2024 indexes

SecurityRiskAdvisors · Jan 8, 2024 · b6a14ab · b6a14ab
1 parent 88cb9e6
commit b6a14ab
Show file tree

Hide file tree

Showing 408 changed files with 23,447 additions and 32 deletions.
diff --git a/README.md b/README.md
@@ -8,13 +8,14 @@ One of the goals of each Threat Simulation Index is to allow organizations to co
 
 Indexes are released once per year. Throughout the year, an Index may receive minor quality of life changes but will not deviate significantly from the initial release. New yearly releases start fresh and are not designed to be compatible with previous releases. Overlap between Indexes in the same industry for different years is incidental, as is overlap across industries.
 
-## 2023 Indexes
+## 2024 Indexes
 
-The following Indexes are available for 2023:
+The following Indexes are available for 2024:
 
-- [Financial Services](fs-index-2023/)
-- [Retail & Hospitality](rh-index-2023/)
-- [Health](h-index-2023/)
+- [Financial Services](fs-index-2024/)
+- [Retail & Hospitality](rh-index-2024/)
+- [Health](h-index-2024/)
+- [OT](ot-index-2024/)
 
 ### Composition
 
@@ -25,32 +26,44 @@ Expand the below section to view Index group compositions
 
 **Financial Services**
 
-- [APT28](https://attack.mitre.org/groups/G0007/)
-- [APT29](https://attack.mitre.org/groups/G0016/)
+- [Scattered Spider](https://attack.mitre.org/groups/G1015/)
+- LockBit
+- [ALPHV](https://attack.mitre.org/software/S1068/)
+- [Clop](https://attack.mitre.org/software/S0611)
+- [Lazarus](https://attack.mitre.org/groups/G0032/)
 - [APT41](https://attack.mitre.org/groups/G0096/)
-- [Bazar](https://attack.mitre.org/software/S0534/)
-- [Bumblebee](https://attack.mitre.org/software/S1039/) (& Quantum)
-- [LAPSUS$](https://attack.mitre.org/groups/G1004/)
-- [QakBot](https://attack.mitre.org/software/S0650/)
+- SocGholish
+
 
 **Retail & Hospitality**
 
-- [APT41](https://attack.mitre.org/groups/G0096/)
-- [Conti](https://attack.mitre.org/software/S0575/)
-- [Bumblebee](https://attack.mitre.org/software/S1039/) (& Quantum)
-- [FIN7](https://attack.mitre.org/groups/G0046/)
-- [LAPSUS$](https://attack.mitre.org/groups/G1004/)
-- [QakBot](https://attack.mitre.org/software/S0650/)
+- BianLian
+- [Scattered Spider](https://attack.mitre.org/groups/G1015/)
+- LockBit
+- [ALPHV](https://attack.mitre.org/software/S1068/)
+- [Clop](https://attack.mitre.org/software/S0611)
 
 **Health**
 
+- [Scattered Spider](https://attack.mitre.org/groups/G1015/)
+- LockBit
+- [ALPHV](https://attack.mitre.org/software/S1068/)
+- [Clop](https://attack.mitre.org/software/S0611)
 - [APT41](https://attack.mitre.org/groups/G0096/)
-- [Bazar](https://attack.mitre.org/software/S0534/)
-- [BlackTech](https://attack.mitre.org/groups/G0098/)
-- [Bumblebee](https://attack.mitre.org/software/S1039/) (& Quantum)
-- [Conti](https://attack.mitre.org/software/S0575/)
-- [Kimsuky](https://attack.mitre.org/groups/G0094/)
-- [QakBot](https://attack.mitre.org/software/S0650/)
+- SocGholish
+- [Mustang Panda](https://attack.mitre.org/groups/G0129/)
+- Dark Angels
+- BianLian
+
+**OT**
+
+- [Scattered Spider](https://attack.mitre.org/groups/G1015/)
+- LockBit
+- [ALPHV](https://attack.mitre.org/software/S1068/)
+- [Lazarus](https://attack.mitre.org/groups/G0032/)
+- [Mustang Panda](https://attack.mitre.org/groups/G0129/)
+- Dark Angels
+- [Sandworm](https://attack.mitre.org/groups/G0034)
 
 </details>
 
@@ -72,13 +85,12 @@ Indexes can be imported directly into [VECTR](https://vectr.io) using the merged
 
 Test cases are based on MITRE-tracked intelligence and the general process for determining test cases for inclusion is as follows:
 
-1. Identify initial list of groups with principal members
-2. Map groups to MITRE-tracked groups and filter out non-MITRE groups
-3. Review intelligence report for each group
-    1. Remove anything produced before the look-back period of two years
+1. Identify initial list of groups and TTPs with principal members
+2. Collect then review intelligence report for each group
+    1. Remove anything produced before the look-back period of one year
     2. Remove reports that do not provide enough information for simulation purposes
     3. Cut groups lacking intelligence
-4. Extract TTP information from intelligence reports then develop full test cases for each
+3. Extract TTP information from intelligence reports then develop full test cases for each
     1. Exclude TTPs that likely do not act as worthwhile simulation candidates
-5. Filter out items from list to balance plan composition
+4. Filter out items from list to balance plan composition
 
diff --git a/archived/2023/README.md b/archived/2023/README.md
@@ -0,0 +1,84 @@
+# Threat Simulation Indexes
+
+Each Threat Simulation Index is a curated list of test cases derived from the threat groups of interest for members of a given industry using MITRE-tracked intelligence. Security Risk Advisors (SRA) collaborates with experts in threat intelligence and cyber defense at targeted organizations to identify priorities for defense testing.  
+
+One of the goals of each Threat Simulation Index is to allow organizations to compare objective defense scores against peers. Visit the [Defense Success Metric blog post on SRA.io](https://sra.io/blog/the-road-to-benchmarked-mitre-attck-alignment-defense-success-metrics/) for more information.
+
+### Release Cycle
+
+Indexes are released once per year. Throughout the year, an Index may receive minor quality of life changes but will not deviate significantly from the initial release. New yearly releases start fresh and are not designed to be compatible with previous releases. Overlap between Indexes in the same industry for different years is incidental, as is overlap across industries.
+
+## 2023 Indexes
+
+The following Indexes are available for 2023:
+
+- [Financial Services](fs-index-2023/)
+- [Retail & Hospitality](rh-index-2023/)
+- [Health](h-index-2023/)
+
+### Composition
+
+Expand the below section to view Index group compositions
+
+<details>
+  <summary>Expand</summary>
+
+**Financial Services**
+
+- [APT28](https://attack.mitre.org/groups/G0007/)
+- [APT29](https://attack.mitre.org/groups/G0016/)
+- [APT41](https://attack.mitre.org/groups/G0096/)
+- [Bazar](https://attack.mitre.org/software/S0534/)
+- [Bumblebee](https://attack.mitre.org/software/S1039/) (& Quantum)
+- [LAPSUS$](https://attack.mitre.org/groups/G1004/)
+- [QakBot](https://attack.mitre.org/software/S0650/)
+
+**Retail & Hospitality**
+
+- [APT41](https://attack.mitre.org/groups/G0096/)
+- [Conti](https://attack.mitre.org/software/S0575/)
+- [Bumblebee](https://attack.mitre.org/software/S1039/) (& Quantum)
+- [FIN7](https://attack.mitre.org/groups/G0046/)
+- [LAPSUS$](https://attack.mitre.org/groups/G1004/)
+- [QakBot](https://attack.mitre.org/software/S0650/)
+
+**Health**
+
+- [APT41](https://attack.mitre.org/groups/G0096/)
+- [Bazar](https://attack.mitre.org/software/S0534/)
+- [BlackTech](https://attack.mitre.org/groups/G0098/)
+- [Bumblebee](https://attack.mitre.org/software/S1039/) (& Quantum)
+- [Conti](https://attack.mitre.org/software/S0575/)
+- [Kimsuky](https://attack.mitre.org/groups/G0094/)
+- [QakBot](https://attack.mitre.org/software/S0650/)
+
+</details>
+
+## Intent & Use
+
+Indexes are designed to be used by human operators as part of simulated attack scenarios such as purple teams. Operators should have general familiarity with attacker techniques, payload generation, and infrastructure management.
+
+Individual Index requirements can be found in that Index's folder in the REQUIREMENTS.md file.
+
+Indexes can be imported directly into [VECTR](https://vectr.io) using the merged YAML document for that Index.
+
+### Additional Notes
+
+- Operators are free to use their payload generation procedures of choice as long as the resulting payload(s) complies with the general description provided by the test case and its associated documentation.
+- Where possible, Operators should avoid using default settings for their tools. This includes, but is not limited to: shellcode, C2 traffic signatures, and default artifacts
+- Some test cases can be performed through alternative execution methods. However, Operators should exercise caution in methods that produce significantly different detection artifacts for the core behaviors. For example, executing a .NET payload via an `execute-assembly` style harness is generally acceptable whereas substituting one credential dumping method for another should be avoided.
+
+## Development Process
+
+Test cases are based on MITRE-tracked intelligence and the general process for determining test cases for inclusion is as follows:
+
+1. Identify initial list of groups with principal members
+2. Map groups to MITRE-tracked groups and filter out non-MITRE groups
+3. Review intelligence report for each group
+    1. Remove anything produced before the look-back period of two years
+    2. Remove reports that do not provide enough information for simulation purposes
+    3. Cut groups lacking intelligence
+4. Extract TTP information from intelligence reports then develop full test cases for each
+    1. Exclude TTPs that likely do not act as worthwhile simulation candidates
+5. Filter out items from list to balance plan composition
+
diff --git a/fs-index-2023/CHANGELOG.md → archived/2023/fs-index-2023/CHANGELOG.md b/fs-index-2023/CHANGELOG.md → archived/2023/fs-index-2023/CHANGELOG.md
diff --git a/fs-index-2023/NOTEBOOK.md → archived/2023/fs-index-2023/NOTEBOOK.md b/fs-index-2023/NOTEBOOK.md → archived/2023/fs-index-2023/NOTEBOOK.md
diff --git a/fs-index-2023/REQUIREMENTS.md → archived/2023/fs-index-2023/REQUIREMENTS.md b/fs-index-2023/REQUIREMENTS.md → archived/2023/fs-index-2023/REQUIREMENTS.md
diff --git a/fs-index-2023/fs-index-2023-v1.2-summary.csv → ...index-2023/fs-index-2023-v1.2-summary.csv b/fs-index-2023/fs-index-2023-v1.2-summary.csv → ...index-2023/fs-index-2023-v1.2-summary.csv
diff --git a/fs-index-2023/fs-index-2023-v1.2.yml → ...2023/fs-index-2023/fs-index-2023-v1.2.yml b/fs-index-2023/fs-index-2023-v1.2.yml → ...2023/fs-index-2023/fs-index-2023-v1.2.yml
diff --git a/fs-index-2023/navigator.json → archived/2023/fs-index-2023/navigator.json b/fs-index-2023/navigator.json → archived/2023/fs-index-2023/navigator.json
diff --git a/...chniques/Collection/T1560.001_7zip_v1.yml → ...chniques/Collection/T1560.001_7zip_v1.yml b/...chniques/Collection/T1560.001_7zip_v1.yml → ...chniques/Collection/T1560.001_7zip_v1.yml
