.yaml#L790
+- https://blog.sekoia.io/scattered-spider-laying-new-eggs/
+- https://redcanary.com/threat-detection-report/techniques/installer-packages/
+- https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
+- https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#roles-are-being-activated-too-frequently
 - https://learn.microsoft.com/en-us/dotnet/api/system.diagnostics.eventing.reader.eventlogsession.clearlog?view=windowsdesktop-9.0&viewFallbackFrom=dotnet-plat-ext-5.0#System_Diagnostics_Eventing_Reader_EventLogSession_ClearLog_System_String_
-- https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
-- https://www.nccgroup.com/us/research-blog/lapsus-recent-techniques-tactics-and-procedures/
-- https://www.ired.team/offensive-security/lateral-movement/winrs-for-lateral-movement
-- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
-- https://learn.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
-- https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/
-- https://learn.microsoft.com/en-us/windows/win32/debug/configuring-automatic-debugging
-- https://github.com/rapid7/metasploit-framework/issues/11337
-- https://x.com/Wietze/status/1933495426952421843
-- https://www.wiz.io/blog/how-to-set-secure-defaults-on-aws
-- https://www.hexacorn.com/blog/2020/08/23/certutil-one-more-gui-lolbin
-- https://learn.microsoft.com/en-us/entra/architecture/security-operations-devices#bitlocker-key-retrieval
-- https://expel.com/blog/cache-smuggling-when-a-picture-isnt-a-thousand-words/
+- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
+- https://github.com/HackTricks-wiki/hacktricks/blob/72f20a3fa26775b932bd819f1824c6377802a768/src/windows-hardening/basic-cmd-for-pentesters.md#firewall
+- https://docs.aws.amazon.com/kms/latest/developerguide/ct-deleteimportedkeymaterial.html
+- https://www.microsoft.com/en-us/security/blog/2025/03/06/malvertising-campaign-leads-to-info-stealers-hosted-on-github/
+- https://github.com/DrorDvash/CVE-2022-22954_VMware_PoC
 - https://en.wikipedia.org/wiki/Right-to-left_override
-- https://man7.org/linux/man-pages/man2/sysinfo.2.html
-- https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/bcdedit--set
-- https://www.man7.org/linux/man-pages/man1/systemctl.1.html
-- https://github.com/okta/workflows-templates/blob/1164f0eb71ce47c9ddc7d850e9ab87b5a2b42333/workflows/suspicious_activity_reported/readme.md
-- https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4673
-- https://github.com/elastic/detection-rules/blob/main/rules/integrations/aws/defense_evasion_guardduty_detector_deletion.toml
-- https://help.fortinet.com/fsiem/Public_Resource_Access/7_2_1/rules/PH_RULE_AWS_Management_Console_Brute_Force_of_Root_User_Identity.htm
-- https://www.intrinsec.com/alphv-ransomware-gang-analysis/?cn-reloaded=1
-- https://securelist.com/apt41-in-africa/116986/
-- https://tria.ge/231023-lpw85she57/behavioral2
-- https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
-- https://www.virustotal.com/gui/file/14d886517fff2cc8955844b252c985ab59f2f95b2849002778f03a8f07eb8aef
-- https://thecyberexpress.com/rogue-rdp-files-used-in-ukraine-cyberattacks/
-- https://github.com/Arno0x/DNSExfiltrator/
+- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
+- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
+- https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
+- https://www.joesandbox.com/analysis/1467354/0/html
+- https://www.huntress.com/blog/fake-browser-updates-lead-to-boinc-volunteer-computing-software
+- https://cert.gov.ua/article/6277849
+- https://github.com/kh4sh3i/CVE-2025-32463/blob/81bb430f84fa2089224733c3ed4bfa434c197ad4/exploit.sh
+- https://docs.microsoft.com/en-us/windows/win32/etw/configuring-and-starting-an-autologger-session
+- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
+- https://github.com/fortra/impacket/blob/ff8c200fd040b04d3b5ff05449646737f836235d/examples/secretsdump.py
+- https://www.linkedin.com/posts/kevin-beaumont-security_ive-been-assisting-a-few-orgs-hit-with-successful-activity-7268055739116445701-xxjZ/
+- https://docs.aws.amazon.com/STS/latest/APIReference/API_GetCallerIdentity.html
+- https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html
+- https://www.huntress.com/blog/silencing-the-edr-silencers
+- https://nodejs.org/api/child_process.html#class-childprocess
+- https://github.com/codewhitesec/SysmonEnte/blob/fe267690fcc799fbda15398243615a30451d9099/screens/1.png
+- https://vmois.dev/query-signal-desktop-messages-sqlite/
+- https://labs.nettitude.com/blog/introducing-sharpwsus/
+- https://web.archive.org/web/20221204161143/https://www.glitch-cat.com/p/green-lambert-and-attack
+- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/systeminfo
+- https://man7.org/linux/man-pages/man2/personality.2.html
+- https://x.com/0gtweet/status/1564131230941122561
+- https://www.bleepingcomputer.com/news/security/decades-old-finger-protocol-abused-in-clickfix-malware-attacks/
+- https://x.com/JangPr0/status/1932034543026065833
+- https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/
+- https://paper.seebug.org/1495/
+- https://docs.stellarcyber.ai/5.2.x/Using/ML/Alert-Rule-Based-Potentially_Malicious_AWS_Activity.html
+- https://docs.fortinet.com/document/fortigate/7.6.4/fortios-log-message-reference/44546/44546-logid-event-config-attr
+- https://www.trellix.com/blogs/research/the-silent-fileless-threat-of-vshell/
+- https://ss64.com/osx/sw_vers.html
+- https://www.huntress.com/blog/gootloader-threat-detection-woff2-obfuscation
+- https://gtfobins.github.io/gtfobins/capsh/#shell
+- https://www.huntress.com/blog/exploitation-of-windows-server-update-services-remote-code-execution-vulnerability
+- https://web.archive.org/web/20180203014709/https://blog.alsid.eu/dcshadow-explained-4510f52fc19d?gi=c426ac876c48
+- https://www.sophos.com/en-us/blog/sharpening-the-knife-gold-blades-strategic-evolution
+- https://juggernaut-sec.com/capabilities/#cap_setgid
+- https://www.fortalicesolutions.com/posts/hiding-behind-the-front-door-with-azure-domain-fronting
+- https://restic.net/
+- https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/8/html/configuring_and_managing_networking/getting-started-with-nftables_configuring-and-managing-networking
+- https://www.mcafee.com/blogs/other-blogs/mcafee-labs/agent-teslas-unique-approach-vbs-and-steganography-for-delivery-and-intrusion/
+- https://attackerkb.com/topics/k0EgiL9Psz/cve-2025-2825/rapid7-analysis
+- https://learn.microsoft.com/en-us/windows/client-management/mdm/policy-csp-deviceguard
+- https://cloud.google.com/blog/topics/threat-intelligence/evolution-of-fin7/
+- https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
+- https://thedfirreport.com/2025/09/08/blurring-the-lines-intrusion-shows-connection-with-three-major-ransomware-gangs/
+- https://x.com/cyberfeeddigest/status/1887041526397587859
+- https://www.fortinet.com/blog/threat-research/evolution-of-chaos-ransomware-faster-smarter-and-more-dangerous
+- https://www.security.com/threat-intelligence/medusa-ransomware-attacks
+- https://intel.thedfirreport.com/eventReports/view/70
+- https://www.virustotal.com/gui/file/d2a4f52a9923336f119a52e531bbb1e66f18322fd8efa9af1a64b94f4d36dc97
+- https://support.kaspersky.com/KES4Linux/12.0.0/en-US/197929.htm
+- https://naikordian.github.io/blog/posts/brute-force-aws-console/
+- https://x.com/byrne_emmy12099/status/1932346420226658668
+- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
+- https://research.splunk.com/endpoint/76406a0f-f5e0-4167-8e1f-337fdc0f1b0c/
+- https://www.getsafety.com/blog-posts/shai-hulud-npm-attack
+- https://docs.fortinet.com/document/fortigate/7.6.4/cli-reference/114404382/config-vpn-ssl-settings
+- https://github.com/HackTricks-wiki/hacktricks/blob/e4c7b21b8f36c97c35b7c622732b38a189ce18f7/src/windows-hardening/windows-local-privilege-escalation/privilege-escalation-with-autorun-binaries.md
+- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
+- https://securitylabs.datadoghq.com/cloud-security-atlas/vulnerabilities/iam-user-without-mfa/
+- https://docs.microsoft.com/en-us/powershell/module/powershellwebaccess/install-pswawebapplication
+- https://www.linkedin.com/posts/mauricefielenbach_livingofftheland-redteam-persistence-activity-7344801774182051843-TE00/
+- https://www.group-ib.com/blog/apt41-world-tour-2021/
+- https://github.com/redcanaryco/atomic-red-team/blob/5ede8f21e42ebe37e0a6eff757dba60bcfa85859/atomics/T1547.001/T1547.001.md
+- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
+- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
+- https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/operations/event-id-explanations
+- https://github.com/Lifailon/RSA/blob/rsa/Sources/RSA-1.4.1.ps1#L1468
+- https://github.com/h4rmy/KDU
+- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
+- https://twitter.com/Kostastsale/status/1480716528421011458
+- https://www.broadcom.com/support/security-center/protection-bulletin/funksec-ransomware
+- https://labs.jumpsec.com/tokensmith-bypassing-intune-compliant-device-conditional-access/
+- https://www.cybertriage.com/artifact/terminalservices_remoteconnectionmanager_log/
+- https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware
+- https://news.ycombinator.com/item?id=29504755
diff --git a/tests/rule-references.txt b/tests/rule-references.txt
index 2ed2210fcda..1cb9008c180 100644
--- a/tests/rule-references.txt
+++ b/tests/rule-references.txt
@@ -88,6 +88,7 @@ https://any.run/report/68bc255f9b0db6a0d30a8f2dadfbee3256acfe12497bf93943bc1eab0
 https://anydesk.com/en/changelog/windows
 https://app.any.run/tasks/17f2d378-6d11-4d6f-8340-954b04f35e83/
 https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/
+https://app.any.run/tasks/1efb3ed4-cc0f-4690-a0ed-24516809bc72/
 https://app.any.run/tasks/210244b9-0b6b-4a2c-83a3-04bd3175d017/
 https://app.any.run/tasks/214094a7-0abc-4a7b-a564-1b757faed79d/
 https://app.any.run/tasks/25970bb5-f864-4e9e-9e1b-cc8ff9e6386a
@@ -103,6 +104,7 @@ https://app.any.run/tasks/4bc9860d-ab51-4077-9e09-59ad346b92fd/
 https://app.any.run/tasks/512c1352-6380-4436-b27d-bb62f0c020d6/
 https://app.any.run/tasks/51e7185c-52d7-4efb-ac0d-e86340053473/
 https://app.any.run/tasks/579e7587-f09d-4aae-8b07-472833262965
+https://app.any.run/tasks/5c16b4db-4b36-4039-a0ed-9b09abff8be2
 https://app.any.run/tasks/61a296bb-81ad-4fee-955f-3b399f4aaf4b
 https://app.any.run/tasks/6217d77d-3189-4db2-a957-8ab239f3e01e
 https://app.any.run/tasks/62bb01ae-25a4-4180-b278-8e464a90b8d7/
@@ -120,6 +122,7 @@ https://app.any.run/tasks/7e906adc-9d11-447f-8641-5f40375ecebb
 https://app.any.run/tasks/7eaba74e-c1ea-400f-9c17-5e30eee89906/
 https://app.any.run/tasks/81f3c28c-c686-425d-8a2b-a98198d244e1/
 https://app.any.run/tasks/84fc9b4a-ea2b-47b1-8aa6-9014402dfb56/
+https://app.any.run/tasks/8901e2d5-0c5a-48ba-a8e9-10b5ed7e06f4
 https://app.any.run/tasks/8b9a571b-bcc1-4783-ba32-df4ba623b9c0/
 https://app.any.run/tasks/8bbd5b4c-b82d-4e6d-a3ea-d454594a37cc/
 https://app.any.run/tasks/8e22486b-5edc-4cef-821c-373e945f296c/
@@ -603,6 +606,7 @@ https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server
 https://docs.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
 https://docs.microsoft.com/en-us/sql/t-sql/statements/alter-server-audit-transact-sql?view=sql-server-ver16
 https://docs.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
+https://docs.microsoft.com/en-us/sql/tools/bcp-utility
 https://docs.microsoft.com/en-us/sql/tools/sqlcmd-utility?view=sql-server-ver15
 https://docs.microsoft.com/en-us/sql/tools/sqlps-utility?view=sql-server-ver15
 https://docs.microsoft.com/en-us/sysinternals/downloads/autoruns
@@ -815,6 +819,7 @@ https://github.com/albertzsigovits/malware-notes/blob/c820c7fea76cf76a861b28ebc7
 https://github.com/AlessandroZ/LaZagne/tree/master
 https://github.com/AliBrTab/CVE-2023-46747-POC/tree/main
