Merge pull request #330 from Yamato-Security/delete-sample-evtx-dir

Delete sample-evtx dir
2021-12-22 10:18:56 +09:00
parent 0d4fe82a23 62b856efbb
commit 6f31f09c74
503 changed files with 0 additions and 0 deletions
--- a/sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-encoding-menu.evtx
+++ b/sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-encoding-menu.evtx
--- a/sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx
+++ b/sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-many.evtx
--- a/sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-string-menu.evtx
+++ b/sample-evtx/DeepBlueCLI/Powershell-Invoke-Obfuscation-string-menu.evtx
--- a/sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx
+++ b/sample-evtx/DeepBlueCLI/disablestop-eventlog.evtx
--- a/sample-evtx/DeepBlueCLI/eventlog-dac.evtx
+++ b/sample-evtx/DeepBlueCLI/eventlog-dac.evtx
--- a/sample-evtx/DeepBlueCLI/many-events-application.evtx
+++ b/sample-evtx/DeepBlueCLI/many-events-application.evtx
--- a/sample-evtx/DeepBlueCLI/many-events-security.evtx
+++ b/sample-evtx/DeepBlueCLI/many-events-security.evtx
--- a/sample-evtx/DeepBlueCLI/many-events-system.evtx
+++ b/sample-evtx/DeepBlueCLI/many-events-system.evtx
--- a/sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-security.evtx
+++ b/sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-security.evtx
--- a/sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-system.evtx
+++ b/sample-evtx/DeepBlueCLI/metasploit-psexec-native-target-system.evtx
--- a/sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx
+++ b/sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-security.evtx
--- a/sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx
+++ b/sample-evtx/DeepBlueCLI/metasploit-psexec-powershell-target-system.evtx
--- a/sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx
+++ b/sample-evtx/DeepBlueCLI/metasploit-psexec-pwshpayload.evtx
--- a/sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx
+++ b/sample-evtx/DeepBlueCLI/mimikatz-privesc-hashdump.evtx
--- a/sample-evtx/DeepBlueCLI/mimikatz-privilegedebug-tokenelevate-hashdump.evtx
+++ b/sample-evtx/DeepBlueCLI/mimikatz-privilegedebug-tokenelevate-hashdump.evtx
--- a/sample-evtx/DeepBlueCLI/new-user-security.evtx
+++ b/sample-evtx/DeepBlueCLI/new-user-security.evtx
--- a/sample-evtx/DeepBlueCLI/password-spray.evtx
+++ b/sample-evtx/DeepBlueCLI/password-spray.evtx
--- a/sample-evtx/DeepBlueCLI/powersploit-security.evtx
+++ b/sample-evtx/DeepBlueCLI/powersploit-security.evtx
--- a/sample-evtx/DeepBlueCLI/powersploit-system.evtx
+++ b/sample-evtx/DeepBlueCLI/powersploit-system.evtx
--- a/sample-evtx/DeepBlueCLI/psattack-security.evtx
+++ b/sample-evtx/DeepBlueCLI/psattack-security.evtx
--- a/sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx
+++ b/sample-evtx/DeepBlueCLI/smb-password-guessing-security.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/DE_timestomp_and_dll_sideloading_and_RunPersist.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_cmd_schtask.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/rundll32_hollowing_wermgr_masquerading.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_injection_persistence_run_key.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/Malware/sideloading_uacbypass_rundll32_injection_c2.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/PanacheSysmon_vs_AtomicRedTeam01.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/WinDefender_Events_1117_1116_AtomicRedTeam.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/AutomatedTestingTools/panache_sysmon_vs_EDRTestingScript.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Command
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Command