diff --git a/...CommandandControl/T1071.001_httpc2_v3.yml → ...CommandandControl/T1071.001_httpc2_v3.yml b/...CommandandControl/T1071.001_httpc2_v3.yml → ...CommandandControl/T1071.001_httpc2_v3.yml
diff --git a/...ommandandControl/T1071.001_httpsc2_v3.yml → ...ommandandControl/T1071.001_httpsc2_v3.yml b/...ommandandControl/T1071.001_httpsc2_v3.yml → ...ommandandControl/T1071.001_httpsc2_v3.yml
diff --git a/...mmandandControl/T1071.004_dnstxtc2_v3.yml → ...mmandandControl/T1071.004_dnstxtc2_v3.yml b/...mmandandControl/T1071.004_dnstxtc2_v3.yml → ...mmandandControl/T1071.004_dnstxtc2_v3.yml
diff --git a/...dandControl/T1102.002_webservicec2_v3.yml → ...dandControl/T1102.002_webservicec2_v3.yml b/...dandControl/T1102.002_webservicec2_v3.yml → ...dandControl/T1102.002_webservicec2_v3.yml
diff --git a/...s/CommandandControl/T1105_certutil_v2.yml → ...s/CommandandControl/T1105_certutil_v2.yml b/...s/CommandandControl/T1105_certutil_v2.yml → ...s/CommandandControl/T1105_certutil_v2.yml
diff --git a/...mmandandControl/T1105_tooldownload_v2.yml → ...mmandandControl/T1105_tooldownload_v2.yml b/...mmandandControl/T1105_tooldownload_v2.yml → ...mmandandControl/T1105_tooldownload_v2.yml
diff --git a/...mandandControl/T1219_remote_assist_v1.yml → ...mandandControl/T1219_remote_assist_v1.yml b/...mandandControl/T1219_remote_assist_v1.yml → ...mandandControl/T1219_remote_assist_v1.yml
diff --git a/...ommandandControl/T1572_personalvpn_v1.yml → ...ommandandControl/T1572_personalvpn_v1.yml b/...ommandandControl/T1572_personalvpn_v1.yml → ...ommandandControl/T1572_personalvpn_v1.yml
diff --git a/...CredentialAccess/T1003.001_comsvcs_v1.yml → ...CredentialAccess/T1003.001_comsvcs_v1.yml b/...CredentialAccess/T1003.001_comsvcs_v1.yml → ...CredentialAccess/T1003.001_comsvcs_v1.yml
diff --git a/...redentialAccess/T1003.001_procdump_v2.yml → ...redentialAccess/T1003.001_procdump_v2.yml b/...redentialAccess/T1003.001_procdump_v2.yml → ...redentialAccess/T1003.001_procdump_v2.yml
diff --git a/...CredentialAccess/T1003.001_taskmgr_v1.yml → ...CredentialAccess/T1003.001_taskmgr_v1.yml b/...CredentialAccess/T1003.001_taskmgr_v1.yml → ...CredentialAccess/T1003.001_taskmgr_v1.yml
diff --git a/...ntialAccess/T1003.002_reg_save_all_v1.yml → ...ntialAccess/T1003.002_reg_save_all_v1.yml b/...ntialAccess/T1003.002_reg_save_all_v1.yml → ...ntialAccess/T1003.002_reg_save_all_v1.yml
diff --git a/...tialAccess/T1003.003_ntds_vssadmin_v1.yml → ...tialAccess/T1003.003_ntds_vssadmin_v1.yml b/...tialAccess/T1003.003_ntds_vssadmin_v1.yml → ...tialAccess/T1003.003_ntds_vssadmin_v1.yml
diff --git a/...redentialAccess/T1003.003_ntdsutil_v2.yml → ...redentialAccess/T1003.003_ntdsutil_v2.yml b/...redentialAccess/T1003.003_ntdsutil_v2.yml → ...redentialAccess/T1003.003_ntdsutil_v2.yml
diff --git a/.../CredentialAccess/T1003.006_dcsync_v2.yml → .../CredentialAccess/T1003.006_dcsync_v2.yml b/.../CredentialAccess/T1003.006_dcsync_v2.yml → .../CredentialAccess/T1003.006_dcsync_v2.yml
diff --git a/...alAccess/T1555.003_creddumpbrowser_v2.yml → ...alAccess/T1555.003_creddumpbrowser_v2.yml b/...alAccess/T1555.003_creddumpbrowser_v2.yml → ...alAccess/T1555.003_creddumpbrowser_v2.yml
diff --git a/...nseEvasion/T1070.001_cleareventlog_v2.yml → ...nseEvasion/T1070.001_cleareventlog_v2.yml b/...nseEvasion/T1070.001_cleareventlog_v2.yml → ...nseEvasion/T1070.001_cleareventlog_v2.yml
diff --git a/...ues/DefenseEvasion/T1218.005_mshta_v2.yml → ...ues/DefenseEvasion/T1218.005_mshta_v2.yml b/...ues/DefenseEvasion/T1218.005_mshta_v2.yml → ...ues/DefenseEvasion/T1218.005_mshta_v2.yml
diff --git a/.../DefenseEvasion/T1218.008_odbcconf_v2.yml → .../DefenseEvasion/T1218.008_odbcconf_v2.yml b/.../DefenseEvasion/T1218.008_odbcconf_v2.yml → .../DefenseEvasion/T1218.008_odbcconf_v2.yml
diff --git a/.../DefenseEvasion/T1218.010_regsvr32_v3.yml → .../DefenseEvasion/T1218.010_regsvr32_v3.yml b/.../DefenseEvasion/T1218.010_regsvr32_v3.yml → .../DefenseEvasion/T1218.010_regsvr32_v3.yml
diff --git a/...DefenseEvasion/T1218.011_proxy_exe_v1.yml → ...DefenseEvasion/T1218.011_proxy_exe_v1.yml b/...DefenseEvasion/T1218.011_proxy_exe_v1.yml → ...DefenseEvasion/T1218.011_proxy_exe_v1.yml
diff --git a/.../DefenseEvasion/T1218.011_rundll32_v1.yml → .../DefenseEvasion/T1218.011_rundll32_v1.yml b/.../DefenseEvasion/T1218.011_rundll32_v1.yml → .../DefenseEvasion/T1218.011_rundll32_v1.yml
diff --git a/.../DefenseEvasion/T1489_netstop_bulk_v2.yml → .../DefenseEvasion/T1489_netstop_bulk_v2.yml b/.../DefenseEvasion/T1489_netstop_bulk_v2.yml → .../DefenseEvasion/T1489_netstop_bulk_v2.yml
diff --git a/...DefenseEvasion/T1548.002_uacbypass_v3.yml → ...DefenseEvasion/T1548.002_uacbypass_v3.yml b/...DefenseEvasion/T1548.002_uacbypass_v3.yml → ...DefenseEvasion/T1548.002_uacbypass_v3.yml
diff --git a/...nseEvasion/T1550.003_passtheticket_v2.yml → ...nseEvasion/T1550.003_passtheticket_v2.yml b/...nseEvasion/T1550.003_passtheticket_v2.yml → ...nseEvasion/T1550.003_passtheticket_v2.yml
diff --git a/...on/T1574.001_dll_searchorderhijack_v1.yml → ...on/T1574.001_dll_searchorderhijack_v1.yml b/...on/T1574.001_dll_searchorderhijack_v1.yml → ...on/T1574.001_dll_searchorderhijack_v1.yml
diff --git a/...ques/Discovery/T1018_nltest_dclist_v1.yml → ...ques/Discovery/T1018_nltest_dclist_v1.yml b/...ques/Discovery/T1018_nltest_dclist_v1.yml → ...ques/Discovery/T1018_nltest_dclist_v1.yml
diff --git a/...niques/Discovery/T1046_networkscan_v1.yml → ...niques/Discovery/T1046_networkscan_v1.yml b/...niques/Discovery/T1046_networkscan_v1.yml → ...niques/Discovery/T1046_networkscan_v1.yml
diff --git a/...es/Discovery/T1087.002_adfind_bulk_v1.yml → ...es/Discovery/T1087.002_adfind_bulk_v1.yml b/...es/Discovery/T1087.002_adfind_bulk_v1.yml → ...es/Discovery/T1087.002_adfind_bulk_v1.yml
diff --git a/...ues/Discovery/T1087.002_ldap_users_v1.yml → ...ues/Discovery/T1087.002_ldap_users_v1.yml b/...ues/Discovery/T1087.002_ldap_users_v1.yml → ...ues/Discovery/T1087.002_ldap_users_v1.yml
diff --git a/...scovery/T1087.002_net_domainadmins_v1.yml → ...scovery/T1087.002_net_domainadmins_v1.yml b/...scovery/T1087.002_net_domainadmins_v1.yml → ...scovery/T1087.002_net_domainadmins_v1.yml
diff --git a/...iscovery/T1087.002_net_user_groups_v1.yml → ...iscovery/T1087.002_net_user_groups_v1.yml b/...iscovery/T1087.002_net_user_groups_v1.yml → ...iscovery/T1087.002_net_user_groups_v1.yml
diff --git a/...ues/Discovery/T1135_netview_shares_v1.yml → ...ues/Discovery/T1135_netview_shares_v1.yml b/...ues/Discovery/T1135_netview_shares_v1.yml → ...ues/Discovery/T1135_netview_shares_v1.yml
diff --git a/...hniques/Discovery/T1482_nltest_all_v1.yml → ...hniques/Discovery/T1482_nltest_all_v1.yml b/...hniques/Discovery/T1482_nltest_all_v1.yml → ...hniques/Discovery/T1482_nltest_all_v1.yml
diff --git a/...023/techniques/Execution/T1106_exe_v1.yml → ...023/techniques/Execution/T1106_exe_v1.yml b/...023/techniques/Execution/T1106_exe_v1.yml → ...023/techniques/Execution/T1106_exe_v1.yml
diff --git a/...ques/Execution/T1204.002_macro_hta_v1.yml → ...ques/Execution/T1204.002_macro_hta_v1.yml b/...ques/Execution/T1204.002_macro_hta_v1.yml → ...ques/Execution/T1204.002_macro_hta_v1.yml
diff --git a/...chniques/Execution/T1204.002_macro_v1.yml → ...chniques/Execution/T1204.002_macro_v1.yml b/...chniques/Execution/T1204.002_macro_v1.yml → ...chniques/Execution/T1204.002_macro_v1.yml
diff --git a/...s/Exfiltration/T1048.003_httpexfil_v2.yml → ...s/Exfiltration/T1048.003_httpexfil_v2.yml b/...s/Exfiltration/T1048.003_httpexfil_v2.yml → ...s/Exfiltration/T1048.003_httpexfil_v2.yml
diff --git a/...Exfiltration/T1567.002_mega_rclone_v1.yml → ...Exfiltration/T1567.002_mega_rclone_v1.yml b/...Exfiltration/T1567.002_mega_rclone_v1.yml → ...Exfiltration/T1567.002_mega_rclone_v1.yml
diff --git a/...Impact/T1021.002_remote_ransomware_v2.yml → ...Impact/T1021.002_remote_ransomware_v2.yml b/...Impact/T1021.002_remote_ransomware_v2.yml → ...Impact/T1021.002_remote_ransomware_v2.yml
diff --git a/...techniques/Impact/T1486_ransomware_v3.yml → ...techniques/Impact/T1486_ransomware_v3.yml b/...techniques/Impact/T1486_ransomware_v3.yml → ...techniques/Impact/T1486_ransomware_v3.yml
diff --git a/...ccess/T1027.006_html_smuggle_email_v1.yml → ...ccess/T1027.006_html_smuggle_email_v1.yml b/...ccess/T1027.006_html_smuggle_email_v1.yml → ...ccess/T1027.006_html_smuggle_email_v1.yml
diff --git a/...tialAccess/T1078_simultaneouslogin_v1.yml → ...tialAccess/T1078_simultaneouslogin_v1.yml b/...tialAccess/T1078_simultaneouslogin_v1.yml → ...tialAccess/T1078_simultaneouslogin_v1.yml
diff --git a/...itialAccess/T1078_suspicious_login_v3.yml → ...itialAccess/T1078_suspicious_login_v3.yml b/...itialAccess/T1078_suspicious_login_v3.yml → ...itialAccess/T1078_suspicious_login_v3.yml
diff --git a/...tialAccess/T1110.003_externalspray_v2.yml → ...tialAccess/T1110.003_externalspray_v2.yml b/...tialAccess/T1110.003_externalspray_v2.yml → ...tialAccess/T1110.003_externalspray_v2.yml
diff --git a/...InitialAccess/T1566.001_zipped_iso_v1.yml → ...InitialAccess/T1566.001_zipped_iso_v1.yml b/...InitialAccess/T1566.001_zipped_iso_v1.yml → ...InitialAccess/T1566.001_zipped_iso_v1.yml
diff --git a/...itialAccess/T1566.001_zipped_macro_v1.yml → ...itialAccess/T1566.001_zipped_macro_v1.yml b/...itialAccess/T1566.001_zipped_macro_v1.yml → ...itialAccess/T1566.001_zipped_macro_v1.yml
diff --git a/...es/InitialAccess/T1566.002_spl_iso_v1.yml → ...es/InitialAccess/T1566.002_spl_iso_v1.yml b/...es/InitialAccess/T1566.002_spl_iso_v1.yml → ...es/InitialAccess/T1566.002_spl_iso_v1.yml
diff --git a/...iques/InitialAccess/T1621_mfa_spam_v1.yml → ...iques/InitialAccess/T1621_mfa_spam_v1.yml b/...iques/InitialAccess/T1621_mfa_spam_v1.yml → ...iques/InitialAccess/T1621_mfa_spam_v1.yml
diff --git a/...ques/LateralMovement/T1021.001_rdp_v2.yml → ...ques/LateralMovement/T1021.001_rdp_v2.yml b/...ques/LateralMovement/T1021.001_rdp_v2.yml → ...ques/LateralMovement/T1021.001_rdp_v2.yml
diff --git a/...es/LateralMovement/T1021.002_smbc2_v1.yml → ...es/LateralMovement/T1021.002_smbc2_v1.yml b/...es/LateralMovement/T1021.002_smbc2_v1.yml → ...es/LateralMovement/T1021.002_smbc2_v1.yml
diff --git a/...alMovement/T1021.003_scheduledtask_v2.yml → ...alMovement/T1021.003_scheduledtask_v2.yml b/...alMovement/T1021.003_scheduledtask_v2.yml → ...alMovement/T1021.003_scheduledtask_v2.yml
diff --git a/...s/LateralMovement/T1021.003_wmipcc_v1.yml → ...s/LateralMovement/T1021.003_wmipcc_v1.yml b/...s/LateralMovement/T1021.003_wmipcc_v1.yml → ...s/LateralMovement/T1021.003_wmipcc_v1.yml
diff --git a/...ment/T1057_processdiscovery_remote_v1.yml → ...ment/T1057_processdiscovery_remote_v1.yml b/...ment/T1057_processdiscovery_remote_v1.yml → ...ment/T1057_processdiscovery_remote_v1.yml
diff --git a/...ques/LateralMovement/T1570_execopy_v1.yml → ...ques/LateralMovement/T1570_execopy_v1.yml b/...ques/LateralMovement/T1570_execopy_v1.yml → ...ques/LateralMovement/T1570_execopy_v1.yml
diff --git a/...ques/Persistence/T1053.005_schtask_v7.yml → ...ques/Persistence/T1053.005_schtask_v7.yml b/...ques/Persistence/T1053.005_schtask_v7.yml → ...ques/Persistence/T1053.005_schtask_v7.yml
diff --git a/...ersistence/T1136.001_newlocaladmin_v1.yml → ...ersistence/T1136.001_newlocaladmin_v1.yml b/...ersistence/T1136.001_newlocaladmin_v1.yml → ...ersistence/T1136.001_newlocaladmin_v1.yml
diff --git a/...rsistence/T1543.003_newservice_reg_v1.yml → ...rsistence/T1543.003_newservice_reg_v1.yml b/...rsistence/T1543.003_newservice_reg_v1.yml → ...rsistence/T1543.003_newservice_reg_v1.yml
diff --git a/...iques/Persistence/T1547.001_runkey_v3.yml → ...iques/Persistence/T1547.001_runkey_v3.yml b/...iques/Persistence/T1547.001_runkey_v3.yml → ...iques/Persistence/T1547.001_runkey_v3.yml
diff --git a/h-index-2023/NOTEBOOK.md → archived/2023/h-index-2023/NOTEBOOK.md b/h-index-2023/NOTEBOOK.md → archived/2023/h-index-2023/NOTEBOOK.md
diff --git a/h-index-2023/REQUIREMENTS.md → archived/2023/h-index-2023/REQUIREMENTS.md b/h-index-2023/REQUIREMENTS.md → archived/2023/h-index-2023/REQUIREMENTS.md
diff --git a/h-index-2023/h-index-2023-v1.2-summary.csv → ...-index-2023/h-index-2023-v1.2-summary.csv b/h-index-2023/h-index-2023-v1.2-summary.csv → ...-index-2023/h-index-2023-v1.2-summary.csv
diff --git a/h-index-2023/h-index-2023-v1.2.yml → ...d/2023/h-index-2023/h-index-2023-v1.2.yml b/h-index-2023/h-index-2023-v1.2.yml → ...d/2023/h-index-2023/h-index-2023-v1.2.yml
diff --git a/h-index-2023/navigator.json → archived/2023/h-index-2023/navigator.json b/h-index-2023/navigator.json → archived/2023/h-index-2023/navigator.json
diff --git a/...niques/Collection/T1056.001_keylog_v2.yml → ...niques/Collection/T1056.001_keylog_v2.yml b/...niques/Collection/T1056.001_keylog_v2.yml → ...niques/Collection/T1056.001_keylog_v2.yml
diff --git a/...chniques/Collection/T1560.001_7zip_v1.yml → ...chniques/Collection/T1560.001_7zip_v1.yml b/...chniques/Collection/T1560.001_7zip_v1.yml → ...chniques/Collection/T1560.001_7zip_v1.yml
diff --git a/...CommandandControl/T1071.001_httpc2_v3.yml → ...CommandandControl/T1071.001_httpc2_v3.yml b/...CommandandControl/T1071.001_httpc2_v3.yml → ...CommandandControl/T1071.001_httpc2_v3.yml
diff --git a/...ommandandControl/T1071.001_httpsc2_v3.yml → ...ommandandControl/T1071.001_httpsc2_v3.yml b/...ommandandControl/T1071.001_httpsc2_v3.yml → ...ommandandControl/T1071.001_httpsc2_v3.yml
diff --git a/...mmandandControl/T1071.004_dnstxtc2_v3.yml → ...mmandandControl/T1071.004_dnstxtc2_v3.yml b/...mmandandControl/T1071.004_dnstxtc2_v3.yml → ...mmandandControl/T1071.004_dnstxtc2_v3.yml
diff --git a/...mmandandControl/T1105_tooldownload_v2.yml → ...mmandandControl/T1105_tooldownload_v2.yml b/...mmandandControl/T1105_tooldownload_v2.yml → ...mmandandControl/T1105_tooldownload_v2.yml
diff --git a/...mandandControl/T1219_remote_assist_v1.yml → ...mandandControl/T1219_remote_assist_v1.yml b/...mandandControl/T1219_remote_assist_v1.yml → ...mandandControl/T1219_remote_assist_v1.yml
diff --git a/...ialAccess/T1003.001_creddumpmemory_v3.yml → ...ialAccess/T1003.001_creddumpmemory_v3.yml b/...ialAccess/T1003.001_creddumpmemory_v3.yml → ...ialAccess/T1003.001_creddumpmemory_v3.yml
diff --git a/...redentialAccess/T1003.001_procdump_v2.yml → ...redentialAccess/T1003.001_procdump_v2.yml b/...redentialAccess/T1003.001_procdump_v2.yml → ...redentialAccess/T1003.001_procdump_v2.yml
diff --git a/...tialAccess/T1003.001_processhacker_v1.yml → ...tialAccess/T1003.001_processhacker_v1.yml b/...tialAccess/T1003.001_processhacker_v1.yml → ...tialAccess/T1003.001_processhacker_v1.yml
diff --git a/...redentialAccess/T1003.002_hashdump_v1.yml → ...redentialAccess/T1003.002_hashdump_v1.yml b/...redentialAccess/T1003.002_hashdump_v1.yml → ...redentialAccess/T1003.002_hashdump_v1.yml
diff --git a/...ntialAccess/T1003.002_reg_save_all_v1.yml → ...ntialAccess/T1003.002_reg_save_all_v1.yml b/...ntialAccess/T1003.002_reg_save_all_v1.yml → ...ntialAccess/T1003.002_reg_save_all_v1.yml
diff --git a/...tialAccess/T1003.003_ntds_vssadmin_v1.yml → ...tialAccess/T1003.003_ntds_vssadmin_v1.yml b/...tialAccess/T1003.003_ntds_vssadmin_v1.yml → ...tialAccess/T1003.003_ntds_vssadmin_v1.yml
diff --git a/...alAccess/T1555.003_creddumpbrowser_v2.yml → ...alAccess/T1555.003_creddumpbrowser_v2.yml b/...alAccess/T1555.003_creddumpbrowser_v2.yml → ...alAccess/T1555.003_creddumpbrowser_v2.yml
diff --git a/...fenseEvasion/T1140_certutil_decode_v2.yml → ...fenseEvasion/T1140_certutil_decode_v2.yml b/...fenseEvasion/T1140_certutil_decode_v2.yml → ...fenseEvasion/T1140_certutil_decode_v2.yml
diff --git a/...ues/DefenseEvasion/T1218.005_mshta_v2.yml → ...ues/DefenseEvasion/T1218.005_mshta_v2.yml b/...ues/DefenseEvasion/T1218.005_mshta_v2.yml → ...ues/DefenseEvasion/T1218.005_mshta_v2.yml
diff --git a/.../DefenseEvasion/T1218.008_odbcconf_v2.yml → .../DefenseEvasion/T1218.008_odbcconf_v2.yml b/.../DefenseEvasion/T1218.008_odbcconf_v2.yml → .../DefenseEvasion/T1218.008_odbcconf_v2.yml
diff --git a/.../DefenseEvasion/T1218.010_regsvr32_v3.yml → .../DefenseEvasion/T1218.010_regsvr32_v3.yml b/.../DefenseEvasion/T1218.010_regsvr32_v3.yml → .../DefenseEvasion/T1218.010_regsvr32_v3.yml
diff --git a/.../DefenseEvasion/T1218.011_rundll32_v1.yml → .../DefenseEvasion/T1218.011_rundll32_v1.yml b/.../DefenseEvasion/T1218.011_rundll32_v1.yml → .../DefenseEvasion/T1218.011_rundll32_v1.yml
diff --git a/...DefenseEvasion/T1548.002_uacbypass_v3.yml → ...DefenseEvasion/T1548.002_uacbypass_v3.yml b/...DefenseEvasion/T1548.002_uacbypass_v3.yml → ...DefenseEvasion/T1548.002_uacbypass_v3.yml
diff --git a/...niques/Discovery/T1046_networkscan_v1.yml → ...niques/Discovery/T1046_networkscan_v1.yml b/...niques/Discovery/T1046_networkscan_v1.yml → ...niques/Discovery/T1046_networkscan_v1.yml
diff --git a/...s/Discovery/T1057_processdiscovery_v1.yml → ...s/Discovery/T1057_processdiscovery_v1.yml b/...s/Discovery/T1057_processdiscovery_v1.yml → ...s/Discovery/T1057_processdiscovery_v1.yml
diff --git a/...Discovery/T1087.001_net_localgroup_v1.yml → ...Discovery/T1087.001_net_localgroup_v1.yml b/...Discovery/T1087.001_net_localgroup_v1.yml → ...Discovery/T1087.001_net_localgroup_v1.yml
diff --git a/...es/Discovery/T1087.002_adfind_bulk_v1.yml → ...es/Discovery/T1087.002_adfind_bulk_v1.yml b/...es/Discovery/T1087.002_adfind_bulk_v1.yml → ...es/Discovery/T1087.002_adfind_bulk_v1.yml
diff --git a/...scovery/T1087.002_net_domainadmins_v1.yml → ...scovery/T1087.002_net_domainadmins_v1.yml b/...scovery/T1087.002_net_domainadmins_v1.yml → ...scovery/T1087.002_net_domainadmins_v1.yml
diff --git a/...covery/T1087.002_setspn_collection_v1.yml → ...covery/T1087.002_setspn_collection_v1.yml b/...covery/T1087.002_setspn_collection_v1.yml → ...covery/T1087.002_setspn_collection_v1.yml
diff --git a/...ues/Discovery/T1135_netview_shares_v1.yml → ...ues/Discovery/T1135_netview_shares_v1.yml b/...ues/Discovery/T1135_netview_shares_v1.yml → ...ues/Discovery/T1135_netview_shares_v1.yml
diff --git a/...hniques/Discovery/T1482_nltest_all_v1.yml → ...hniques/Discovery/T1482_nltest_all_v1.yml b/...hniques/Discovery/T1482_nltest_all_v1.yml → ...hniques/Discovery/T1482_nltest_all_v1.yml
diff --git a/...covery/T1518.001_securitydiscovery_v3.yml → ...covery/T1518.001_securitydiscovery_v3.yml b/...covery/T1518.001_securitydiscovery_v3.yml → ...covery/T1518.001_securitydiscovery_v3.yml
diff --git a/...023/techniques/Execution/T1106_exe_v1.yml → ...023/techniques/Execution/T1106_exe_v1.yml b/...023/techniques/Execution/T1106_exe_v1.yml → ...023/techniques/Execution/T1106_exe_v1.yml
diff --git a/...ques/Execution/T1204.002_macro_hta_v1.yml → ...ques/Execution/T1204.002_macro_hta_v1.yml b/...ques/Execution/T1204.002_macro_hta_v1.yml → ...ques/Execution/T1204.002_macro_hta_v1.yml
diff --git a/...chniques/Execution/T1204.002_macro_v1.yml → ...chniques/Execution/T1204.002_macro_v1.yml b/...chniques/Execution/T1204.002_macro_v1.yml → ...chniques/Execution/T1204.002_macro_v1.yml
diff --git a/...ues/Exfiltration/T1041_httpc2exfil_v2.yml → ...ues/Exfiltration/T1041_httpc2exfil_v2.yml b/...ues/Exfiltration/T1041_httpc2exfil_v2.yml → ...ues/Exfiltration/T1041_httpc2exfil_v2.yml
diff --git a/...Exfiltration/T1567.002_mega_rclone_v1.yml → ...Exfiltration/T1567.002_mega_rclone_v1.yml b/...Exfiltration/T1567.002_mega_rclone_v1.yml → ...Exfiltration/T1567.002_mega_rclone_v1.yml
diff --git a/...Impact/T1021.002_remote_ransomware_v2.yml → ...Impact/T1021.002_remote_ransomware_v2.yml b/...Impact/T1021.002_remote_ransomware_v2.yml → ...Impact/T1021.002_remote_ransomware_v2.yml
diff --git a/...techniques/Impact/T1486_ransomware_v3.yml → ...techniques/Impact/T1486_ransomware_v3.yml b/...techniques/Impact/T1486_ransomware_v3.yml → ...techniques/Impact/T1486_ransomware_v3.yml
diff --git a/...ccess/T1027.006_html_smuggle_email_v1.yml → ...ccess/T1027.006_html_smuggle_email_v1.yml b/...ccess/T1027.006_html_smuggle_email_v1.yml → ...ccess/T1027.006_html_smuggle_email_v1.yml
diff --git a/...lAccess/T1566.001_encarchive_macro_v1.yml → ...lAccess/T1566.001_encarchive_macro_v1.yml b/...lAccess/T1566.001_encarchive_macro_v1.yml → ...lAccess/T1566.001_encarchive_macro_v1.yml
diff --git a/...InitialAccess/T1566.001_zipped_iso_v1.yml → ...InitialAccess/T1566.001_zipped_iso_v1.yml b/...InitialAccess/T1566.001_zipped_iso_v1.yml → ...InitialAccess/T1566.001_zipped_iso_v1.yml
diff --git a/.../InitialAccess/T1566.001_zipped_js_v1.yml → .../InitialAccess/T1566.001_zipped_js_v1.yml b/.../InitialAccess/T1566.001_zipped_js_v1.yml → .../InitialAccess/T1566.001_zipped_js_v1.yml
diff --git a/...InitialAccess/T1566.002_zipped_iso_v1.yml → ...InitialAccess/T1566.002_zipped_iso_v1.yml b/...InitialAccess/T1566.002_zipped_iso_v1.yml → ...InitialAccess/T1566.002_zipped_iso_v1.yml
diff --git a/...iques/InitialAccess/T1621_mfa_spam_v1.yml → ...iques/InitialAccess/T1621_mfa_spam_v1.yml b/...iques/InitialAccess/T1621_mfa_spam_v1.yml → ...iques/InitialAccess/T1621_mfa_spam_v1.yml
diff --git a/...ques/LateralMovement/T1021.001_rdp_v2.yml → ...ques/LateralMovement/T1021.001_rdp_v2.yml b/...ques/LateralMovement/T1021.001_rdp_v2.yml → ...ques/LateralMovement/T1021.001_rdp_v2.yml
diff --git a/...s/LateralMovement/T1021.003_wmipcc_v1.yml → ...s/LateralMovement/T1021.003_wmipcc_v1.yml b/...s/LateralMovement/T1021.003_wmipcc_v1.yml → ...s/LateralMovement/T1021.003_wmipcc_v1.yml
diff --git a/...ques/Persistence/T1053.005_schtask_v7.yml → ...ques/Persistence/T1053.005_schtask_v7.yml b/...ques/Persistence/T1053.005_schtask_v7.yml → ...ques/Persistence/T1053.005_schtask_v7.yml
diff --git a/...ersistence/T1136.001_newlocaladmin_v1.yml → ...ersistence/T1136.001_newlocaladmin_v1.yml b/...ersistence/T1136.001_newlocaladmin_v1.yml → ...ersistence/T1136.001_newlocaladmin_v1.yml
diff --git a/...rsistence/T1543.003_newservice_reg_v1.yml → ...rsistence/T1543.003_newservice_reg_v1.yml b/...rsistence/T1543.003_newservice_reg_v1.yml → ...rsistence/T1543.003_newservice_reg_v1.yml
diff --git a/...ques/Persistence/T1547.001_runonce_v2.yml → ...ques/Persistence/T1547.001_runonce_v2.yml b/...ques/Persistence/T1547.001_runonce_v2.yml → ...ques/Persistence/T1547.001_runonce_v2.yml
diff --git a/...ersistence/T1547.001_startupfolder_v1.yml → ...ersistence/T1547.001_startupfolder_v1.yml b/...ersistence/T1547.001_startupfolder_v1.yml → ...ersistence/T1547.001_startupfolder_v1.yml
diff --git a/...sistence/T1564.002_hide_user_logon_v1.yml → ...sistence/T1564.002_hide_user_logon_v1.yml b/...sistence/T1564.002_hide_user_logon_v1.yml → ...sistence/T1564.002_hide_user_logon_v1.yml
diff --git a/rh-index-2023/NOTEBOOK.md → archived/2023/rh-index-2023/NOTEBOOK.md b/rh-index-2023/NOTEBOOK.md → archived/2023/rh-index-2023/NOTEBOOK.md
diff --git a/rh-index-2023/REQUIREMENTS.md → archived/2023/rh-index-2023/REQUIREMENTS.md b/rh-index-2023/REQUIREMENTS.md → archived/2023/rh-index-2023/REQUIREMENTS.md
diff --git a/rh-index-2023/navigator.json → archived/2023/rh-index-2023/navigator.json b/rh-index-2023/navigator.json → archived/2023/rh-index-2023/navigator.json
diff --git a/rh-index-2023/rh-index-2023-v1.2-summary.csv → ...index-2023/rh-index-2023-v1.2-summary.csv b/rh-index-2023/rh-index-2023-v1.2-summary.csv → ...index-2023/rh-index-2023-v1.2-summary.csv
diff --git a/rh-index-2023/rh-index-2023-v1.2.yml → ...2023/rh-index-2023/rh-index-2023-v1.2.yml b/rh-index-2023/rh-index-2023-v1.2.yml → ...2023/rh-index-2023/rh-index-2023-v1.2.yml
diff --git a/...chniques/Collection/T1560.001_7zip_v1.yml → ...chniques/Collection/T1560.001_7zip_v1.yml b/...chniques/Collection/T1560.001_7zip_v1.yml → ...chniques/Collection/T1560.001_7zip_v1.yml
diff --git a/...CommandandControl/T1071.001_httpc2_v3.yml → ...CommandandControl/T1071.001_httpc2_v3.yml b/...CommandandControl/T1071.001_httpc2_v3.yml → ...CommandandControl/T1071.001_httpc2_v3.yml
diff --git a/...ommandandControl/T1071.001_httpsc2_v3.yml → ...ommandandControl/T1071.001_httpsc2_v3.yml b/...ommandandControl/T1071.001_httpsc2_v3.yml → ...ommandandControl/T1071.001_httpsc2_v3.yml
diff --git a/...mmandandControl/T1071.004_dnstxtc2_v3.yml → ...mmandandControl/T1071.004_dnstxtc2_v3.yml b/...mmandandControl/T1071.004_dnstxtc2_v3.yml → ...mmandandControl/T1071.004_dnstxtc2_v3.yml
diff --git a/...mmandandControl/T1105_tooldownload_v2.yml → ...mmandandControl/T1105_tooldownload_v2.yml b/...mmandandControl/T1105_tooldownload_v2.yml → ...mmandandControl/T1105_tooldownload_v2.yml
diff --git a/...mandandControl/T1219_remote_assist_v1.yml → ...mandandControl/T1219_remote_assist_v1.yml b/...mandandControl/T1219_remote_assist_v1.yml → ...mandandControl/T1219_remote_assist_v1.yml
diff --git a/...redentialAccess/T1003.001_procdump_v2.yml → ...redentialAccess/T1003.001_procdump_v2.yml b/...redentialAccess/T1003.001_procdump_v2.yml → ...redentialAccess/T1003.001_procdump_v2.yml
diff --git a/...tialAccess/T1003.001_processhacker_v1.yml → ...tialAccess/T1003.001_processhacker_v1.yml b/...tialAccess/T1003.001_processhacker_v1.yml → ...tialAccess/T1003.001_processhacker_v1.yml
diff --git a/...redentialAccess/T1003.002_hashdump_v1.yml → ...redentialAccess/T1003.002_hashdump_v1.yml b/...redentialAccess/T1003.002_hashdump_v1.yml → ...redentialAccess/T1003.002_hashdump_v1.yml
diff --git a/...tialAccess/T1003.003_ntds_vssadmin_v1.yml → ...tialAccess/T1003.003_ntds_vssadmin_v1.yml b/...tialAccess/T1003.003_ntds_vssadmin_v1.yml → ...tialAccess/T1003.003_ntds_vssadmin_v1.yml
diff --git a/...redentialAccess/T1003.003_ntdsutil_v2.yml → ...redentialAccess/T1003.003_ntdsutil_v2.yml b/...redentialAccess/T1003.003_ntdsutil_v2.yml → ...redentialAccess/T1003.003_ntdsutil_v2.yml
diff --git a/.../CredentialAccess/T1003.006_dcsync_v2.yml → .../CredentialAccess/T1003.006_dcsync_v2.yml b/.../CredentialAccess/T1003.006_dcsync_v2.yml → .../CredentialAccess/T1003.006_dcsync_v2.yml
diff --git a/...alAccess/T1555.003_creddumpbrowser_v2.yml → ...alAccess/T1555.003_creddumpbrowser_v2.yml b/...alAccess/T1555.003_creddumpbrowser_v2.yml → ...alAccess/T1555.003_creddumpbrowser_v2.yml
diff --git a/...dentialAccess/T1558.003_kerberoast_v3.yml → ...dentialAccess/T1558.003_kerberoast_v3.yml b/...dentialAccess/T1558.003_kerberoast_v3.yml → ...dentialAccess/T1558.003_kerberoast_v3.yml
diff --git a/...ues/DefenseEvasion/T1218.005_mshta_v2.yml → ...ues/DefenseEvasion/T1218.005_mshta_v2.yml b/...ues/DefenseEvasion/T1218.005_mshta_v2.yml → ...ues/DefenseEvasion/T1218.005_mshta_v2.yml
diff --git a/.../DefenseEvasion/T1218.008_odbcconf_v2.yml → .../DefenseEvasion/T1218.008_odbcconf_v2.yml b/.../DefenseEvasion/T1218.008_odbcconf_v2.yml → .../DefenseEvasion/T1218.008_odbcconf_v2.yml
diff --git a/.../DefenseEvasion/T1218.010_regsvr32_v3.yml → .../DefenseEvasion/T1218.010_regsvr32_v3.yml b/.../DefenseEvasion/T1218.010_regsvr32_v3.yml → .../DefenseEvasion/T1218.010_regsvr32_v3.yml
diff --git a/.../DefenseEvasion/T1218.011_rundll32_v1.yml → .../DefenseEvasion/T1218.011_rundll32_v1.yml b/.../DefenseEvasion/T1218.011_rundll32_v1.yml → .../DefenseEvasion/T1218.011_rundll32_v1.yml
diff --git a/...DefenseEvasion/T1548.002_uacbypass_v3.yml → ...DefenseEvasion/T1548.002_uacbypass_v3.yml b/...DefenseEvasion/T1548.002_uacbypass_v3.yml → ...DefenseEvasion/T1548.002_uacbypass_v3.yml
diff --git a/...ques/Discovery/T1018_nltest_dclist_v1.yml → ...ques/Discovery/T1018_nltest_dclist_v1.yml b/...ques/Discovery/T1018_nltest_dclist_v1.yml → ...ques/Discovery/T1018_nltest_dclist_v1.yml
diff --git a/...niques/Discovery/T1046_networkscan_v1.yml → ...niques/Discovery/T1046_networkscan_v1.yml b/...niques/Discovery/T1046_networkscan_v1.yml → ...niques/Discovery/T1046_networkscan_v1.yml
diff --git a/...ques/Discovery/T1049_sessiongopher_v1.yml → ...ques/Discovery/T1049_sessiongopher_v1.yml b/...ques/Discovery/T1049_sessiongopher_v1.yml → ...ques/Discovery/T1049_sessiongopher_v1.yml
diff --git a/...hniques/Discovery/T1082_systeminfo_v1.yml → ...hniques/Discovery/T1082_systeminfo_v1.yml b/...hniques/Discovery/T1082_systeminfo_v1.yml → ...hniques/Discovery/T1082_systeminfo_v1.yml
diff --git a/...Discovery/T1087.001_net_localgroup_v1.yml → ...Discovery/T1087.001_net_localgroup_v1.yml b/...Discovery/T1087.001_net_localgroup_v1.yml → ...Discovery/T1087.001_net_localgroup_v1.yml
diff --git a/...es/Discovery/T1087.002_ad_explorer_v1.yml → ...es/Discovery/T1087.002_ad_explorer_v1.yml b/...es/Discovery/T1087.002_ad_explorer_v1.yml → ...es/Discovery/T1087.002_ad_explorer_v1.yml
diff --git a/...scovery/T1087.002_net_domainadmins_v1.yml → ...scovery/T1087.002_net_domainadmins_v1.yml b/...scovery/T1087.002_net_domainadmins_v1.yml → ...scovery/T1087.002_net_domainadmins_v1.yml
diff --git a/...covery/T1087.002_setspn_collection_v1.yml → ...covery/T1087.002_setspn_collection_v1.yml b/...covery/T1087.002_setspn_collection_v1.yml → ...covery/T1087.002_setspn_collection_v1.yml
diff --git a/...ues/Discovery/T1135_netview_shares_v1.yml → ...ues/Discovery/T1135_netview_shares_v1.yml b/...ues/Discovery/T1135_netview_shares_v1.yml → ...ues/Discovery/T1135_netview_shares_v1.yml
diff --git a/...hniques/Discovery/T1482_nltest_all_v1.yml → ...hniques/Discovery/T1482_nltest_all_v1.yml b/...hniques/Discovery/T1482_nltest_all_v1.yml → ...hniques/Discovery/T1482_nltest_all_v1.yml
diff --git a/...techniques/Execution/T1059.005_vbs_v1.yml → ...techniques/Execution/T1059.005_vbs_v1.yml b/...techniques/Execution/T1059.005_vbs_v1.yml → ...techniques/Execution/T1059.005_vbs_v1.yml
diff --git a/...023/techniques/Execution/T1106_exe_v1.yml → ...023/techniques/Execution/T1106_exe_v1.yml b/...023/techniques/Execution/T1106_exe_v1.yml → ...023/techniques/Execution/T1106_exe_v1.yml
