/
_toc.yml
executable file
·200 lines (200 loc) · 11.7 KB
/
_toc.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
format: jb-book
root: introduction
parts:
- caption: How-To
chapters:
- file: create/intro
sections:
- file: create/windows
- file: create/azureloganalyticsapi
- file: create/m365defenderhuntapi
- file: create/kafka
- file: consume/intro
sections:
- file: consume/jupyter-notebooks
- file: consume/suricata
- file: consume/kafka
- file: consume/helk
- caption: Atomic Datasets
chapters:
- file: notebooks/atomic/aws/intro
sections:
- file: notebooks/atomic/aws/initial_access/intro
sections:
- file: notebooks/atomic/aws/initial_access/SDAWS-200914011940
- file: notebooks/atomic/aws/persistence/intro
sections:
- file: notebooks/atomic/aws/persistence/SDAWS-200914011940
- file: notebooks/atomic/aws/privilege_escalation/intro
sections:
- file: notebooks/atomic/aws/privilege_escalation/SDAWS-200914011940
- file: notebooks/atomic/aws/defense_evasion/intro
sections:
- file: notebooks/atomic/aws/defense_evasion/SDAWS-200914011940
- file: notebooks/atomic/aws/collection/intro
sections:
- file: notebooks/atomic/aws/collection/SDAWS-200914011940
- file: notebooks/atomic/aws/discovery/intro
sections:
- file: notebooks/atomic/aws/discovery/SDAWS-2202181000
- file: notebooks/atomic/linux/intro
sections:
- file: notebooks/atomic/linux/discovery/intro
sections:
- file: notebooks/atomic/linux/discovery/SDLIN-201110074812
- file: notebooks/atomic/linux/defense_evasion/intro
sections:
- file: notebooks/atomic/linux/defense_evasion/SDLIN-201110081941
- file: notebooks/atomic/windows/intro
sections:
- file: notebooks/atomic/windows/defense_evasion/intro
sections:
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190301125905
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190319131123
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190403133337
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190518200432
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190518201922
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190518203650
- file: notebooks/atomic/windows/defense_evasion/SDWIN-190518221344
- file: notebooks/atomic/windows/defense_evasion/SDWIN-191027223020
- file: notebooks/atomic/windows/defense_evasion/SDWIN-191225045202
- file: notebooks/atomic/windows/defense_evasion/SDWIN-200721232741
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201012183248
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201017061100
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201019232515
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201021001911
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201022002145
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201022013121
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201022015432
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201022022144
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201022025808
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201022035214
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201023020513
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201023023651
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201023031210
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201026235835
- file: notebooks/atomic/windows/defense_evasion/SDWIN-201028191914
- file: notebooks/atomic/windows/defense_evasion/SDWIN-210611210814
- file: notebooks/atomic/windows/defense_evasion/SDWIN-220630130349
- file: notebooks/atomic/windows/defense_evasion/SDWIN-220703123711
- file: notebooks/atomic/windows/defense_evasion/SDWIN-220705170038
- file: notebooks/atomic/windows/defense_evasion/SDWIN-220708104215
- file: notebooks/atomic/windows/defense_evasion/SDWIN-220708104300
- file: notebooks/atomic/windows/defense_evasion/SDWIN-220803205800
- file: notebooks/atomic/windows/credential_access/intro
sections:
- file: notebooks/atomic/windows/credential_access/SDWIN-190301174830
- file: notebooks/atomic/windows/credential_access/SDWIN-190319145126
- file: notebooks/atomic/windows/credential_access/SDWIN-190518202151
- file: notebooks/atomic/windows/credential_access/SDWIN-190518230752
- file: notebooks/atomic/windows/credential_access/SDWIN-190518235535
- file: notebooks/atomic/windows/credential_access/SDWIN-190625103712
- file: notebooks/atomic/windows/credential_access/SDWIN-190625133822
- file: notebooks/atomic/windows/credential_access/SDWIN-191027055035
- file: notebooks/atomic/windows/credential_access/SDWIN-200805020926
- file: notebooks/atomic/windows/credential_access/SDWIN-200807103913
- file: notebooks/atomic/windows/credential_access/SDWIN-200921230246
- file: notebooks/atomic/windows/credential_access/SDWIN-200922042230
- file: notebooks/atomic/windows/credential_access/SDWIN-201018195009
- file: notebooks/atomic/windows/credential_access/SDWIN-201018225619
- file: notebooks/atomic/windows/credential_access/SDWIN-201019002900
- file: notebooks/atomic/windows/credential_access/SDWIN-201019033054
- file: notebooks/atomic/windows/credential_access/SDWIN-201020013208
- file: notebooks/atomic/windows/credential_access/SDWIN-201022042947
- file: notebooks/atomic/windows/discovery/intro
sections:
- file: notebooks/atomic/windows/discovery/SDWIN-190319020147
- file: notebooks/atomic/windows/discovery/SDWIN-190319020729
- file: notebooks/atomic/windows/discovery/SDWIN-190319021158
- file: notebooks/atomic/windows/discovery/SDWIN-190518201207
- file: notebooks/atomic/windows/discovery/SDWIN-190518224039
- file: notebooks/atomic/windows/discovery/SDWIN-190519005224
- file: notebooks/atomic/windows/discovery/SDWIN-200806130039
- file: notebooks/atomic/windows/discovery/SDWIN-201021232814
- file: notebooks/atomic/windows/discovery/SDWIN-201022042947
- file: notebooks/atomic/windows/discovery/SDWIN-201102163918
- file: notebooks/atomic/windows/persistence/intro
sections:
- file: notebooks/atomic/windows/persistence/SDWIN-190319023812
- file: notebooks/atomic/windows/persistence/SDWIN-190319024742
- file: notebooks/atomic/windows/persistence/SDWIN-190403133337
- file: notebooks/atomic/windows/persistence/SDWIN-190518184306
- file: notebooks/atomic/windows/persistence/SDWIN-200722001847
- file: notebooks/atomic/windows/persistence/SDWIN-200921175806
- file: notebooks/atomic/windows/persistence/SDWIN-201019224718
- file: notebooks/atomic/windows/persistence/SDWIN-201021204544
- file: notebooks/atomic/windows/persistence/SDWIN-201023023651
- file: notebooks/atomic/windows/persistence/SDWIN-201219070027
- file: notebooks/atomic/windows/persistence/SDWIN-201219075059
- file: notebooks/atomic/windows/persistence/SDWIN-210314014019
- file: notebooks/atomic/windows/lateral_movement/intro
sections:
- file: notebooks/atomic/windows/lateral_movement/SDWIN-190319131123
- file: notebooks/atomic/windows/lateral_movement/SDWIN-190518210125
- file: notebooks/atomic/windows/lateral_movement/SDWIN-190518210652
- file: notebooks/atomic/windows/lateral_movement/SDWIN-190518211052
- file: notebooks/atomic/windows/lateral_movement/SDWIN-190518211456
- file: notebooks/atomic/windows/lateral_movement/SDWIN-190518213907
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200724174200
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200805034820
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806012009
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806015757
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806022635
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806030120
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806031938
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806035621
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200806115603
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200914080546
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200916232559
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200917174542
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200918145959
- file: notebooks/atomic/windows/lateral_movement/SDWIN-200921001437
- file: notebooks/atomic/windows/lateral_movement/SDWIN-201009173318
- file: notebooks/atomic/windows/lateral_movement/SDWIN-201009183000
- file: notebooks/atomic/windows/lateral_movement/SDWIN-201022042947
- file: notebooks/atomic/windows/lateral_movement/SDWIN-201219070027
- file: notebooks/atomic/windows/lateral_movement/SDWIN-201219075059
- file: notebooks/atomic/windows/lateral_movement/SDWIN-210427020247
- file: notebooks/atomic/windows/privilege_escalation/intro
sections:
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-190403133337
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-190518184306
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-190518200432
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-190518221344
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-200904032946
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201019232515
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201021204544
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201023031210
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201026235835
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201028191914
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201219070027
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-201219075059
- file: notebooks/atomic/windows/privilege_escalation/SDWIN-210611210814
- file: notebooks/atomic/windows/execution/intro
sections:
- file: notebooks/atomic/windows/execution/SDWIN-190518182022
- file: notebooks/atomic/windows/execution/SDWIN-190518210652
- file: notebooks/atomic/windows/execution/SDWIN-190518211052
- file: notebooks/atomic/windows/execution/SDWIN-190518211456
- file: notebooks/atomic/windows/execution/SDWIN-190518213907
- file: notebooks/atomic/windows/execution/SDWIN-191027223020
- file: notebooks/atomic/windows/execution/SDWIN-200724174200
- file: notebooks/atomic/windows/execution/SDWIN-200806035621
- file: notebooks/atomic/windows/execution/SDWIN-200806115603
- file: notebooks/atomic/windows/execution/SDWIN-200914080546
- file: notebooks/atomic/windows/execution/SDWIN-200921001437
- file: notebooks/atomic/windows/execution/SDWIN-201009173318
- file: notebooks/atomic/windows/execution/SDWIN-201029001615
- file: notebooks/atomic/windows/execution/SDWIN-201029202324
- file: notebooks/atomic/windows/execution/SDWIN-201102041306
- file: notebooks/atomic/windows/execution/SDWIN-201219070027
- file: notebooks/atomic/windows/execution/SDWIN-201219075059
- file: notebooks/atomic/windows/execution/SDWIN-210314014019
- file: notebooks/atomic/windows/collection/intro
sections:
- file: notebooks/atomic/windows/collection/SDWIN-200609225055
- file: notebooks/atomic/windows/collection/SDWIN-201020013208
- caption: Compound Datasets
chapters:
- file: notebooks/compound/GoldenSAMLADFSMailAccess
- file: notebooks/compound/Log4Shell