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Command
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Command
--- a/Control/DE_RDP_Tunneling_TerminalServices-RemoteConnectionManagerOperational_1149.evtx
+++ b/Control/DE_RDP_Tunneling_TerminalServices-RemoteConnectionManagerOperational_1149.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Command
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Command
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Command
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Command
--- a/Control/tunna_iis_rdp_smb_tunneling_sysmon_3.evtx
+++ b/Control/tunna_iis_rdp_smb_tunneling_sysmon_3.evtx
--- a/Access/4794_DSRM_password_change_t1098.evtx
+++ b/Access/4794_DSRM_password_change_t1098.evtx
--- a/Access/ACL_ForcePwd_SPNAdd_User_Computer_Accounts.evtx
+++ b/Access/ACL_ForcePwd_SPNAdd_User_Computer_Accounts.evtx
--- a/Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx
+++ b/Access/CA_4624_4625_LogonType2_LogonProc_chrome.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/CA_Mimikatz_Memssp_Default_Logs_Sysmon_11.evtx
+++ b/Access/CA_Mimikatz_Memssp_Default_Logs_Sysmon_11.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/CA_hashdump_4663_4656_lsass_access.evtx
+++ b/Access/CA_hashdump_4663_4656_lsass_access.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx
+++ b/Access/CA_keepass_KeeThief_Get-KeePassDatabaseKey.evtx
--- a/Access/CA_protectedstorage_5145_rpc_masterkey.evtx
+++ b/Access/CA_protectedstorage_5145_rpc_masterkey.evtx
--- a/Access/CA_sysmon_hashdump_cmd_meterpreter.evtx
+++ b/Access/CA_sysmon_hashdump_cmd_meterpreter.evtx
--- a/Access/CA_teamviewer-dumper_sysmon_10.evtx
+++ b/Access/CA_teamviewer-dumper_sysmon_10.evtx
--- a/Access/LsassSilentProcessExit_process_exit_monitor_3001_lsass.evtx
+++ b/Access/LsassSilentProcessExit_process_exit_monitor_3001_lsass.evtx
--- a/Access/MSSQL_multiple_failed_logon_EventID_18456.evtx
+++ b/Access/MSSQL_multiple_failed_logon_EventID_18456.evtx
--- a/Access/Powershell_4104_MiniDumpWriteDump_Lsass.evtx
+++ b/Access/Powershell_4104_MiniDumpWriteDump_Lsass.evtx
--- a/Access/Sysmon13_MachineAccount_Password_Hash_Changed_via_LsarSetSecret.evtx
+++ b/Access/Sysmon13_MachineAccount_Password_Hash_Changed_via_LsarSetSecret.evtx
--- a/Access/Sysmon_13_Local_Admin_Password_Changed.evtx
+++ b/Access/Sysmon_13_Local_Admin_Password_Changed.evtx
--- a/Access/Zerologon_CVE-2020-1472_DFIR_System_NetLogon_Error_EventID_5805.evtx
+++ b/Access/Zerologon_CVE-2020-1472_DFIR_System_NetLogon_Error_EventID_5805.evtx
--- a/Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx
+++ b/Access/Zerologon_VoidSec_CVE-2020-1472_4626_LT3_Anonym_follwedby_4742_DC_Anony_DC.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/dc_applog_ntdsutil_dfir_325_326_327.evtx
+++ b/Access/dc_applog_ntdsutil_dfir_325_326_327.evtx
--- a/Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx
+++ b/Access/discovery_sysmon_1_iis_pwd_and_config_discovery_appcmd.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/phish_windows_credentials_powershell_scriptblockLog_4104.evtx
+++ b/Access/phish_windows_credentials_powershell_scriptblockLog_4104.evtx
--- a/Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx
+++ b/Access/ppl_bypass_ppldump_knowdll_hijack_sysmon_security.evtx
--- a/Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx
+++ b/Access/remote_pwd_reset_rpc_mimikatz_postzerologon_target_DC.evtx
--- a/Access/sysmon17_18_kekeo_tsssp_default_np.evtx
+++ b/Access/sysmon17_18_kekeo_tsssp_default_np.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx
+++ b/Access/sysmon_10_11_outlfank_dumpert_and_andrewspecial_memdump.evtx
--- a/Access/sysmon_10_1_memdump_comsvcs_minidump.evtx
+++ b/Access/sysmon_10_1_memdump_comsvcs_minidump.evtx
--- a/Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx
+++ b/Access/sysmon_10_lsass_mimikatz_sekurlsa_logonpasswords.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx
+++ b/Access/sysmon_2x10_lsass_with_different_pid_RtlCreateProcessReflection.evtx
--- a/Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx
+++ b/Access/sysmon_3_10_Invoke-Mimikatz_hosted_Github.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Credential
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Defense
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Defense
--- a/Evasion/DE_1102_security_log_cleared.evtx
+++ b/Evasion/DE_1102_security_log_cleared.evtx
--- a/Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx
+++ b/Evasion/DE_BYOV_Zam64_CA_Memdump_sysmon_7_10.evtx
--- a/Evasion/DE_EventLog_Service_Crashed.evtx
+++ b/Evasion/DE_EventLog_Service_Crashed.evtx
--- a/Evasion/DE_Fake_ComputerAccount_4720.evtx
+++ b/Evasion/DE_Fake_ComputerAccount_4720.evtx
--- a/Evasion/DE_KernelDebug_and_TestSigning_ON_Security_4826.evtx
+++ b/Evasion/DE_KernelDebug_and_TestSigning_ON_Security_4826.evtx
--- a/Evasion/DE_Powershell_CLM_Disabled_Sysmon_12.evtx
+++ b/Evasion/DE_Powershell_CLM_Disabled_Sysmon_12.evtx
--- a/Evasion/DE_ProcessHerpaderping_Sysmon_11_10_1_7.evtx
+++ b/Evasion/DE_ProcessHerpaderping_Sysmon_11_10_1_7.evtx
--- a/Evasion/DE_UAC_Disabled_Sysmon_12_13.evtx
+++ b/Evasion/DE_UAC_Disabled_Sysmon_12_13.evtx
--- a/Evasion/DE_WinEventLogSvc_Crash_System_7036.evtx
+++ b/Evasion/DE_WinEventLogSvc_Crash_System_7036.evtx
--- a/Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx
+++ b/Evasion/DE_remote_eventlog_svc_crash_byt3bl33d3r_sysmon_17_1_3.evtx
--- a/Evasion/DE_renamed_psexec_service_sysmon_17_18.evtx
+++ b/Evasion/DE_renamed_psexec_service_sysmon_17_18.evtx
--- a/Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx
+++ b/Evasion/DE_suspicious_remote_eventlog_svc_access_5145.evtx
--- a/Evasion/DE_xp_cmdshell_enabled_MSSQL_EID_15457.evtx
+++ b/Evasion/DE_xp_cmdshell_enabled_MSSQL_EID_15457.evtx
--- a/Evasion/DSE_bypass_BYOV_TDL_dummydriver_sysmon_6_7_13.evtx
+++ b/Evasion/DSE_bypass_BYOV_TDL_dummydriver_sysmon_6_7_13.evtx
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Defense
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Defense
--- a/sample-evtx/EVTX-ATTACK-SAMPLES/Defense
+++ b/sample-evtx/EVTX-ATTACK-SAMPLES/Defense
--- a/Evasion/Sysmon_10_Evasion_Suspicious_NtOpenProcess_CallTrace.evtx
+++ b/Evasion/Sysmon_10_Evasion_Suspicious_NtOpenProcess_CallTrace.evtx
--- a/Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx
+++ b/Evasion/Sysmon_12_DE_AntiForensics_MRU_DeleteKey.evtx
--- a/Evasion/Win_4985_T1186_Process_Doppelganging.evtx
+++ b/Evasion/Win_4985_T1186_Process_Doppelganging.evtx
--- a/Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx
+++ b/Evasion/apt10_jjs_sideloading_prochollowing_persist_as_service_sysmon_1_7_8_13.evtx
--- a/Evasion/de_PsScriptBlockLogging_disabled_sysmon12_13.evtx
+++ b/Evasion/de_PsScriptBlockLogging_disabled_sysmon12_13.evtx
--- a/Evasion/de_hiding_files_via_attrib_cmdlet.evtx
+++ b/Evasion/de_hiding_files_via_attrib_cmdlet.evtx
--- a/Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx
+++ b/Evasion/de_portforward_netsh_rdp_sysmon_13_1.evtx
--- a/Evasion/de_powershell_execpolicy_changed_sysmon_13.evtx
+++ b/Evasion/de_powershell_execpolicy_changed_sysmon_13.evtx
--- a/Evasion/de_sysmon_13_VBA_Security_AccessVBOM.evtx
+++ b/Evasion/de_sysmon_13_VBA_Security_AccessVBOM.evtx
--- a/Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx
+++ b/Evasion/de_unmanagedpowershell_psinject_sysmon_7_8_10.evtx
--- a/Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx
+++ b/Evasion/evasion_codeinj_odzhan_conhost_sysmon_10_1.evtx
--- a/Show More
+++ b/Show More