From 7522e57a026a53a457b91017acd1ce1f71d88478 Mon Sep 17 00:00:00 2001 From: terrancedejesus Date: Wed, 15 Nov 2023 13:25:44 -0500 Subject: [PATCH 1/2] Update URLs in branch 8.5 --- ...rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...0-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc | 2 +- ...1-1-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...ebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc | 2 +- ...-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...3-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...ebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc | 2 +- ...3-3-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc | 2 +- ...ebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc | 2 +- ...4-1-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...ebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc | 2 +- ...4-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc | 2 +- ...4-3-account-configured-with-never-expiring-password.asciidoc | 2 +- ...5-1-account-configured-with-never-expiring-password.asciidoc | 2 +- ...5-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc | 2 +- ...5-4-account-configured-with-never-expiring-password.asciidoc | 2 +- ...5-7-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc | 2 +- .../account-configured-with-never-expiring-password.asciidoc | 2 +- .../creation-of-a-hidden-local-user-account.asciidoc | 2 +- .../rule-details/remote-execution-via-file-shares.asciidoc | 2 +- .../rule-details/remote-file-copy-via-teamviewer.asciidoc | 2 +- .../suspicious-managed-code-hosting-process.asciidoc | 2 +- .../rule-details/suspicious-werfault-child-process.asciidoc | 2 +- 58 files changed, 58 insertions(+), 58 deletions(-) diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc index 020e566575..23ad9275e7 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc index 2d5ce573d1..8eba27e783 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc index 18a07bda0f..63b02a8c5b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc index f57d60146e..3c41f484e3 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc index 4c0e2a95f0..3108114345 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc index 2c7f451f37..aab56f6547 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc index cafdf8ee54..5a0fc7d53f 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc index 8b2ae547d7..ebf6732c3e 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc index 735a3d6056..04aaddd2be 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc index 418ce5d49a..d15126cd1f 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc index 9e7b24a737..b97d32bf56 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc index 4b64a71f5c..59c0b88c68 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc index 4a6acb4b56..f329480726 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc index 916be015e2..36cfc85554 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc index ccd6219e99..5e65f1f702 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc index bf71f1fb34..a9185f6a1a 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc index 526626dc6d..c666dfc325 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc index 7d84d9a207..3787ced05f 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc index 24490e0cd8..25ec4e9641 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc index ab30a39451..420cc43832 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc index e5dc48ac73..eb26470576 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc index 9994e73d88..fe31eb9cee 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc index f27587b921..9ac7afd4c2 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc index 8413189e5a..d7f29dc3f4 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc index 28c3711c80..826f2a81a9 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc @@ -26,7 +26,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc index 29b1e8f814..e90bbc8a37 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc index 649af873df..d8f1161be7 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc index 600e416248..98060d9f9c 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc index 93d6a4b3d3..165cdbc9c4 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc index 21ff4a4120..c42a8d1f0b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc index c41325134c..a0c06ff3b6 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc @@ -26,7 +26,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc index acc6c8bca7..25bcd317b2 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc index 6190982447..a59908829f 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc index ddc1396d4a..bf3ba288be 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc index 07cc453c1b..0c75b00672 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc index 742c6b958d..d60777ba34 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc index 7e8a6c0dcd..f882976a06 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc index 779d25914d..a151c1eb42 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc index 0f2f3edf73..967eb9f65e 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc index a50ed91217..2d26d3d634 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc index b8d5bbd93e..0f33d28884 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc @@ -24,7 +24,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc index 0206c1a5b0..10be9e590d 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc @@ -24,7 +24,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc index 5c7cf89058..721c888548 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc index e1f6a0a6ca..2adb0abfad 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc index eec3b76930..f366bf56fd 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc index b784f0acc8..868ed895ca 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc index 3a1a144920..30ebad9689 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc index d4064345bb..8f27932671 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc @@ -24,7 +24,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc index efd286667f..6e952fa6d3 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc @@ -24,7 +24,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc index 35efd597f0..1c92bed445 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc index 