diff --git a/...ques/Execution/T1204.002_macro_hta_v1.yml → ...ques/Execution/T1204.002_macro_hta_v1.yml b/...ques/Execution/T1204.002_macro_hta_v1.yml → ...ques/Execution/T1204.002_macro_hta_v1.yml
diff --git a/...chniques/Execution/T1204.002_macro_v1.yml → ...chniques/Execution/T1204.002_macro_v1.yml b/...chniques/Execution/T1204.002_macro_v1.yml → ...chniques/Execution/T1204.002_macro_v1.yml
diff --git a/...Exfiltration/T1567.002_mega_rclone_v1.yml → ...Exfiltration/T1567.002_mega_rclone_v1.yml b/...Exfiltration/T1567.002_mega_rclone_v1.yml → ...Exfiltration/T1567.002_mega_rclone_v1.yml
diff --git a/...Impact/T1021.002_remote_ransomware_v2.yml → ...Impact/T1021.002_remote_ransomware_v2.yml b/...Impact/T1021.002_remote_ransomware_v2.yml → ...Impact/T1021.002_remote_ransomware_v2.yml
diff --git a/...techniques/Impact/T1486_ransomware_v3.yml → ...techniques/Impact/T1486_ransomware_v3.yml b/...techniques/Impact/T1486_ransomware_v3.yml → ...techniques/Impact/T1486_ransomware_v3.yml
diff --git a/...ccess/T1027.006_html_smuggle_email_v1.yml → ...ccess/T1027.006_html_smuggle_email_v1.yml b/...ccess/T1027.006_html_smuggle_email_v1.yml → ...ccess/T1027.006_html_smuggle_email_v1.yml
diff --git a/...tialAccess/T1078_simultaneouslogin_v1.yml → ...tialAccess/T1078_simultaneouslogin_v1.yml b/...tialAccess/T1078_simultaneouslogin_v1.yml → ...tialAccess/T1078_simultaneouslogin_v1.yml
diff --git a/...itialAccess/T1078_suspicious_login_v3.yml → ...itialAccess/T1078_suspicious_login_v3.yml b/...itialAccess/T1078_suspicious_login_v3.yml → ...itialAccess/T1078_suspicious_login_v3.yml
diff --git a/...InitialAccess/T1566.001_zipped_iso_v1.yml → ...InitialAccess/T1566.001_zipped_iso_v1.yml b/...InitialAccess/T1566.001_zipped_iso_v1.yml → ...InitialAccess/T1566.001_zipped_iso_v1.yml
diff --git a/...itialAccess/T1566.001_zipped_macro_v1.yml → ...itialAccess/T1566.001_zipped_macro_v1.yml b/...itialAccess/T1566.001_zipped_macro_v1.yml → ...itialAccess/T1566.001_zipped_macro_v1.yml
diff --git a/...InitialAccess/T1566.002_zipped_iso_v1.yml → ...InitialAccess/T1566.002_zipped_iso_v1.yml b/...InitialAccess/T1566.002_zipped_iso_v1.yml → ...InitialAccess/T1566.002_zipped_iso_v1.yml
diff --git a/...InitialAccess/T1566.002_zipped_vbs_v1.yml → ...InitialAccess/T1566.002_zipped_vbs_v1.yml b/...InitialAccess/T1566.002_zipped_vbs_v1.yml → ...InitialAccess/T1566.002_zipped_vbs_v1.yml
diff --git a/...iques/InitialAccess/T1621_mfa_spam_v1.yml → ...iques/InitialAccess/T1621_mfa_spam_v1.yml b/...iques/InitialAccess/T1621_mfa_spam_v1.yml → ...iques/InitialAccess/T1621_mfa_spam_v1.yml
diff --git a/...ques/LateralMovement/T1021.001_rdp_v2.yml → ...ques/LateralMovement/T1021.001_rdp_v2.yml b/...ques/LateralMovement/T1021.001_rdp_v2.yml → ...ques/LateralMovement/T1021.001_rdp_v2.yml
diff --git a/...s/LateralMovement/T1021.003_wmipcc_v1.yml → ...s/LateralMovement/T1021.003_wmipcc_v1.yml b/...s/LateralMovement/T1021.003_wmipcc_v1.yml → ...s/LateralMovement/T1021.003_wmipcc_v1.yml
diff --git a/...ques/Persistence/T1053.005_schtask_v7.yml → ...ques/Persistence/T1053.005_schtask_v7.yml b/...ques/Persistence/T1053.005_schtask_v7.yml → ...ques/Persistence/T1053.005_schtask_v7.yml
diff --git a/...ques/Persistence/T1098.005_aadjoin_v1.yml → ...ques/Persistence/T1098.005_aadjoin_v1.yml b/...ques/Persistence/T1098.005_aadjoin_v1.yml → ...ques/Persistence/T1098.005_aadjoin_v1.yml
diff --git a/...ersistence/T1136.001_newlocaladmin_v1.yml → ...ersistence/T1136.001_newlocaladmin_v1.yml b/...ersistence/T1136.001_newlocaladmin_v1.yml → ...ersistence/T1136.001_newlocaladmin_v1.yml
diff --git a/...rsistence/T1543.003_newservice_reg_v1.yml → ...rsistence/T1543.003_newservice_reg_v1.yml b/...rsistence/T1543.003_newservice_reg_v1.yml → ...rsistence/T1543.003_newservice_reg_v1.yml
diff --git a/fs-index-2024/CHANGELOG.md b/fs-index-2024/CHANGELOG.md
@@ -0,0 +1,4 @@
+# v1.0 (January 2024)
+
+- Initial release
+
diff --git a/fs-index-2024/REQUIREMENTS.md b/fs-index-2024/REQUIREMENTS.md
@@ -0,0 +1,39 @@
+# Infrastructure
+
+- Mail server/relay to send emails
+- Proxy/VPN 
+- Proxy/VPN in non-standard geolocation
+- HTTP/S file hosting server 
+- Command-and-control server(s) with HTTPS and HTTP channels
+- Accounts for : Cloud storage provider (exfil), remote assistance service (if applicable)
+- C3, or similar server for C2 over a webservice (and appropriate credentials for that service)
+- Domain(s) and certificate(s) for infrastructure
+
+# Payloads
+
+|#|Test Case|Payload|Notes|
+|---|---|---|---|
+|1|Attachment - Zipped macro|Macro-enabled Office doc in ZIP||
+|2|Attachment - ISO|ISO||
+|3|Load known-abusable kernel driver|Windows driver|refer to notebook for example drivers + hashes|
+|4|DLL execution using Rundll32|DLL||
+|5|Sideload a DLL into a legitimate application|DLL|can be shared with #4 as long as exported functions are as expected|
+|6|Register Security Service Provider (SSP) in LSASS|SSP DLL|refer to notebook for instructions on creating DLL|
+|7|<Exfiltration>|Sensitive data|Use dlptest.com for sample data|
+|8|Macro - Remote Template|Office document that loads remotely-hosted macro-enabled template||
+
+# Tools/Scripts
+
+- Remote assistance tool such as TeamViewer, GoTo, or AnyConnect
+- SharpHound : https://github.com/BloodHoundAD/SharpHound
+- Net Scan : https://www.softperfect.com/products/networkscanner/
+- C3 : https://github.com/WithSecureLabs/C3
+- Mimikatz : https://github.com/gentilkiwi/mimikatz
+- Nanodump : https://github.com/fortra/nanodump
+- Rubeus : https://github.com/GhostPack/Rubeus
+- SharpDPAPI : https://github.com/GhostPack/SharpDPAPI
+- ProcDump : https://learn.microsoft.com/en-us/sysinternals/downloads/procdump
+- File encryptor : https://github.com/2XXE-SRA/payload_resources/tree/master/coldencryptor
+- AADInternals : https://github.com/Gerenios/AADInternals
+
+