 https://github.com/AlsidOfficial/WSUSpendu/
+https://github.com/amidaware/tacticalrmm
 https://github.com/amjcyber/EDRNoiseMaker
 https://github.com/amlweems/xzbot?tab=readme-ov-file#backdoor-demo
 https://github.com/antonioCoco/JuicyPotatoNG
@@ -1748,6 +1753,7 @@ https://hstechdocs.helpsystems.com/manuals/cobaltstrike/current/userguide/conten
 https://hunter2.gitbook.io/darthsidious/execution/responder-with-ntlm-relay-and-empire
 https://hunter2.gitbook.io/darthsidious/other/war-stories/domain-admin-in-30-minutes
 https://hunter2.gitbook.io/darthsidious/privilege-escalation/mimikatz
+https://huntress.com/blog/esxi-vm-escape-exploit
 https://hyp3rlinx.altervista.org/advisories/MICROSOFT_WINDOWS_DEFENDER_TROJAN.WIN32.POWESSERE.G_MITIGATION_BYPASS_PART2.txt
 https://i.blackhat.com/EU-21/Wednesday/EU-21-Teodorescu-Veni-No-Vidi-No-Vici-Attacks-On-ETW-Blind-EDRs.pdf
 https://ijustwannared.team/2020/08/01/the-curious-case-of-aspnet_compiler-exe/
@@ -1800,6 +1806,7 @@ https://jsecurity101.medium.com/bypassing-access-mask-auditing-strategies-480fb6
 https://jstnk9.github.io/jstnk9/research/GobRAT-Malware/
 https://jstnk9.github.io/jstnk9/research/InstallScreenSaver-SCR-files
 https://jstnk9.github.io/jstnk9/research/Jlaive-Antivirus-Evasion-Tool
+https://juggernaut-sec.com/capabilities/#cap_setuid
 https://kb.acronis.com/content/60892
 https://kb.cert.org/vuls/id/843464
 https://kb.eventtracker.com/evtpass/evtpages/EventId_6004_Microsoft-Windows-DNS-Server-Service_65410.asp
@@ -1900,6 +1907,7 @@ https://learn.microsoft.com/en-us/dotnet/core/diagnostics/dotnet-dump#dotnet-dum
 https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
 https://learn.microsoft.com/en-us/dotnet/framework/tools/installutil-exe-installer-tool
 https://learn.microsoft.com/en-us/dotnet/framework/tools/regsvcs-exe-net-services-installation-tool
+https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#appid-uri-added-modified-or-removed
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-authentication-flows
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#application-configuration-changes
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-applications#end-user-consent
@@ -1912,6 +1920,7 @@ https://learn.microsoft.com/en-us/entra/architecture/security-operations-privile
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#changes-to-privileged-accounts
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-accounts#things-to-monitor
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-privileged-identity-management#azure-ad-roles-assignment
+https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#monitoring-for-successful-unusual-sign-ins
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#short-lived-accounts
 https://learn.microsoft.com/en-us/entra/architecture/security-operations-user-accounts#unusual-sign-ins
 https://learn.microsoft.com/en-us/entra/id-governance/privileged-identity-management/pim-how-to-configure-security-alerts#administrators-arent-using-their-privileged-roles
@@ -2039,6 +2048,7 @@ https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-serve
 https://learn.microsoft.com/en-us/sql/odbc/odbcconf-exe?view=sql-server-ver16
 https://learn.microsoft.com/en-us/sql/relational-databases/system-stored-procedures/sp-procoption-transact-sql?view=sql-server-ver16
 https://learn.microsoft.com/en-us/sql/t-sql/statements/drop-server-audit-transact-sql?view=sql-server-ver16
+https://learn.microsoft.com/en-us/sql/t-sql/statements/truncate-table-transact-sql?view=sql-server-ver16
 https://learn.microsoft.com/en-us/sysinternals/downloads/livekd
 https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
 https://learn.microsoft.com/en-us/sysinternals/downloads/process-explorer
@@ -2101,6 +2111,7 @@ https://learn.microsoft.com/en-us/windows-server/identity/software-restriction-p
 https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
 https://learn.microsoft.com/en-us/windows/client-management/client-tools/quick-assist#disable-quick-assist-within-your-organization
 https://learn.microsoft.com/en-us/windows/client-management/manage-recall
+https://learn.microsoft.com/en-us/windows/msix/package/package-support-framework
 https://learn.microsoft.com/en-us/windows/msix/package/unsigned-package
 https://learn.microsoft.com/en-us/windows/package-manager/winget/source
 https://learn.microsoft.com/en-us/windows/security/application-security/application-control/app-control-for-business/deployment/appcontrol-deployment-guide
@@ -2377,6 +2388,7 @@ https://micahbabinski.medium.com/search-ms-webdav-and-chill-99c5b23ac462
 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/container%20service%20account/
 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Data%20destruction/
 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Exec%20into%20container/
+https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/List%20K8S%20secrets/
 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Pod%20or%20container%20name%20similarily/
 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Sidecar%20Injection/
 https://microsoft.github.io/Threat-Matrix-for-Kubernetes/techniques/Writable%20hostPath%20mount/
@@ -2520,6 +2532,7 @@ https://persistence-info.github.io/Data/windowsterminalprofile.html
 https://persistence-info.github.io/Data/wpbbin.html
 https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
 https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
+https://ponderthebits.com/2018/02/windows-rdp-related-event-logs-identification-tracking-and-investigation/
 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0708
 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1388
 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1472
@@ -3751,6 +3764,7 @@ https://www.justice.gov/file/1080281/download
 https://www.justice.gov/usao-cdca/divisions/national-security-division/qakbot-resources
 https://www.kaspersky.com/blog/lazarus-vhd-ransomware/36559/
 https://www.kernel.org/doc/html/v5.0/trace/kprobetrace.html
+https://www.kroll.com/en/insights/publications/cyber/cactus-ransomware-prickly-new-variant-evades-detection
 https://www.kroll.com/en/insights/publications/cyber/microsoft-teams-used-as-initial-access-for-darkgate-malware
 https://www.kroll.com/en/insights/publications/cyber/new-m365-business-email-compromise-attacks-with-rclone
 https://www.lexjansen.com/sesug/1993/SESUG93035.pdf
@@ -3947,6 +3961,7 @@ https://www.sans.org/cyber-security-summit/archives
 https://www.sans.org/cyber-security-summit/archives/file/summit-archive-1492186586.pdf
 https://www.sans.org/webcasts/119395
 https://www.sans.org/webcasts/tech-tuesday-workshop-cobalt-strike-detection-log-analysis-119395
+https://www.scip.ch/en/?labs.20240523
 https://www.scythe.io/library/threat-emulation-qakbot
 https://www.secuinfra.com/en/techtalk/hide-your-hypervisor-analysis-of-esxiargs-ransomware/
 https://www.secura.com/blog/zero-logon
@@ -4015,6 +4030,7 @@ https://www.thestack.technology/security-experts-call-for-incident-response-exer
 https://www.trellix.com/en-sg/about/newsroom/stories/threat-labs/lockergoga-ransomware-family-used-in-targeted-attacks.html
 https://www.trellix.com/en-us/about/newsroom/stories/research/beyond-file-search-a-novel-method.html
 https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/h/ransomware-actor-abuses-genshin-impact-anti-cheat-driver-to-kill-antivirus/Genshin%20Impact%20Figure%2010.jpg
+https://www.trendmicro.com/content/dam/trendmicro/global/en/research/24/b/lockbit-attempts-to-stay-afloat-with-a-new-version/technical-appendix-lockbit-ng-dev-analysis.pdf
 https://www.trendmicro.com/en_id/research/22/e/uncovering-a-kingminer-botnet-attack-using-trend-micro-managed-x.html
 https://www.trendmicro.com/en_no/research/24/b/cve202421412-water-hydra-targets-traders-with-windows-defender-s.html
 https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html