5e91483a4f..bb58cd6ee2 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc index 685c3d3548..72bdf18445 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc index c930da9403..591cb39b03 100644 --- a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc index a42804a8dc..7b0e44d725 100644 --- a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc index d23de6dbb6..8c1f30b148 100644 --- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc index a4500db454..15a815dc2d 100644 --- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc index ec730f3fd6..15f85aae60 100644 --- a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc index 1de25792d4..858d752e31 100644 --- a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* https://blog.menasec.net/2021/01/ +* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: From 09089720151e8c8b58627eae82618f3ca14171a4 Mon Sep 17 00:00:00 2001 From: terrancedejesus Date: Wed, 15 Nov 2023 15:07:48 -0500 Subject: [PATCH 2/2] Update HTTP links to HTTPS in fix-old-links-in-security-rules-8-5 --- ...rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...0-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc | 2 +- ...1-1-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...ebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc | 2 +- ...-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...3-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...ebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc | 2 +- ...3-3-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc | 2 +- ...ebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc | 2 +- ...4-1-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...ebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc | 2 +- ...4-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc | 2 +- ...4-3-account-configured-with-never-expiring-password.asciidoc | 2 +- ...5-1-account-configured-with-never-expiring-password.asciidoc | 2 +- ...5-2-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc | 2 +- ...5-4-account-configured-with-never-expiring-password.asciidoc | 2 +- ...5-7-account-configured-with-never-expiring-password.asciidoc | 2 +- ...-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc | 2 +- ...rebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc | 2 +- ...prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc | 2 +- ...-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc | 2 +- ...ebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc | 2 +- .../account-configured-with-never-expiring-password.asciidoc | 2 +- .../creation-of-a-hidden-local-user-account.asciidoc | 2 +- .../rule-details/remote-execution-via-file-shares.asciidoc | 2 +- .../rule-details/remote-file-copy-via-teamviewer.asciidoc | 2 +- .../suspicious-managed-code-hosting-process.asciidoc | 2 +- .../rule-details/suspicious-werfault-child-process.asciidoc | 2 +- 58 files changed, 58 insertions(+), 58 deletions(-) diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc index 23ad9275e7..09239daf23 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc index 8eba27e783..429a555d18 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/0-14-2/prebuilt-rule-0-14-2-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc index 63b02a8c5b..2c4fed828e 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc index 3c41f484e3..c2fca7cb6c 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc index 3108114345..97d5e5a6a3 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc index aab56f6547..cc3b23750c 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc index 5a0fc7d53f..ef2a86868e 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/1-0-2/prebuilt-rule-1-0-2-suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc index ebf6732c3e..544388b78b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc index 04aaddd2be..acff2fd7fe 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc index d15126cd1f..71c9ed2f01 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-1-1/prebuilt-rule-8-1-1-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc index b97d32bf56..a5005d6c76 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc index 59c0b88c68..263baa9d18 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc index f329480726..71bba5baca 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-2-1/prebuilt-rule-8-2-1-suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc index 36cfc85554..e27bdc3320 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-1/prebuilt-rule-8-3-1-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc index 5e65f1f702..873b4fd1c1 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc index a9185f6a1a..bd57c65178 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc index c666dfc325..5d6499590e 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc index 3787ced05f..d3697645ae 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc index 25ec4e9641..79495d568b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-2/prebuilt-rule-8-3-2-suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc index 420cc43832..03422e5e84 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc index eb26470576..e7eab885f7 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc index fe31eb9cee..70cccf11b1 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc index 9ac7afd4c2..ba635e11f9 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc index d7f29dc3f4..b5817ff572 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc index 826f2a81a9..937a0d26be 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-3/prebuilt-rule-8-3-3-suspicious-werfault-child-process.asciidoc @@ -26,7 +26,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc index e90bbc8a37..fa4c550613 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-3-4/prebuilt-rule-8-3-4-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc index d8f1161be7..60e8279b34 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc index 98060d9f9c..b63d450720 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc index 165cdbc9c4..ef2efae144 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc index c42a8d1f0b..73cc1ab0f3 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc index a0c06ff3b6..af338028f8 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-1/prebuilt-rule-8-4-1-suspicious-werfault-child-process.asciidoc @@ -26,7 +26,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc index 25bcd317b2..1b3796edf5 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc index a59908829f..d609345404 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc index bf3ba288be..fd48ac7329 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc index 0c75b00672..85459c2fd4 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc index d60777ba34..4f080cea8f 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc index f882976a06..c620433624 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-2/prebuilt-rule-8-4-2-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc index a151c1eb42..2ae3858a24 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-4-3/prebuilt-rule-8-4-3-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc index 967eb9f65e..80521b9500 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-1/prebuilt-rule-8-5-1-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc index 2d26d3d634..8223bf343b 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc index 0f33d28884..e28e170cf0 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-creation-of-a-hidden-local-user-account.asciidoc @@ -24,7 +24,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc index 10be9e590d..263f7e19a6 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-execution-via-file-shares.asciidoc @@ -24,7 +24,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc index 721c888548..a80271f96c 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc index 2adb0abfad..05dd51e198 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc index f366bf56fd..29dd126739 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-2/prebuilt-rule-8-5-2-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc index 868ed895ca..55364908ae 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-4/prebuilt-rule-8-5-4-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc index 30ebad9689..174e5bacb1 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-account-configured-with-never-expiring-password.asciidoc @@ -24,7 +24,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc index 8f27932671..c332739dbe 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-creation-of-a-hidden-local-user-account.asciidoc @@ -24,7 +24,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc index 6e952fa6d3..ded35c9be3 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-execution-via-file-shares.asciidoc @@ -24,7 +24,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc index 1c92bed445..95aca56fd3 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-remote-file-copy-via-teamviewer.asciidoc @@ -24,7 +24,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc index bb58cd6ee2..2a32625d89 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc index 72bdf18445..4393a8b48c 100644 --- a/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/downloadable-packages/8-5-7/prebuilt-rule-8-5-7-suspicious-werfault-child-process.asciidoc @@ -27,7 +27,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://www.hexacorn.com/blog/2019/09/20/werfault-command-line-switches-v0-1/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc index 591cb39b03..7f1eb705c4 100644 --- a/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/account-configured-with-never-expiring-password.asciidoc @@ -23,7 +23,7 @@ Detects the creation and modification of an account with the "Don't Expire Passw *References*: * https://www.cert.ssi.gouv.fr/uploads/guide-ad.html#dont_expire -* http://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html +* https://web.archive.org/web/20230329171952/https://blog.menasec.net/2019/02/threat-hunting-26-persistent-password.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc index 7b0e44d725..ff060cc5b5 100644 --- a/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/creation-of-a-hidden-local-user-account.asciidoc @@ -23,7 +23,7 @@ Identifies the creation of a hidden local user account by appending the dollar s *References*: -* http://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html +* https://web.archive.org/web/20230329153858/https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights_8.html * https://github.com/CyberMonitor/APT_CyberCriminal_Campagin_Collections/tree/master/2020/2020.12.15.Lazarus_Campaign *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc index 8c1f30b148..3b2def5ec6 100644 --- a/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/remote-execution-via-file-shares.asciidoc @@ -23,7 +23,7 @@ Identifies the execution of a file that was created by the virtual system proces *References*: -* http://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html +* https://web.archive.org/web/20230329172636/https://blog.menasec.net/2020/08/new-trick-to-detect-lateral-movement.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc index 15a815dc2d..7b3a69cb41 100644 --- a/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/remote-file-copy-via-teamviewer.asciidoc @@ -23,7 +23,7 @@ Identifies an executable or script file remotely downloaded via a TeamViewer tra *References*: -* http://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html +* https://web.archive.org/web/20230329160957/https://blog.menasec.net/2019/11/hunting-for-suspicious-use-of.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc index 15f85aae60..2bf1088ef3 100644 --- a/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/suspicious-managed-code-hosting-process.asciidoc @@ -23,7 +23,7 @@ Identifies a suspicious managed code hosting process which could indicate code i *References*: -* http://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html +* https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html *Tags*: diff --git a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc index 858d752e31..7fca1f224c 100644 --- a/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc +++ b/docs/detections/prebuilt-rules/rule-details/suspicious-werfault-child-process.asciidoc @@ -25,7 +25,7 @@ A suspicious WerFault child process was detected, which may indicate an attempt * https://www.hexacorn.com/blog/2019/09/19/silentprocessexit-quick-look-under-the-hood/ * https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES/blob/master/Persistence/persistence_SilentProcessExit_ImageHijack_sysmon_13_1.evtx -* http://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ +* https://web.archive.org/web/20230530011556/https://blog.menasec.net/2021/01/ *Tags*: