An overview of commit and contributor trends.
Timeline
Per Year
Latest commit date: 2022-01-19
| Commits |
16 |
394 |
505 |
57 |
166 |
| Contributors |
3 |
30 |
29 |
16 |
20 |
| 2022 | 2021 | 2020 | 2019 | 2018 |
Per Month
Latest commit date: 2022-01-19
| Commits |
16 |
10 |
4 |
13 |
6 |
48 |
50 |
60 |
34 |
18 |
39 |
39 |
73 |
62 |
49 |
43 |
46 |
55 |
90 |
50 |
39 |
68 |
0 |
0 |
| Contributors |
3 |
4 |
2 |
4 |
3 |
7 |
12 |
7 |
6 |
5 |
10 |
8 |
11 |
8 |
6 |
6 |
7 |
7 |
8 |
8 |
5 |
7 |
0 |
0 |
| 2022 01 |
2021 12 |
2021 11 |
2021 10 |
2021 09 |
2021 08 |
2021 07 |
2021 06 |
2021 05 |
2021 04 |
2021 03 |
2021 02 |
2021 01 |
2020 12 |
2020 11 |
2020 10 |
2020 09 |
2020 08 |
2020 07 |
2020 06 |
2020 05 |
2020 04 |
2020 03 |
2020 02 |
Per Week
Latest commit date: 2022-01-19
| Commits |
3 |
13 |
0 |
0 |
0 |
3 |
7 |
0 |
0 |
0 |
0 |
4 |
2 |
7 |
2 |
2 |
1 |
4 |
1 |
0 |
0 |
0 |
19 |
29 |
0 |
5 |
18 |
4 |
7 |
16 |
16 |
3 |
12 |
29 |
3 |
13 |
18 |
0 |
1 |
3 |
2 |
0 |
12 |
8 |
2 |
10 |
19 |
8 |
17 |
1 |
13 |
42 |
6 |
11 |
14 |
7 |
30 |
22 |
3 |
0 |
0 |
3 |
11 |
35 |
14 |
9 |
5 |
15 |
4 |
3 |
1 |
10 |
33 |
11 |
10 |
5 |
24 |
8 |
18 |
33 |
30 |
3 |
24 |
11 |
8 |
5 |
12 |
1 |
18 |
2 |
7 |
65 |
1 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
| Contributors |
1 |
3 |
0 |
0 |
0 |
2 |
2 |
0 |
0 |
0 |
0 |
2 |
2 |
2 |
2 |
1 |
1 |
2 |
1 |
0 |
0 |
0 |
5 |
4 |
0 |
4 |
5 |
4 |
3 |
5 |
5 |
2 |
4 |
2 |
2 |
4 |
6 |
0 |
1 |
2 |
2 |
0 |
2 |
4 |
2 |
6 |
5 |
4 |
4 |
1 |
4 |
5 |
3 |
4 |
6 |
2 |
4 |
5 |
2 |
0 |
0 |
2 |
2 |
5 |
3 |
3 |
3 |
1 |
2 |
2 |
1 |
3 |
5 |
4 |
3 |
2 |
4 |
4 |
2 |
4 |
6 |
2 |
3 |
4 |
4 |
3 |
2 |
1 |
3 |
1 |
3 |
5 |
1 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
| 2022 01 17 |
2022 01 10 |
2022 01 03 |
2021 12 27 |
2021 12 20 |
2021 12 13 |
2021 12 06 |
2021 11 29 |
2021 11 22 |
2021 11 15 |
2021 11 08 |
2021 11 01 |
2021 10 25 |
2021 10 18 |
2021 10 11 |
2021 10 04 |
2021 09 27 |
2021 09 20 |
2021 09 13 |
2021 09 06 |
2021 08 30 |
2021 08 23 |
2021 08 16 |
2021 08 09 |
2021 08 02 |
2021 07 26 |
2021 07 19 |
2021 07 12 |
2021 07 05 |
2021 06 28 |
2021 06 21 |
2021 06 14 |
2021 06 07 |
2021 05 31 |
2021 05 24 |
2021 05 17 |
2021 05 10 |
2021 05 03 |
2021 04 26 |
2021 04 19 |
2021 04 12 |
2021 04 05 |
2021 03 29 |
2021 03 22 |
2021 03 15 |
2021 03 08 |
2021 03 01 |
2021 02 22 |
2021 02 15 |
2021 02 08 |
2021 02 01 |
2021 01 25 |
2021 01 18 |
2021 01 11 |
2021 01 04 |
2020 12 28 |
2020 12 21 |
2020 12 14 |
2020 12 07 |
2020 11 30 |
2020 11 23 |
2020 11 16 |
2020 11 09 |
2020 11 02 |
2020 10 26 |
2020 10 19 |
2020 10 12 |
2020 10 05 |
2020 09 28 |
2020 09 21 |
2020 09 14 |
2020 09 07 |
2020 08 31 |
2020 08 24 |
2020 08 17 |
2020 08 10 |
2020 08 03 |
2020 07 27 |
2020 07 20 |
2020 07 13 |
2020 07 06 |
2020 06 29 |
2020 06 22 |
2020 06 15 |
2020 06 08 |
2020 06 01 |
2020 05 25 |
2020 05 18 |
2020 05 11 |
2020 05 04 |
2020 04 27 |
2020 04 20 |
2020 04 13 |
2020 04 06 |
2020 03 30 |
2020 03 23 |
2020 03 16 |
2020 03 09 |
2020 03 02 |
2020 02 24 |
2020 02 17 |
2020 02 10 |
2020 02 03 |
2020 01 27 |
Per Day
Latest commit date: 2022-01-19
| Commits |
3 |
0 |
0 |
7 |
0 |
0 |
0 |
0 |
6 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
7 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
4 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
1 |
6 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
4 |
0 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
6 |
12 |
0 |
0 |
0 |
0 |
6 |
12 |
11 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
1 |
0 |
0 |
2 |
0 |
0 |
0 |
6 |
6 |
0 |
6 |
1 |
0 |
0 |
2 |
0 |
0 |
1 |
0 |
0 |
5 |
2 |
0 |
0 |
0 |
0 |
2 |
8 |
6 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
4 |
7 |
3 |
1 |
0 |
0 |
1 |
1 |
0 |
0 |
0 |
0 |
7 |
0 |
2 |
2 |
1 |
0 |
0 |
0 |
29 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
3 |
0 |
0 |
0 |
0 |
1 |
2 |
10 |
0 |
0 |
0 |
2 |
4 |
3 |
5 |
4 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
2 |
1 |
1 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
7 |
0 |
0 |
5 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
5 |
2 |
1 |
1 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
9 |
1 |
0 |
0 |
2 |
3 |
12 |
0 |
2 |
1 |
0 |
0 |
5 |
0 |
0 |
2 |
3 |
0 |
1 |
3 |
1 |
0 |
9 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
2 |
0 |
1 |
0 |
0 |
3 |
7 |
0 |
0 |
2 |
2 |
22 |
16 |
0 |
0 |
0 |
0 |
0 |
0 |
| Contributors |
1 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
1 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
2 |
3 |
0 |
0 |
0 |
0 |
3 |
2 |
3 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
1 |
0 |
0 |
2 |
0 |
0 |
0 |
2 |
3 |
0 |
2 |
1 |
0 |
0 |
2 |
0 |
0 |
1 |
0 |
0 |
2 |
1 |
0 |
0 |
0 |
0 |
2 |
3 |
4 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
3 |
2 |
2 |
1 |
0 |
0 |
1 |
1 |
0 |
0 |
0 |
0 |
2 |
0 |
2 |
2 |
1 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
0 |
0 |
0 |
0 |
1 |
2 |
4 |
0 |
0 |
0 |
2 |
3 |
3 |
2 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
2 |
1 |
1 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
1 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
2 |
2 |
1 |
1 |
0 |
1 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
0 |
6 |
1 |
0 |
0 |
1 |
1 |
5 |
0 |
1 |
1 |
0 |
0 |
2 |
0 |
0 |
2 |
1 |
0 |
1 |
2 |
1 |
0 |
1 |
0 |
0 |
1 |
0 |
0 |
0 |
0 |
1 |
0 |
1 |
0 |
0 |
2 |
2 |
0 |
0 |
2 |
2 |
2 |
2 |
0 |
0 |
0 |
0 |
0 |
0 |
| 2022 01 19 |
2022 01 18 |
2022 01 17 |
2022 01 16 |
2022 01 15 |
2022 01 14 |
2022 01 13 |
2022 01 12 |
2022 01 11 |
2022 01 10 |
2022 01 09 |
2022 01 08 |
2022 01 07 |
2022 01 06 |
2022 01 05 |
2022 01 04 |
2022 01 03 |
2022 01 02 |
2022 01 01 |
2021 12 31 |
2021 12 30 |
2021 12 29 |
2021 12 28 |
2021 12 27 |
2021 12 26 |
2021 12 25 |
2021 12 24 |
2021 12 23 |
2021 12 22 |
2021 12 21 |
2021 12 20 |
2021 12 19 |
2021 12 18 |
2021 12 17 |
2021 12 16 |
2021 12 15 |
2021 12 14 |
2021 12 13 |
2021 12 12 |
2021 12 11 |
2021 12 10 |
2021 12 09 |
2021 12 08 |
2021 12 07 |
2021 12 06 |
2021 12 05 |
2021 12 04 |
2021 12 03 |
2021 12 02 |
2021 12 01 |
2021 11 30 |
2021 11 29 |
2021 11 28 |
2021 11 27 |
2021 11 26 |
2021 11 25 |
2021 11 24 |
2021 11 23 |
2021 11 22 |
2021 11 21 |
2021 11 20 |
2021 11 19 |
2021 11 18 |
2021 11 17 |
2021 11 16 |
2021 11 15 |
2021 11 14 |
2021 11 13 |
2021 11 12 |
2021 11 11 |
2021 11 10 |
2021 11 09 |
2021 11 08 |
2021 11 07 |
2021 11 06 |
2021 11 05 |
2021 11 04 |
2021 11 03 |
2021 11 02 |
2021 11 01 |
2021 10 31 |
2021 10 30 |
2021 10 29 |
2021 10 28 |
2021 10 27 |
2021 10 26 |
2021 10 25 |
2021 10 24 |
2021 10 23 |
2021 10 22 |
2021 10 21 |
2021 10 20 |
2021 10 19 |
2021 10 18 |
2021 10 17 |
2021 10 16 |
2021 10 15 |
2021 10 14 |
2021 10 13 |
2021 10 12 |
2021 10 11 |
2021 10 10 |
2021 10 09 |
2021 10 08 |
2021 10 07 |
2021 10 06 |
2021 10 05 |
2021 10 04 |
2021 10 03 |
2021 10 02 |
2021 10 01 |
2021 09 30 |
2021 09 29 |
2021 09 28 |
2021 09 27 |
2021 09 26 |
2021 09 25 |
2021 09 24 |
2021 09 23 |
2021 09 22 |
2021 09 21 |
2021 09 20 |
2021 09 19 |
2021 09 18 |
2021 09 17 |
2021 09 16 |
2021 09 15 |
2021 09 14 |
2021 09 13 |
2021 09 12 |
2021 09 11 |
2021 09 10 |
2021 09 09 |
2021 09 08 |
2021 09 07 |
2021 09 06 |
2021 09 05 |
2021 09 04 |
2021 09 03 |
2021 09 02 |
2021 09 01 |
2021 08 31 |
2021 08 30 |
2021 08 29 |
2021 08 28 |
2021 08 27 |
2021 08 26 |
2021 08 25 |
2021 08 24 |
2021 08 23 |
2021 08 22 |
2021 08 21 |
2021 08 20 |
2021 08 19 |
2021 08 18 |
2021 08 17 |
2021 08 16 |
2021 08 15 |
2021 08 14 |
2021 08 13 |
2021 08 12 |
2021 08 11 |
2021 08 10 |
2021 08 09 |
2021 08 08 |
2021 08 07 |
2021 08 06 |
2021 08 05 |
2021 08 04 |
2021 08 03 |
2021 08 02 |
2021 08 01 |
2021 07 31 |
2021 07 30 |
2021 07 29 |
2021 07 28 |
2021 07 27 |
2021 07 26 |
2021 07 25 |
2021 07 24 |
2021 07 23 |
2021 07 22 |
2021 07 21 |
2021 07 20 |
2021 07 19 |
2021 07 18 |
2021 07 17 |
2021 07 16 |
2021 07 15 |
2021 07 14 |
2021 07 13 |
2021 07 12 |
2021 07 11 |
2021 07 10 |
2021 07 09 |
2021 07 08 |
2021 07 07 |
2021 07 06 |
2021 07 05 |
2021 07 04 |
2021 07 03 |
2021 07 02 |
2021 07 01 |
2021 06 30 |
2021 06 29 |
2021 06 28 |
2021 06 27 |
2021 06 26 |
2021 06 25 |
2021 06 24 |
2021 06 23 |
2021 06 22 |
2021 06 21 |
2021 06 20 |
2021 06 19 |
2021 06 18 |
2021 06 17 |
2021 06 16 |
2021 06 15 |
2021 06 14 |
2021 06 13 |
2021 06 12 |
2021 06 11 |
2021 06 10 |
2021 06 09 |
2021 06 08 |
2021 06 07 |
2021 06 06 |
2021 06 05 |
2021 06 04 |
2021 06 03 |
2021 06 02 |
2021 06 01 |
2021 05 31 |
2021 05 30 |
2021 05 29 |
2021 05 28 |
2021 05 27 |
2021 05 26 |
2021 05 25 |
2021 05 24 |
2021 05 23 |
2021 05 22 |
2021 05 21 |
2021 05 20 |
2021 05 19 |
2021 05 18 |
2021 05 17 |
2021 05 16 |
2021 05 15 |
2021 05 14 |
2021 05 13 |
2021 05 12 |
2021 05 11 |
2021 05 10 |
2021 05 09 |
2021 05 08 |
2021 05 07 |
2021 05 06 |
2021 05 05 |
2021 05 04 |
2021 05 03 |
2021 05 02 |
2021 05 01 |
2021 04 30 |
2021 04 29 |
2021 04 28 |
2021 04 27 |
2021 04 26 |
2021 04 25 |
2021 04 24 |
2021 04 23 |
2021 04 22 |
2021 04 21 |
2021 04 20 |
2021 04 19 |
2021 04 18 |
2021 04 17 |
2021 04 16 |
2021 04 15 |
2021 04 14 |
2021 04 13 |
2021 04 12 |
2021 04 11 |
2021 04 10 |
2021 04 09 |
2021 04 08 |
2021 04 07 |
2021 04 06 |
2021 04 05 |
2021 04 04 |
2021 04 03 |
2021 04 02 |
2021 04 01 |
2021 03 31 |
2021 03 30 |
2021 03 29 |
2021 03 28 |
2021 03 27 |
2021 03 26 |
2021 03 25 |
2021 03 24 |
2021 03 23 |
2021 03 22 |
2021 03 21 |
2021 03 20 |
2021 03 19 |
2021 03 18 |
2021 03 17 |
2021 03 16 |
2021 03 15 |
2021 03 14 |
2021 03 13 |
2021 03 12 |
2021 03 11 |
2021 03 10 |
2021 03 09 |
2021 03 08 |
2021 03 07 |
2021 03 06 |
2021 03 05 |
2021 03 04 |
2021 03 03 |
2021 03 02 |
2021 03 01 |
2021 02 28 |
2021 02 27 |
2021 02 26 |
2021 02 25 |
2021 02 24 |
2021 02 23 |
2021 02 22 |
2021 02 21 |
2021 02 20 |
2021 02 19 |
2021 02 18 |
2021 02 17 |
2021 02 16 |
2021 02 15 |
2021 02 14 |
2021 02 13 |
2021 02 12 |
2021 02 11 |
2021 02 10 |
2021 02 09 |
2021 02 08 |
2021 02 07 |
2021 02 06 |
2021 02 05 |
2021 02 04 |
2021 02 03 |
2021 02 02 |
2021 02 01 |
2021 01 31 |
2021 01 30 |
2021 01 29 |
2021 01 28 |
2021 01 27 |
2021 01 26 |
2021 01 25 |
2021 01 24 |
2021 01 23 |
2021 01 22 |
2021 01 21 |
2021 01 20 |
Contributors
Recent Contributors (9 = 3 veterans + 6 rookies)
Contributed in past 6 months (a rookie = the first contribution in past year)
Past 30 days (3):
Past 31 to 90 days (2):
Past 91 to 180 days (4):
Historical Contributors (68)
Last contributed more than 6 months ago
Contributors Matrix (Per Month)
| Commits (3m) |
Commit Days |
3
|
4
|
2
|
4
|
3
|
7
|
12
|
7
|
6
|
5
|
10
|
8
|
11
|
8
|
6
|
6
|
7
|
7
|
8
|
8
|
5
|
7
|
-
|
-
|
3
|
|
| 63594865+tali-ash@users.noreply.github.com | 12 | 100 |
|
|
-
|
|
-
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
-
|
-
|
-
|
| 79610537+dreadphones@users.noreply.github.com | 12 | 21 |
|
|
|
|
|
|
|
|
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 47709940+endisphotic@users.noreply.github.com | 2 | 29 |
|
|
-
|
|
|
|
|
|
|
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 40626732+danaim1@users.noreply.github.com | 1 | 3 |
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
| 38123224+mcyr5@users.noreply.github.com | 3 | 2 |
-
|
-
|
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 64156578+mjmelone@users.noreply.github.com | - | 48 |
-
|
-
|
-
|
|
|
-
|
|
-
|
|
|
-
|
|
|
|
|
|
|
|
|
|
|
|
-
|
-
|
-
|
| 56367954+alimajalt@users.noreply.github.com | - | 7 |
-
|
-
|
-
|
-
|
-
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| Iveco@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| iveco@gmx.net | - | 1 |
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| Dolcita.Montemayor@microsoft.com | - | 10 |
-
|
-
|
-
|
-
|
-
|
-
|
|
|
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 45784740+YulelogPagoda@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 66640150+Shivammalaviya@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| yujiao@microsoft.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| powell.mike@gmail.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| v-maave@microsoft.com | - | 47 |
-
|
-
|
-
|
-
|
-
|
-
|
|
|
|
-
|
|
|
|
|
|
|
|
|
|
|
|
-
|
-
|
-
|
-
|
| 66005183+darioongit@users.noreply.github.com | - | 8 |
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
|
|
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| rony_123@protonmail.ch | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 66407692+YoshihiroIchinose@users.noreply.github.com | - | 5 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| HeathL17@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 65675989+julihooper@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| louie.mayor@microsoft.com | - | 13 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
|
|
-
|
|
|
|
-
|
-
|
-
|
| 23354952+Dylan-J@users.noreply.github.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| orshemesh@microsoft.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| anvascon@microsoft.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
| david.kasabji@gmail.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| mehmetergene@gmail.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| blstrom@microsoft.com | - | 5 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 47076035+pawp81@users.noreply.github.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
| 379437+bstrom@users.noreply.github.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| stesell@microsoft.com | - | 4 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| talma@microsoft.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| vboyev@gmail.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| martyavedon@gmail.com | - | 7 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
|
|
|
|
|
-
|
-
|
-
|
-
|
-
|
| 33558203+JesseEsquivel@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| alex.verboon@basevision.ch | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| maarten@goet.net | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| billy_sec@pm.me | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
|
-
|
-
|
-
|
| 48328018+AntoineJo@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
| insider-threat-feedback@cert.org | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
-
|
| 51508845+MiladMSFT@users.noreply.github.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
|
-
|
-
|
-
|
| 56391590+morRubin@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
| m@manuelhauch.de | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
| manuel.hauch@microsoft.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
-
|
| ronny.de.jong@outlook.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
-
|
| rosenmoore12@gmail.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
-
|
-
|
-
|
| 52788195+pasilva-msft@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
| makislev@microsoft.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
|
| 24293001+mattiasborg82@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| matt@chromeweb.com | - | 7 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 55390762+ItaiZur1@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 28117568+docbrown1981@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 31686674+meni-braun@users.noreply.github.com | - | 5 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| antonio.vasconcelos@gmail.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| kevbollengier@gmail.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| jan@geisbauer.de | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 51991841+sco-sim@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 49073073+SpinmanUK@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| hritter@microsoft.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 48090227+TheRealEricOlson@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 39497402+bulbafett@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 33941668+TomerAlpert@users.noreply.github.com | - | 43 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| johnla@microsoft.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 42285038+miflower@users.noreply.github.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 40575644+jing-microsoft@users.noreply.github.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| milada@microsoft.com | - | 5 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| oh.jeongwook@gmail.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 40007564+jobaror@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| rick-bryant@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| mwhamiltonut@gmail.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| macapara@microsoft.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 37715501+elflorio@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 37783395+aprakash13@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 37699907+GregCottingham@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| talpert@microsoft.com | - | 3 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 37658792+JKSG@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| 33941668+tomeralpert@users.noreply.github.com | - | 2 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| microsoftopensource@users.noreply.github.com | - | 1 |
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
-
|
| Commits |
|
||||||||||||||
| Contributors |
|
77 contributors (1,138 commits):
| # | Contributor |
First Commit |
Latest Commit |
Commits Count |
File Updates (per extension) |
|---|---|---|---|---|---|
| 1. | 63594865+tali-ash@users.noreply.github.com | 2020-04-22 | 2022-01-19 | 359 (31%) | md (320), txt (271), csl (39), (3), ipynb (3) |
| 2. | v-maave@microsoft.com | 2020-05-14 | 2021-07-09 | 120 (10%) | md (321), txt (1), (1) |
| 3. | 33941668+TomerAlpert@users.noreply.github.com | 2018-03-20 | 2018-12-04 | 110 (9%) | txt (104), (14), md (11) |
| 4. | 64156578+mjmelone@users.noreply.github.com | 2020-04-22 | 2021-10-11 | 99 (8%) | md (55), csl (40), txt (4) |
| 5. | 47709940+endisphotic@users.noreply.github.com | 2021-02-12 | 2022-01-11 | 80 (7%) | md (105), txt (13), (8) |
| 6. | 79610537+dreadphones@users.noreply.github.com | 2021-03-09 | 2022-01-11 | 54 (4%) | md (50), (4) |
| 7. | 66005183+darioongit@users.noreply.github.com | 2020-12-22 | 2021-07-08 | 29 (2%) | md (19), txt (10) |
| 8. | louie.mayor@microsoft.com | 2018-04-03 | 2021-03-05 | 23 (2%) | md (61), txt (25) |
| 9. | 56367954+alimajalt@users.noreply.github.com | 2021-07-29 | 2021-08-18 | 22 (1%) | md (20), (2) |
| 10. | 66407692+YoshihiroIchinose@users.noreply.github.com | 2020-10-21 | 2021-06-09 | 22 (1%) | md (20), (2) |
| 11. | jan@geisbauer.de | 2019-05-29 | 2019-06-19 | 20 (1%) | txt (20) |
| 12. | martyavedon@gmail.com | 2020-06-12 | 2020-11-04 | 17 (1%) | md (17) |
| 13. | Dolcita.Montemayor@microsoft.com | 2021-03-09 | 2021-07-30 | 13 (1%) | md (69) |
| 14. | matt@chromeweb.com | 2018-07-19 | 2019-11-06 | 12 (1%) | txt (14) |
| 15. | 31686674+meni-braun@users.noreply.github.com | 2018-03-19 | 2019-09-25 | 10 (<1%) | txt (11), md (2), (1) |
| 16. | stesell@microsoft.com | 2020-12-28 | 2021-01-11 | 7 (<1%) | md (9) |
| 17. | 38123224+mcyr5@users.noreply.github.com | 2021-08-12 | 2021-11-02 | 6 (<1%) | md (6) |
| 18. | milada@microsoft.com | 2018-07-14 | 2018-08-14 | 6 (<1%) | txt (5), (1) |
| 19. | 40626732+danaim1@users.noreply.github.com | 2019-06-19 | 2021-12-15 | 5 (<1%) | txt (63), (1) |
| 20. | Iveco@users.noreply.github.com | 2021-08-17 | 2021-08-17 | 5 (<1%) | md (5) |
| 21. | blstrom@microsoft.com | 2020-12-17 | 2021-01-19 | 5 (<1%) | md (6) |
| 22. | 40575644+jing-microsoft@users.noreply.github.com | 2018-08-14 | 2018-08-27 | 5 (<1%) | txt (5) |
| 23. | mwhamiltonut@gmail.com | 2018-04-13 | 2018-04-27 | 5 (<1%) | txt (9) |
| 24. | talpert@microsoft.com | 2018-03-20 | 2018-03-22 | 5 (<1%) | txt (19), md (1) |
| 25. | 47076035+pawp81@users.noreply.github.com | 2020-07-13 | 2021-01-18 | 4 (<1%) | md (4) |
| 26. | 48328018+AntoineJo@users.noreply.github.com | 2020-07-10 | 2020-07-29 | 4 (<1%) | txt (4) |
| 27. | 56391590+morRubin@users.noreply.github.com | 2020-06-24 | 2020-06-30 | 4 (<1%) | md (9) |
| 28. | ronny.de.jong@outlook.com | 2020-05-28 | 2020-05-28 | 4 (<1%) | txt (4) |
| 29. | antonio.vasconcelos@gmail.com | 2019-04-03 | 2019-09-25 | 4 (<1%) | txt (3), (1) |
| 30. | 45784740+YulelogPagoda@users.noreply.github.com | 2021-07-01 | 2021-07-21 | 3 (<1%) | md (2), (1) |
| 31. | 23354952+Dylan-J@users.noreply.github.com | 2021-01-06 | 2021-03-03 | 3 (<1%) | md (3) |
| 32. | 379437+bstrom@users.noreply.github.com | 2020-12-23 | 2021-01-15 | 3 (<1%) | md (39) |
| 33. | alex.verboon@basevision.ch | 2019-04-16 | 2020-09-22 | 3 (<1%) | txt (3) |
| 34. | 51508845+MiladMSFT@users.noreply.github.com | 2020-04-22 | 2020-07-06 | 3 (<1%) | md (2), pdf (2) |
| 35. | 55390762+ItaiZur1@users.noreply.github.com | 2019-10-24 | 2019-10-28 | 3 (<1%) | md (3) |
| 36. | 51991841+sco-sim@users.noreply.github.com | 2019-06-19 | 2019-06-19 | 3 (<1%) | txt (5) |
| 37. | johnla@microsoft.com | 2018-03-20 | 2018-12-04 | 3 (<1%) | txt (2), ipynb (1) |
| 38. | 42285038+miflower@users.noreply.github.com | 2018-08-21 | 2018-10-10 | 3 (<1%) | txt (3) |
| 39. | 33941668+tomeralpert@users.noreply.github.com | 2018-03-19 | 2018-03-20 | 3 (<1%) | txt (7) |
| 40. | 66640150+Shivammalaviya@users.noreply.github.com | 2021-07-19 | 2021-07-21 | 2 (<1%) | (2) |
| 41. | rony_123@protonmail.ch | 2021-06-23 | 2021-06-23 | 2 (<1%) | md (2) |
| 42. | anvascon@microsoft.com | 2020-04-20 | 2021-02-17 | 2 (<1%) | txt (2) |
| 43. | billy_sec@pm.me | 2020-04-09 | 2020-08-25 | 2 (<1%) | txt (2) |
| 44. | m@manuelhauch.de | 2019-12-11 | 2020-06-19 | 2 (<1%) | md (1), txt (1) |
| 45. | kevbollengier@gmail.com | 2019-09-17 | 2019-09-17 | 2 (<1%) | (2) |
| 46. | oh.jeongwook@gmail.com | 2018-04-05 | 2018-06-22 | 2 (<1%) | txt (2) |
| 47. | 40007564+jobaror@users.noreply.github.com | 2018-06-06 | 2018-06-07 | 2 (<1%) | txt (1), (1) |
| 48. | macapara@microsoft.com | 2018-03-20 | 2018-04-03 | 2 (<1%) | md (2) |
| 49. | 37715501+elflorio@users.noreply.github.com | 2018-03-24 | 2018-03-27 | 2 (<1%) | txt (2) |
| 50. | microsoftopensource@users.noreply.github.com | 2018-03-18 | 2018-03-18 | 2 (<1%) | md (1), (1) |
| 51. | iveco@gmx.net | 2021-08-17 | 2021-08-17 | 1 (<1%) | md (1) |
| 52. | yujiao@microsoft.com | 2021-07-15 | 2021-07-15 | 1 (<1%) | md (1) |
| 53. | powell.mike@gmail.com | 2021-07-12 | 2021-07-12 | 1 (<1%) | md (1) |
| 54. | HeathL17@users.noreply.github.com | 2021-03-23 | 2021-03-23 | 1 (<1%) | md (1) |
| 55. | 65675989+julihooper@users.noreply.github.com | 2021-03-19 | 2021-03-19 | 1 (<1%) | md (1) |
| 56. | orshemesh@microsoft.com | 2021-02-22 | 2021-02-22 | 1 (<1%) | txt (12) |
| 57. | david.kasabji@gmail.com | 2021-01-29 | 2021-01-29 | 1 (<1%) | txt (1) |
| 58. | mehmetergene@gmail.com | 2021-01-28 | 2021-01-28 | 1 (<1%) | md (1) |
| 59. | talma@microsoft.com | 2020-12-16 | 2020-12-16 | 1 (<1%) | md (1) |
| 60. | vboyev@gmail.com | 2020-11-17 | 2020-11-17 | 1 (<1%) | txt (1) |
| 61. | 33558203+JesseEsquivel@users.noreply.github.com | 2020-10-13 | 2020-10-13 | 1 (<1%) | csl (1) |
| 62. | maarten@goet.net | 2020-08-31 | 2020-08-31 | 1 (<1%) | ipynb (1) |
| 63. | insider-threat-feedback@cert.org | 2020-07-29 | 2020-07-29 | 1 (<1%) | md (4) |
| 64. | manuel.hauch@microsoft.com | 2020-06-19 | 2020-06-19 | 1 (<1%) | 0-execution (1) |
| 65. | rosenmoore12@gmail.com | 2020-04-16 | 2020-04-16 | 1 (<1%) | txt (1) |
| 66. | 52788195+pasilva-msft@users.noreply.github.com | 2020-01-16 | 2020-01-16 | 1 (<1%) | txt (1) |
| 67. | makislev@microsoft.com | 2020-01-05 | 2020-01-05 | 1 (<1%) | txt (60) |
| 68. | 24293001+mattiasborg82@users.noreply.github.com | 2019-12-16 | 2019-12-16 | 1 (<1%) | txt (1) |
| 69. | 28117568+docbrown1981@users.noreply.github.com | 2019-10-22 | 2019-10-22 | 1 (<1%) | (1) |
| 70. | 49073073+SpinmanUK@users.noreply.github.com | 2019-04-03 | 2019-04-03 | 1 (<1%) | txt (1) |
| 71. | hritter@microsoft.com | 2019-04-02 | 2019-04-02 | 1 (<1%) | md (1) |
| 72. | 48090227+TheRealEricOlson@users.noreply.github.com | 2019-03-31 | 2019-03-31 | 1 (<1%) | txt (1) |
| 73. | 39497402+bulbafett@users.noreply.github.com | 2019-02-04 | 2019-02-04 | 1 (<1%) | txt (1) |
| 74. | rick-bryant@users.noreply.github.com | 2018-05-14 | 2018-05-14 | 1 (<1%) | txt (1) |
| 75. | 37783395+aprakash13@users.noreply.github.com | 2018-03-27 | 2018-03-27 | 1 (<1%) | txt (2) |
| 76. | 37699907+GregCottingham@users.noreply.github.com | 2018-03-23 | 2018-03-23 | 1 (<1%) | txt (1) |
| 77. | 37658792+JKSG@users.noreply.github.com | 2018-03-22 | 2018-03-22 | 1 (<1%) | txt (1) |
Contributor Dependencies
A contributor dependency is detected if two contributors have changed the same files in the past 35600 days.
C-median: 5.0
A half of the contributors has more than 5.0 connections, and a half has less than this number.
C-mean: 7.1
An average number of connections a contributor has with other contributors.
C-index: 9.0
There are 9.0 contributors with 9.0 or more connections.
Most Connected Contributors
| Contributor | # connections | # commits | |
|---|---|---|---|
| 1. | 63594865+tali-ash@users.noreply.github.com | 70 | 359 |
| 2. | 40626732+danaim1@users.noreply.github.com | 33 | 5 |
| 3. | makislev@microsoft.com | 33 | 1 |
| 4. | 33941668+TomerAlpert@users.noreply.github.com | 30 | 110 |
| 5. | v-maave@microsoft.com | 17 | 120 |
| 6. | 47709940+endisphotic@users.noreply.github.com | 17 | 80 |
| 7. | 31686674+meni-braun@users.noreply.github.com | 16 | 10 |
| 8. | 66005183+darioongit@users.noreply.github.com | 15 | 29 |
| 9. | louie.mayor@microsoft.com | 14 | 23 |
| 10. | talpert@microsoft.com | 14 | 5 |
| 11. | 64156578+mjmelone@users.noreply.github.com | 9 | 99 |
| 12. | 55390762+ItaiZur1@users.noreply.github.com | 9 | 3 |
| 13. | macapara@microsoft.com | 9 | 2 |
| 14. | microsoftopensource@users.noreply.github.com | 9 | 2 |
| 15. | hritter@microsoft.com | 9 | 1 |
| 16. | 79610537+dreadphones@users.noreply.github.com | 8 | 54 |
| 17. | Dolcita.Montemayor@microsoft.com | 7 | 13 |
| 18. | antonio.vasconcelos@gmail.com | 7 | 4 |
| 19. | 379437+bstrom@users.noreply.github.com | 7 | 3 |
| 20. | david.kasabji@gmail.com | 7 | 1 |
| 21. | vboyev@gmail.com | 7 | 1 |
| 22. | 39497402+bulbafett@users.noreply.github.com | 7 | 1 |
| 23. | 56367954+alimajalt@users.noreply.github.com | 6 | 22 |
| 24. | jan@geisbauer.de | 6 | 20 |
| 25. | matt@chromeweb.com | 6 | 12 |
| 26. | 40575644+jing-microsoft@users.noreply.github.com | 6 | 5 |
| 27. | 48328018+AntoineJo@users.noreply.github.com | 6 | 4 |
| 28. | anvascon@microsoft.com | 6 | 2 |
| 29. | billy_sec@pm.me | 6 | 2 |
| 30. | m@manuelhauch.de | 6 | 2 |
| 31. | 37715501+elflorio@users.noreply.github.com | 6 | 2 |
| 32. | 52788195+pasilva-msft@users.noreply.github.com | 6 | 1 |
| 33. | rick-bryant@users.noreply.github.com | 6 | 1 |
| 34. | milada@microsoft.com | 5 | 6 |
| 35. | mwhamiltonut@gmail.com | 5 | 5 |
| 36. | ronny.de.jong@outlook.com | 5 | 4 |
| 37. | oh.jeongwook@gmail.com | 5 | 2 |
| 38. | rosenmoore12@gmail.com | 5 | 1 |
| 39. | 48090227+TheRealEricOlson@users.noreply.github.com | 5 | 1 |
| 40. | 37699907+GregCottingham@users.noreply.github.com | 5 | 1 |
| 41. | martyavedon@gmail.com | 4 | 17 |
| 42. | johnla@microsoft.com | 4 | 3 |
| 43. | 42285038+miflower@users.noreply.github.com | 4 | 3 |
| 44. | 40007564+jobaror@users.noreply.github.com | 4 | 2 |
| 45. | blstrom@microsoft.com | 3 | 5 |
| 46. | 47076035+pawp81@users.noreply.github.com | 3 | 4 |
| 47. | 33941668+tomeralpert@users.noreply.github.com | 3 | 3 |
| 48. | rony_123@protonmail.ch | 3 | 2 |
| 49. | yujiao@microsoft.com | 3 | 1 |
| 50. | powell.mike@gmail.com | 3 | 1 |
| 51. | 65675989+julihooper@users.noreply.github.com | 3 | 1 |
| 52. | 49073073+SpinmanUK@users.noreply.github.com | 3 | 1 |
| 53. | 37783395+aprakash13@users.noreply.github.com | 3 | 1 |
| 54. | 66407692+YoshihiroIchinose@users.noreply.github.com | 2 | 22 |
| 55. | stesell@microsoft.com | 2 | 7 |
| 56. | 38123224+mcyr5@users.noreply.github.com | 2 | 6 |
| 57. | Iveco@users.noreply.github.com | 2 | 5 |
| 58. | 23354952+Dylan-J@users.noreply.github.com | 2 | 3 |
| 59. | iveco@gmx.net | 2 | 1 |
| 60. | HeathL17@users.noreply.github.com | 2 | 1 |
| 61. | orshemesh@microsoft.com | 2 | 1 |
| 62. | insider-threat-feedback@cert.org | 2 | 1 |
| 63. | 56391590+morRubin@users.noreply.github.com | 1 | 4 |
| 64. | 45784740+YulelogPagoda@users.noreply.github.com | 1 | 3 |
| 65. | alex.verboon@basevision.ch | 1 | 3 |
| 66. | 51508845+MiladMSFT@users.noreply.github.com | 1 | 3 |
| 67. | 51991841+sco-sim@users.noreply.github.com | 1 | 3 |
| 68. | mehmetergene@gmail.com | 1 | 1 |
| 69. | talma@microsoft.com | 1 | 1 |
| 70. | 33558203+JesseEsquivel@users.noreply.github.com | 1 | 1 |
| 71. | maarten@goet.net | 1 | 1 |
| 72. | 24293001+mattiasborg82@users.noreply.github.com | 1 | 1 |
| 73. | 28117568+docbrown1981@users.noreply.github.com | 1 | 1 |
| 74. | 37658792+JKSG@users.noreply.github.com | 1 | 1 |
| 75. | 66640150+Shivammalaviya@users.noreply.github.com | 0 | 2 |
| 76. | kevbollengier@gmail.com | 0 | 2 |
| 77. | manuel.hauch@microsoft.com | 0 | 1 |
Contributor Dependencies via Shared Files
show graph...
The number on lines shows the number of same files that both persons changed in past 35600 days.
- open 3D force graph
Contributor 1
Contributor 2
# shared files
1.
63594865+tali-ash@users.noreply.github.com
v-maave@microsoft.com
102 shared files
Execution/python-based-attacks-on-macos.md
Lateral Movement/doppelpaymer-psexec.md
Campaigns/c2-lookup-from-nonbrowser[Solorigate]..md
Campaigns/possible-affected-software-orion[Solorigate].md
Privilege escalation/cve-2019-0808-nufsys-file creation.md
Campaigns/robbinhood-driver.md
Execution/sql-server-abuse.md
Campaigns/Sysrv-botnet/tomcat-8-executing-powershell.md
Defense evasion/clear-system-logs.md
Discovery/qakbot-campaign-outlook.md
Defense evasion/ADFSDomainTrustMods[Solarigate].md
Execution/locate-shlayer-payload-decrytion-activity.md
Privilege escalation/detect-cve-2019-1069-bearlpe-exploit.md
Defense evasion/alt-data-streams.md
00-query-submission-template.md
locate-surfbuyer-downloader-decoding-activity.md
Campaigns/locate-dll-loaded-in-memory[Solorigate].md
Campaigns/solorigate-locate-dll-loaded-in-memory.md
Execution/detect-doublepulsar-execution.md
Privilege escalation/detect-cve-2019-1053-sandboxescape-exploit.md
Credential Access/doppelpaymer-procdump.md
Campaigns/solarigate-c2-lookup-response.md
Credential Access/identify-accounts-logged-on-to-endpoints-affected-by-cobalt-strike.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Execution/qakbot-campaign-suspicious-javascript.md
Command and Control/check-for-shadowhammer-activity-download-domain.md
Exploits/winrar-cve-2018-20250-file-creation.md
Execution/detect-exploitation-of-cve-2018-8653.md
Persistence/qakbot-campaign-registry-edit.md
Execution/detect-suspicious-mshta-usage.md
Campaigns/Sysrv-botnet/rce-on-vulnerable-server.md
Campaigns/oceanlotus-apt32-files.md
Discovery/doppelpaymer.md
Campaigns/solarigate-possible-affected-software-orion.md
Exfiltration/Data copied to other location than C drive.txt
README.md
Persistence/NewAppOrServicePrincipalCredential[Solarigate].md
Campaigns/solarigate-locate-dll-created-locally.md
Execution/detect-malicious-rar-extraction.md
Campaigns/known-affected-software-orion[Nobelium].md
Campaigns/Sysrv-botnet/kinsing-miner-download.md
Privilege escalation/cve-2019-0808-c2.md
Campaigns/oceanlotus-apt32-network.md
Campaigns/Sysrv-botnet/app-armor-stopped.md
Command and Control/python-use-by-ransomware-macos.md
Privilege escalation/cve-2019-0808-set-scheduled-task.md
Delivery/detect-jscript-file-creation.md
Discovery/detect-suspicious-commands-initiated-by-web-server-processes.md
Defense evasion/locate-files-possibly-signed-by-fraudulent-ecc-certificates.md
Execution/detect-web-server-exploit-doublepulsar.md
Execution/locate-surfbuyer-downloader-decoding-activity.md
Defense evasion/qakbot-campaign-self-deletion.md
Delivery/Gootkit-malware.md
Defense evasion/deleting-data-w-cipher-tool.md
Campaigns/detect-cyzfc-activity.md
Persistence/CredentialsAddAfterAdminConsentedToApp[Solorigate].md
Execution/detect-bluekeep-related-mining.md
Campaigns/Sysrv-botnet/oracle-webLogic-executing-powershell.md
Execution/detect-malcious-use-of-msiexec.md
Exploits/winrar-cve-2018-20250-ace-files.md
Campaigns/locate-dll-created-locally[Solorigate].md
Campaigns/confluence-weblogic-targeted.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Privilege escalation/detect-cve-2019-1129-byebear-exploit.md
Execution/locate-shlayer-payload-decryption-activity.md
Campaigns/launching-cmd-echo[Solorigate].md
Lateral Movement/detect-suspicious-rdp-connections.md
Campaigns/known-affected-software-orion[Solorigate].md
Campaigns/c2-lookup-response[Solorigate].md
Impact/ransom-note-creation-macos.md
Initial access/jar-attachments.md
Privilege escalation/detect-cve-2019-0973-installerbypass-exploit.md
Campaigns/robbinhood-evasion.md
Persistence/detect-prifou-pua.md
Defense evasion/hiding-java-class-file.md
Execution/office-apps-launching-wscipt.md
Privilege escalation/detect-cve-2019-0863-AngryPolarBearBug2-exploit.md
Initial access/PhishingEmailUrlRedirector.md
Command and Control/reverse-shell-ransomware-macos.md
Discovery/qakbot-campaign-esentutl.md
Defense evasion/doppelpaymer-stop-services.md
Campaigns/solarigate-launching-cmd-echo.md
Execution/jse-launched-by-word.md
Command and Control/recon-with-rundll.md
Initial access/detect-mailsniper.md
Campaigns/Sysrv-botnet/java-executing-cmd-to-run-powershell.md
Impact/turn-off-system-restore.md
Execution/launch-questd-w-osascript.md
Execution/check-for-shadowhammer-activity-implant.md
Discovery/detect-nbtscan-activity.md
Campaigns/launching-base64-powershell[Solorigate].md
Credential Access/wdigest-caching.md
Initial access/detect-bluekeep-exploitation-attempts.md
Credential Access/cobalt-strike.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Privilege escalation/locate-ALPC-local-privilege-elevation-exploit.md
Defense evasion/qakbot-campaign-process-injection.md
Campaigns/solarigate-launching-base64-powershell.md
Execution/detect-office-products-spawning-wmic.md
Campaigns/possible-affected-software-orion[Nobelium].md
...
2.
63594865+tali-ash@users.noreply.github.com
40626732+danaim1@users.noreply.github.com
60 shared files
Delivery/Open email link.txt
Campaigns/Abusing settingcontent-ms.txt
General queries/Network info of machine.txt
Campaigns/apt sofacy zebrocy.txt
Campaigns/DofoilNameCoinServerTraffic.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Execution/PowershellCommand footprint.txt
Campaigns/OceanLotus registry activity.txt
Discovery/Discover hosts doing possible network scans.txt
Execution/PowershellCommand - uncommon commands on machine.txt
Protection events/ExploitGuardNetworkProtectionEvents.txt
Exploits/AcroRd-Exploits.txt
Campaigns/apt tropictrooper.txt
General queries/Baseline Comparison.txt
Protection events/Antivirus detections.txt
Protection events/ExploitGuardStats.txt
Discovery/SMB shares discovery.txt
Persistence/Create account.txt
Execution/Malware_In_recyclebin.txt
Lateral Movement/Account brute force.txt
Delivery/Pivot from detections to related downloads.txt
Persistence/scheduled task creation.txt
Discovery/URL Detection.txt
Execution/Base64encodePEFile.txt
Fun/EmojiHunt.txt
Campaigns/Hurricane Panda activity.txt
Exfiltration/Map external devices.txt
General queries/Failed Logon Attempt.txt
Campaigns/Elise backdoor.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
General queries/Machine info from IP address.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
General queries/Network footprint.txt
Campaigns/Equation Group C2 Communication.txt
Campaigns/Judgement Panda exfil activity.txt
Campaigns/MacOceanLotusBackdoor.txt
Protection events/Windows filtering events (Firewall).txt
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
General queries/File footprint.txt
Lateral Movement/ServiceAccountsPerformingRemotePS.txt
Campaigns/APT29 thinktanks.txt
General queries/Events surrounding alert.txt
Campaigns/Cloud Hopper.txt
Campaigns/Dragon Fly.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
General queries/Alert Events from Internal IP Address.txt
Campaigns/Bear Activity GTR 2019.txt
Persistence/Accessibility Features.txt
Campaigns/APT Baby Shark.txt
Campaigns/MacOceanLotusDropper.txt
General queries/WD AV Signature and Platform Version.txt
Execution/ExecuteBase64DecodedPayload.txt
Protection events/ExploitGuardAsrDescriptions.txt
Delivery/Email link + download + SmartScreen warning.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
3.
63594865+tali-ash@users.noreply.github.com
makislev@microsoft.com
60 shared files
Delivery/Open email link.txt
Campaigns/Abusing settingcontent-ms.txt
General queries/Network info of machine.txt
Campaigns/apt sofacy zebrocy.txt
Campaigns/DofoilNameCoinServerTraffic.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Execution/PowershellCommand footprint.txt
Campaigns/OceanLotus registry activity.txt
Discovery/Discover hosts doing possible network scans.txt
Execution/PowershellCommand - uncommon commands on machine.txt
Protection events/ExploitGuardNetworkProtectionEvents.txt
Exploits/AcroRd-Exploits.txt
Campaigns/apt tropictrooper.txt
General queries/Baseline Comparison.txt
Protection events/Antivirus detections.txt
Protection events/ExploitGuardStats.txt
Discovery/SMB shares discovery.txt
Persistence/Create account.txt
Execution/Malware_In_recyclebin.txt
Lateral Movement/Account brute force.txt
Delivery/Pivot from detections to related downloads.txt
Persistence/scheduled task creation.txt
Discovery/URL Detection.txt
Execution/Base64encodePEFile.txt
Fun/EmojiHunt.txt
Campaigns/Hurricane Panda activity.txt
Exfiltration/Map external devices.txt
General queries/Failed Logon Attempt.txt
Campaigns/Elise backdoor.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
General queries/Machine info from IP address.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
General queries/Network footprint.txt
Campaigns/Equation Group C2 Communication.txt
Campaigns/Judgement Panda exfil activity.txt
Campaigns/MacOceanLotusBackdoor.txt
Protection events/Windows filtering events (Firewall).txt
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
General queries/File footprint.txt
Lateral Movement/ServiceAccountsPerformingRemotePS.txt
Campaigns/APT29 thinktanks.txt
General queries/Events surrounding alert.txt
Campaigns/Cloud Hopper.txt
Campaigns/Dragon Fly.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
General queries/Alert Events from Internal IP Address.txt
Campaigns/Bear Activity GTR 2019.txt
Persistence/Accessibility Features.txt
Campaigns/APT Baby Shark.txt
Campaigns/MacOceanLotusDropper.txt
General queries/WD AV Signature and Platform Version.txt
Execution/ExecuteBase64DecodedPayload.txt
Protection events/ExploitGuardAsrDescriptions.txt
Delivery/Email link + download + SmartScreen warning.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
4.
40626732+danaim1@users.noreply.github.com
makislev@microsoft.com
60 shared files
Delivery/Open email link.txt
Campaigns/Abusing settingcontent-ms.txt
General queries/Network info of machine.txt
Campaigns/apt sofacy zebrocy.txt
Campaigns/DofoilNameCoinServerTraffic.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Execution/PowershellCommand footprint.txt
Campaigns/OceanLotus registry activity.txt
Discovery/Discover hosts doing possible network scans.txt
Execution/PowershellCommand - uncommon commands on machine.txt
Protection events/ExploitGuardNetworkProtectionEvents.txt
Exploits/AcroRd-Exploits.txt
Campaigns/apt tropictrooper.txt
General queries/Baseline Comparison.txt
Protection events/Antivirus detections.txt
Protection events/ExploitGuardStats.txt
Discovery/SMB shares discovery.txt
Persistence/Create account.txt
Execution/Malware_In_recyclebin.txt
Lateral Movement/Account brute force.txt
Delivery/Pivot from detections to related downloads.txt
Persistence/scheduled task creation.txt
Discovery/URL Detection.txt
Execution/Base64encodePEFile.txt
Fun/EmojiHunt.txt
Campaigns/Hurricane Panda activity.txt
Exfiltration/Map external devices.txt
General queries/Failed Logon Attempt.txt
Campaigns/Elise backdoor.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
General queries/Machine info from IP address.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
General queries/Network footprint.txt
Campaigns/Equation Group C2 Communication.txt
Campaigns/Judgement Panda exfil activity.txt
Campaigns/MacOceanLotusBackdoor.txt
Protection events/Windows filtering events (Firewall).txt
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
General queries/File footprint.txt
Lateral Movement/ServiceAccountsPerformingRemotePS.txt
Campaigns/APT29 thinktanks.txt
General queries/Events surrounding alert.txt
Campaigns/Cloud Hopper.txt
Campaigns/Dragon Fly.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
General queries/Alert Events from Internal IP Address.txt
Campaigns/Bear Activity GTR 2019.txt
Persistence/Accessibility Features.txt
Campaigns/APT Baby Shark.txt
Campaigns/MacOceanLotusDropper.txt
General queries/WD AV Signature and Platform Version.txt
Execution/ExecuteBase64DecodedPayload.txt
Protection events/ExploitGuardAsrDescriptions.txt
Delivery/Email link + download + SmartScreen warning.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
5.
64156578+mjmelone@users.noreply.github.com
63594865+tali-ash@users.noreply.github.com
47 shared files
General queries/Crashing Applications.csl
Campaigns/WastedLocker.csl
Execution/File Copy and Execution.md
Webcasts/Airlift 2021 - Lets Invoke.csl
Webcasts/TrackingTheAdversary/README.md
Execution/Webserver Executing Suspicious Applications.md
Command and Control/Device network events w low count FQDN.csl
Persistence/Possible webshell drop.md
General queries/Detect Azure RemoteIP.md
Execution/Possible Ransomware Related Destruction Activity.csl
Fun/Make FolderPath Vogon Poetry.md
Lateral Movement/Network Logons with Local Accounts.md
Campaigns/Dopplepaymer In-Memory Malware Implant.csl
General queries/Firewall Policy Design Assistant.md
Execution/Detect PowerShell v2 Downgrade.md
Exfiltration/Possible File Copy to USB Drive.md
Credential Access/Private Key Files.csl
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.csl
General queries/AppLocker Policy Design Assistant.csl
Exfiltration/Password Protected Archive Creation.md
Webcasts/README.md
Troubleshooting/Connectivity Failures by Domain.md
Troubleshooting/Connectivity Failures by Device.md
Execution/Suspicious Webserver Activity.csl
Campaigns/WastedLocker Downloader.md
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.csl
General queries/Devices by DNS Suffix.csl
General queries/Crashing Applications.md
Webcasts/TrackingTheAdversary/Episode 2 - Joins.csl
Lateral Movement/Device Logons from Unknown IPs.csl
Command and Control/Connection to Rare DNS Hosts.md
Execution/Base64 Detector and Decoder.md
Execution/Detect Encoded Powershell.md
Execution/Possible Ransomware Related Destruction Activity.md
Execution/Base64 Detector and Decoder.csl
Fun/Make FolderPath Vogon Poetry.csl
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.csl
General queries/Device Count by DNS Suffix.md
General queries/AppLocker Policy Design Assistant.md
General queries/Endpoint Status Report.csl
Webcasts/l33tSpeak/l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl
Exfiltration/Password Protected Archives.csl
General queries/MD AV Signature and Platform Version.md
Lateral Movement/Non-local logons with -500 account.csl
General queries/WD AV Signature and Platform Version.txt
Campaigns/Abuse.ch Recent Threat Feed.md
General queries/Endpoint Agent Health Status Report.md
6.
Dolcita.Montemayor@microsoft.com
v-maave@microsoft.com
44 shared files
Command and Control/DNSPattern [Nobelium].md
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Nobelium].md
Persistence/CredentialsAddAfterAdminConsentedToApp[Nobelium].md
Privilege escalation/ServicePrincipalAddedToRole [Nobelium].md
Campaigns/encoded-powershell-structure-snip3.md
Discovery/SuspiciousEnumerationUsingAdfind[Nobelium].md
Command and Control/EncodedDomainURL [Nobelium].md
Campaigns/malicious-network-connectivity-snip3.md
Campaigns/locate-dll-loaded-in-memory[Nobelium].md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Campaigns/c2-lookup-response[Nobelium].md
Campaigns/snip3-encoded-powershell-structure.md
Campaigns/snip3-aviation-targeting-emails.md
Campaigns/launching-cmd-echo[Nobelium].md
Campaigns/cypherpunk-exclusive-commands.md
Collection/Anomaly of MailItemAccess by Other Users Mailbox [Nobelium].md
Campaigns/revengerat-c2-exfiltration-snip3.md
Campaigns/known-affected-software-orion[Nobelium].md
Defense evasion/MailPermissionsAddedToApplication[Nobelium].md
Campaigns/fireeye-red-team-tools-HASHs [Nobelium].md
Defense evasion/Discovering potentially tampered devices [Nobelium].md
Campaigns/detectsanboxie-function-call-snip3.md
Exfiltration/MailItemsAccessed Throttling [Nobelium].md
Defense evasion/ADFSDomainTrustMods[Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/aviation-targeting-emails-snip3.md
Campaigns/snip3-detectsanboxie-function-call.md
Persistence/NewAppOrServicePrincipalCredential[Nobelium].md
Exfiltration/Anomaly of MailItemAccess by GraphAPI [Nobelium].md
Campaigns/compromised-certificate[Nobelium].md
Campaigns/launching-base64-powershell[Nobelium].md
Exfiltration/OAuth Apps reading mail both via GraphAPI and directly [Nobelium].md
Campaigns/locate-dll-created-locally[Nobelium].md
Campaigns/jupyter-solarmarker-evasive-powershell-strings.md
Campaigns/c2-lookup-from-nonbrowser[Nobelium].md
Campaigns/jupyter-solarmarker-evasive-powershell-executions.md
Campaigns/snip3-revengerat-c2-exfiltration.md
Campaigns/cypherpunk-remote-exec-w-psexesvc.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Privilege escalation/dell-driver-vulnerability-2021.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/snip3-malicious-network-connectivity.md
Privilege escalation/Add uncommon credential type to application [Nobelium].md
Exfiltration/OAuth Apps accessing user mail via GraphAPI [Nobelium].md
7.
47709940+endisphotic@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
38 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md
Campaigns/Qakbot/Qakbot reconnaissance activities.md
Campaigns/Log4J/Alerts related to Log4j vulnerability.md
Campaigns/Macaw Ransomware/Imminent Ransomware.md
Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md
Campaigns/Bazacall/Cobalt Strike Lateral Movement
Campaigns/Macaw Ransomware/Inhibit recovery by disabling tools and functionality.md
Campaigns/Qakbot/Qakbot email theft.md
Campaigns/Log4J/Suspicious PowerShell curl flags.md
Campaigns/Bazacall/Malicious Excel Delivery.md
Campaigns/Bazacall/NTDS theft.md
Campaigns/ZLoader/Suspicious Registry Keys.md
Campaigns/Qakbot/General attempts to access local email store.md
Campaigns/Bazacall/Excel Macro Execution.md
Campaigns/Bazarloader/Zip-Doc - Creation of JPG Payload File.md
Campaigns/Bazarloader/Stolen Images Execution.md
Campaigns/Qakbot/Qakbot Craigslist Domains.md
Email Queries/Appspot Phishing Abuse.md
Campaigns/Macaw Ransomware/Use of MSBuild as LOLBin.md
Campaigns/Bazacall/Renamed Rclone Exfil.md
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
Campaigns/Bazacall/Bazacall Emails.md
Email Queries/Appspot Phishing Abuse
Campaigns/Bazacall/RunDLL Suspicious Network Connection.md
Campaigns/Macaw Ransomware/Mass account password change.md
Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md
Campaigns/StrRAT malware/StrRAT-Email-Delivery.md
Campaigns/StrRAT malware/StrRAT-Email-Delivery
Campaigns/ZLoader/Payload Delivery.md
Campaigns/Macaw Ransomware/Disable Controlled Folders.md
Campaigns/Log4J/Suspicious JScript staging comment.md
Campaigns/ZLoader/Malicious bat file.md
Campaigns/Macaw Ransomware/PSExec Attrib commands.md
Campaigns/Qakbot/Excel launching anomalous processes.md
Email Queries/PhishingEmailUrlRedirector.md
Campaigns/StrRAT malware/StrRAT-AV-Discovery.md
Campaigns/StrRAT malware/StrRAT-Malware-Persistence.md
Campaigns/Bazarloader/Zip-Doc - Word Launching MSHTA.md
8.
63594865+tali-ash@users.noreply.github.com
33941668+TomerAlpert@users.noreply.github.com
36 shared files
Delivery/Open email link.txt
Campaigns/Abusing settingcontent-ms.txt
General queries/Network info of machine.txt
Campaigns/DofoilNameCoinServerTraffic.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Execution/PowershellCommand footprint.txt
Execution/PowershellCommand - uncommon commands on machine.txt
Protection events/Antivirus detections.txt
Protection events/ExploitGuardStats.txt
Discovery/SMB shares discovery.txt
Persistence/Create account.txt
Lateral Movement/Account brute force.txt
Delivery/Pivot from detections to related downloads.txt
Fun/EmojiHunt.txt
Exfiltration/Map external devices.txt
README.md
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
General queries/Machine info from IP address.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
Campaigns/MacOceanLotusBackdoor.txt
Protection events/Windows filtering events (Firewall).txt
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
General queries/File footprint.txt
General queries/Events surrounding alert.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
Protection events/ExploitGuardAsrDescriptions.txt
Delivery/Email link + download + SmartScreen warning.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
9.
40626732+danaim1@users.noreply.github.com
33941668+TomerAlpert@users.noreply.github.com
35 shared files
Delivery/Open email link.txt
Campaigns/Abusing settingcontent-ms.txt
General queries/Network info of machine.txt
Campaigns/DofoilNameCoinServerTraffic.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Execution/PowershellCommand footprint.txt
Execution/PowershellCommand - uncommon commands on machine.txt
Protection events/Antivirus detections.txt
Protection events/ExploitGuardStats.txt
Discovery/SMB shares discovery.txt
Persistence/Create account.txt
Lateral Movement/Account brute force.txt
Delivery/Pivot from detections to related downloads.txt
Fun/EmojiHunt.txt
Exfiltration/Map external devices.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
General queries/Machine info from IP address.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
Campaigns/MacOceanLotusBackdoor.txt
Protection events/Windows filtering events (Firewall).txt
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
General queries/File footprint.txt
General queries/Events surrounding alert.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
Protection events/ExploitGuardAsrDescriptions.txt
Delivery/Email link + download + SmartScreen warning.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
10.
makislev@microsoft.com
33941668+TomerAlpert@users.noreply.github.com
35 shared files
Delivery/Open email link.txt
Campaigns/Abusing settingcontent-ms.txt
General queries/Network info of machine.txt
Campaigns/DofoilNameCoinServerTraffic.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Execution/PowershellCommand footprint.txt
Execution/PowershellCommand - uncommon commands on machine.txt
Protection events/Antivirus detections.txt
Protection events/ExploitGuardStats.txt
Discovery/SMB shares discovery.txt
Persistence/Create account.txt
Lateral Movement/Account brute force.txt
Delivery/Pivot from detections to related downloads.txt
Fun/EmojiHunt.txt
Exfiltration/Map external devices.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
General queries/Machine info from IP address.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
Campaigns/MacOceanLotusBackdoor.txt
Protection events/Windows filtering events (Firewall).txt
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
General queries/File footprint.txt
General queries/Events surrounding alert.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
Protection events/ExploitGuardAsrDescriptions.txt
Delivery/Email link + download + SmartScreen warning.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
11.
63594865+tali-ash@users.noreply.github.com
379437+bstrom@users.noreply.github.com
31 shared files
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Solorigate].md
Exfiltration/OAuth Apps reading mail both via GraphAPI and directly [Solorigate].md
Campaigns/c2-lookup-from-nonbrowser[Solorigate]..md
Campaigns/possible-affected-software-orion[Solorigate].md
Campaigns/fireeye-red-team-tools-HASHs [Solorigate].md
Privilege escalation/ServicePrincipalAddedToRole [Solorigate].md
Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].md
Defense evasion/ADFSDomainTrustMods[Solarigate].md
Persistence/Possible webshell drop.md
Campaigns/locate-dll-loaded-in-memory[Solorigate].md
Command and Control/DNSPattern [Solorigate].md
Exfiltration/Anomaly of MailItemAccess by GraphAPI [Solorigate].md
Collection/Anomaly of MailItemAccess by Other Users Mailbox [Solorigate].md
Campaigns/compromised-certificate[Solorigate].md
Command and Control/EncodedDomainURL [Solorigate].md
Persistence/NewAppOrServicePrincipalCredential[Solarigate].md
Defense evasion/UpdateStsRefreshToken[Solorigate].md
Discovery/DetectTorRelayConnectivity.md
Persistence/CredentialsAddAfterAdminConsentedToApp[Solorigate].md
Privilege escalation/Add uncommon credential type to application [Solorigate].md
Exfiltration/MailItemsAccessed Throttling [Solorigate].md
Campaigns/locate-dll-created-locally[Solorigate].md
Discovery/SuspiciousEnumerationUsingAdfind[Solarigate].md
Campaigns/launching-cmd-echo[Solorigate].md
Campaigns/known-affected-software-orion[Solorigate].md
Campaigns/c2-lookup-response[Solorigate].md
Collection/HostExportingMailboxAndRemovingExport[Solarigate].md
Defense evasion/Discovering potentially tampered devices [Solorigate].md
Exfiltration/OAuth Apps accessing user mail via GraphAPI [Solorigate].md
Campaigns/launching-base64-powershell[Solorigate].md
Campaigns/fireeye-red-team-tools-CVEs [Solorigate].md
12.
47709940+endisphotic@users.noreply.github.com
63594865+tali-ash@users.noreply.github.com
29 shared files
Network/Defender for Endpoint Telemetry.txt
Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt
General queries/MD AV Signature and Platform Version.txt
Command and Control/Device network events w low count FQDN.txt
00-query-submission-template.md
Campaigns/Bazacall/NTDS theft.md
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt
Lateral Movement/Device Logons from Unknown IPs.txt
Credential Access/Private Key Files.txt
Campaigns/Dopplepaymer In-Memory Malware Implant.txt
Ransomware/Turning off services using sc exe.md
Ransomware/IcedId Delivery.md
README.md
Ransomware/Turning off System Restore.md
Ransomware/Check for multiple signs of ransomware activity.md
Delivery/Gootkit-malware.md
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
Ransomware/Backup deletion.md
Ransomware/Stopping multiple processes using taskkill.md
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt
Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt
Lateral Movement/Non-local logons with -500 account.txt
Ransomware/Clearing of forensic evidence from event logs using wevtutil.md
Initial access/PhishingEmailUrlRedirector.md
Ransomware/Stopping processes using net stop.md
Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt
Ransomware/IcedId attachments.md
Ransomware/Deletion of data on multiple drives using cipher exe.md
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt
13.
63594865+tali-ash@users.noreply.github.com
66005183+darioongit@users.noreply.github.com
22 shared files
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Solorigate].md
Delivery/Open email link.txt
Campaigns/fireeye-red-team-tools-HASHs [Solorigate].md
Protection events/ExploitGuardBlockOfficeChildProcess.txt
M365-PowerBi Dashboard/readme.txt
General queries/Baseline Comparison.txt
Protection events/Antivirus detections.txt
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
General queries/insider-threat-detection-queries.md
Campaigns/compromised-certificate[Solorigate].md
Campaigns/known-affected-software-orion[Nobelium].md
Exfiltration/detect-exfiltration-after-termination.md
TVM/devices_with_vuln_and_users_received_payload.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/Ransomware hits healthcare - Possible compromised accounts.txt
General queries/Events surrounding alert.txt
Campaigns/Ransomware hits healthcare - Backup deletion.txt
General queries/Alert Events from Internal IP Address.txt
Credential Access/cobalt-strike.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/fireeye-red-team-tools-CVEs [Solorigate].md
Campaigns/possible-affected-software-orion[Nobelium].md
14.
Dolcita.Montemayor@microsoft.com
47709940+endisphotic@users.noreply.github.com
22 shared files
Exploits/Print Spooler RCE/Suspicious DLLs in spool folder.md
Ransomware/IcedId email delivery.md
Ransomware/Suspicious Image Load related to IcedId.md
Ransomware/Potential ransomware activity related to Cobalt Strike.md
Ransomware/Distribution from remote location.md
Ransomware/DarkSide.md
Ransomware/IcedId Delivery.md
Ransomware/Qakbot discovery activies.md
Ransomware/LaZagne Credential Theft.md
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
Ransomware/Fake Replies.md
Ransomware/HTA Startup Persistence.md
Ransomware/Suspicious Bitlocker Encryption.md
Ransomware/Gootkit File Delivery.md
Ransomware/Sticky Keys.md
Ransomware/IcedId attachments.md
Ransomware/File Backup Deletion Alerts.md
Ransomware/Suspicious Google Doc Links.md
Ransomware/Discovery for highly-privileged accounts.md
Campaigns/snip3-malicious-network-connectivity.md
Exploits/Print Spooler RCE/Suspicious files in spool folder.md
15.
63594865+tali-ash@users.noreply.github.com
jan@geisbauer.de
16 shared files
Campaigns/apt sofacy zebrocy.txt
Campaigns/OceanLotus registry activity.txt
Campaigns/apt sofacy.txt
Campaigns/apt tropictrooper.txt
Persistence/scheduled task creation.txt
Campaigns/Hurricane Panda activity.txt
Campaigns/Elise backdoor.txt
Campaigns/Equation Group C2 Communication.txt
Campaigns/Judgement Panda exfil activity.txt
Campaigns/APT29 thinktanks.txt
Campaigns/Cloud Hopper.txt
Campaigns/Dragon Fly.txt
Campaigns/Bear Activity GTR 2019.txt
Campaigns/APT Baby Shark.txt
Campaigns/apt unidentified nov 18.txt
Campaigns/apt ta17 293a ps.txt
16.
33941668+TomerAlpert@users.noreply.github.com
talpert@microsoft.com
15 shared files
Delivery/Open email link.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
Hunting Queries/Discovery/Enumeration of users & groups for lateral movement.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Fun/HiddenMessage.txt
Exploits/Flash-CVE-2018-4848.txt
Protection events/README.md
Hunting Queries/Execution/PowerShell downloads.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
17.
louie.mayor@microsoft.com
v-maave@microsoft.com
15 shared files
Persistence/wadhrama-ransomware.md
Execution/umworkerprocess-unusual-subprocess-activity.md
locate-surfbuyer-downloader-decoding-activity.md
Lateral Movement/remote-file-creation-with-psexec.md
Execution/umworkerprocess-creating-webshell.md
Credential Access/lazagne.md
README.md
Credential Access/procdump-lsass-credentials.md
Campaigns/cobalt-strike-invoked-w-wmi.md
Execution/reverse-shell-nishang.md
Exfiltration/7-zip-prep-for-exfiltration.md
Delivery/powercat-download.md
Credential Access/wadhrama-credential-dump.md
Impact/wadhrama-data-destruction.md
Exfiltration/exchange-powershell-snapin-loaded.md
18.
63594865+tali-ash@users.noreply.github.com
martyavedon@gmail.com
14 shared files
Execution/python-based-attacks-on-macos.md
Campaigns/robbinhood-driver.md
locate-surfbuyer-downloader-decoding-activity.md
Execution/detect-doublepulsar-execution.md
Command and Control/check-for-shadowhammer-activity-download-domain.md
Impact/ransom-note-creation-macos.md
Initial access/jar-attachments.md
Defense evasion/hiding-java-class-file.md
Command and Control/reverse-shell-ransomware-macos.md
Execution/launch-questd-w-osascript.md
Execution/check-for-shadowhammer-activity-implant.md
Credential Access/cobalt-strike.md
Privilege escalation/locate-ALPC-local-privilege-elevation-exploit.md
Impact/backup-deletion.md
19.
martyavedon@gmail.com
v-maave@microsoft.com
14 shared files
Execution/python-based-attacks-on-macos.md
Campaigns/robbinhood-driver.md
locate-surfbuyer-downloader-decoding-activity.md
Execution/detect-doublepulsar-execution.md
Command and Control/check-for-shadowhammer-activity-download-domain.md
Impact/ransom-note-creation-macos.md
Initial access/jar-attachments.md
Defense evasion/hiding-java-class-file.md
Command and Control/reverse-shell-ransomware-macos.md
Execution/launch-questd-w-osascript.md
Execution/check-for-shadowhammer-activity-implant.md
Credential Access/cobalt-strike.md
Privilege escalation/locate-ALPC-local-privilege-elevation-exploit.md
Impact/backup-deletion.md
20.
40626732+danaim1@users.noreply.github.com
jan@geisbauer.de
14 shared files
Campaigns/apt sofacy zebrocy.txt
Campaigns/OceanLotus registry activity.txt
Campaigns/apt tropictrooper.txt
Persistence/scheduled task creation.txt
Campaigns/Hurricane Panda activity.txt
Campaigns/Elise backdoor.txt
Campaigns/Equation Group C2 Communication.txt
Campaigns/Judgement Panda exfil activity.txt
Campaigns/APT29 thinktanks.txt
Campaigns/Cloud Hopper.txt
Campaigns/Dragon Fly.txt
Campaigns/crime fireball.txt
Campaigns/Bear Activity GTR 2019.txt
Campaigns/APT Baby Shark.txt
21.
makislev@microsoft.com
jan@geisbauer.de
13 shared files
Campaigns/apt sofacy zebrocy.txt
Campaigns/OceanLotus registry activity.txt
Campaigns/apt tropictrooper.txt
Persistence/scheduled task creation.txt
Campaigns/Hurricane Panda activity.txt
Campaigns/Elise backdoor.txt
Campaigns/Equation Group C2 Communication.txt
Campaigns/Judgement Panda exfil activity.txt
Campaigns/APT29 thinktanks.txt
Campaigns/Cloud Hopper.txt
Campaigns/Dragon Fly.txt
Campaigns/Bear Activity GTR 2019.txt
Campaigns/APT Baby Shark.txt
22.
47709940+endisphotic@users.noreply.github.com
orshemesh@microsoft.com
12 shared files
Network/Defender for Endpoint Telemetry.txt
Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt
Command and Control/Device network events w low count FQDN.txt
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt
Lateral Movement/Device Logons from Unknown IPs.txt
Credential Access/Private Key Files.txt
Campaigns/Dopplepaymer In-Memory Malware Implant.txt
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt
Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt
Lateral Movement/Non-local logons with -500 account.txt
Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt
23.
63594865+tali-ash@users.noreply.github.com
orshemesh@microsoft.com
12 shared files
Network/Defender for Endpoint Telemetry.txt
Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt
Command and Control/Device network events w low count FQDN.txt
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt
Lateral Movement/Device Logons from Unknown IPs.txt
Credential Access/Private Key Files.txt
Campaigns/Dopplepaymer In-Memory Malware Implant.txt
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt
Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt
Lateral Movement/Non-local logons with -500 account.txt
Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt
24.
63594865+tali-ash@users.noreply.github.com
talpert@microsoft.com
11 shared files
Delivery/Open email link.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
25.
40626732+danaim1@users.noreply.github.com
talpert@microsoft.com
11 shared files
Delivery/Open email link.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
26.
makislev@microsoft.com
talpert@microsoft.com
11 shared files
Delivery/Open email link.txt
Protection events/SmartScreen URL block ignored by user.txt
Execution/PowerShell downloads.txt
Delivery/Dropbox downloads linked from other site.txt
Discovery/Enumeration of users & groups for lateral movement.txt
Exploits/Flash-CVE-2018-4848.txt
Delivery/Doc attachment with link to download.txt
Exploits/Electron-CVE-2018-1000006.txt
Persistence/Accessibility Features.txt
Command and Control/Tor.txt
Protection events/SmartScreen app block ignored by user.txt
27.
379437+bstrom@users.noreply.github.com
v-maave@microsoft.com
11 shared files
Campaigns/c2-lookup-from-nonbrowser[Solorigate]..md
Campaigns/possible-affected-software-orion[Solorigate].md
Defense evasion/ADFSDomainTrustMods[Solarigate].md
Campaigns/locate-dll-loaded-in-memory[Solorigate].md
Persistence/NewAppOrServicePrincipalCredential[Solarigate].md
Persistence/CredentialsAddAfterAdminConsentedToApp[Solorigate].md
Campaigns/locate-dll-created-locally[Solorigate].md
Campaigns/launching-cmd-echo[Solorigate].md
Campaigns/known-affected-software-orion[Solorigate].md
Campaigns/c2-lookup-response[Solorigate].md
Campaigns/launching-base64-powershell[Solorigate].md
28.
v-maave@microsoft.com
47709940+endisphotic@users.noreply.github.com
11 shared files
Delivery/Gootkit Malware
Execution/umworkerprocess-unusual-subprocess-activity.md
00-query-submission-template.md
Execution/umworkerprocess-creating-webshell.md
README.md
Credential Access/procdump-lsass-credentials.md
Delivery/Gootkit-malware.md
Campaigns/Bazacall/Dropping payload via certutil.md
Initial access/PhishingEmailUrlRedirector.md
Campaigns/Bazacall/Excel file download domain pattern.md
Campaigns/snip3-malicious-network-connectivity.md
29.
47709940+endisphotic@users.noreply.github.com
56367954+alimajalt@users.noreply.github.com
9 shared files
Campaigns/LemonDuck/LemonDuck-control-structure.md
Campaigns/LemonDuck/LemonDuck-id-generation.md
Campaigns/LemonDuck/LemonDuck-component-download-structure.md
Campaigns/LemonDuck/LemonDuck/LemonDuck-component-names.md
Campaigns/LemonDuck/LemonDuck-email-subjects.md
Campaigns/LemonDuck/LemonDuck-component-names.md
Campaigns/LemonDuck/LemonDuck-defender-exclusions.md
Campaigns/LemonDuck/LemonDuck-registration-function.md
Campaigns/LemonDuck/LemonDuck-competition-killer.md
30.
63594865+tali-ash@users.noreply.github.com
Dolcita.Montemayor@microsoft.com
8 shared files
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Ransomware/IcedId Delivery.md
Campaigns/known-affected-software-orion[Nobelium].md
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Ransomware/IcedId attachments.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
31.
66005183+darioongit@users.noreply.github.com
40626732+danaim1@users.noreply.github.com
6 shared files
Delivery/Open email link.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
General queries/Baseline Comparison.txt
Protection events/Antivirus detections.txt
General queries/Events surrounding alert.txt
General queries/Alert Events from Internal IP Address.txt
32.
66005183+darioongit@users.noreply.github.com
makislev@microsoft.com
6 shared files
Delivery/Open email link.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
General queries/Baseline Comparison.txt
Protection events/Antivirus detections.txt
General queries/Events surrounding alert.txt
General queries/Alert Events from Internal IP Address.txt
33.
63594865+tali-ash@users.noreply.github.com
56391590+morRubin@users.noreply.github.com
6 shared files
Discovery/PasswordSearch.md
Discovery/VulnComputers.md
Discovery/Roasting.md
Discovery/MultipleLdaps.md
Discovery/SensitiveLdaps.md
Discovery/MultipleSensitiveLdaps.md
34.
33941668+tomeralpert@users.noreply.github.com
31686674+meni-braun@users.noreply.github.com
6 shared files
Hunting Queries/Enumeration of users & groups for lateral movement.txt
Hunting Queries/PowerShell downloads.txt
Hunting Queries/Sticky key attacks.txt
Hunting Queries/0-day Flash.txt
Hunting Queries/Electron framework vulnerability.txt
Hunting Queries/Persistence/Accessibility Features.txt
35.
63594865+tali-ash@users.noreply.github.com
stesell@microsoft.com
6 shared files
Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].md
Collection/Anomaly of MailItemAccess by Other Users Mailbox [Solorigate].md
Defense evasion/UpdateStsRefreshToken[Solorigate].md
Discovery/SuspiciousEnumerationUsingAdfind[Solarigate].md
Collection/HostExportingMailboxAndRemovingExport[Solarigate].md
Collection/MailItemsAccessedTimeSeries[Solarigate].md
36.
66005183+darioongit@users.noreply.github.com
v-maave@microsoft.com
6 shared files
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Credential Access/cobalt-strike.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
37.
63594865+tali-ash@users.noreply.github.com
51991841+sco-sim@users.noreply.github.com
5 shared files
General queries/MITRE - Suspicious Events.txt
Protection events/AV Detections with Source.txt
Protection events/AV Detections with USB Disk Drive.txt
Execution/Masquerading system executable.txt
General queries/Services.txt
38.
63594865+tali-ash@users.noreply.github.com
louie.mayor@microsoft.com
5 shared files
Campaigns/DofoilNameCoinServerTraffic.txt
locate-surfbuyer-downloader-decoding-activity.md
README.md
Campaigns/Ransomware hits healthcare - Possible compromised accounts.txt
Campaigns/Ransomware hits healthcare - Backup deletion.txt
39.
63594865+tali-ash@users.noreply.github.com
matt@chromeweb.com
5 shared files
Protection events/ExploitGuardNetworkProtectionEvents.txt
Protection events/WindowsDefenderAVEvents.txt
General queries/System Guard Security Level Baseline.txt
General queries/System Guard Security Level Drop.txt
Protection events/ExploitGuardAsrDescriptions.txt
40.
379437+bstrom@users.noreply.github.com
stesell@microsoft.com
5 shared files
Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].md
Collection/Anomaly of MailItemAccess by Other Users Mailbox [Solorigate].md
Defense evasion/UpdateStsRefreshToken[Solorigate].md
Discovery/SuspiciousEnumerationUsingAdfind[Solarigate].md
Collection/HostExportingMailboxAndRemovingExport[Solarigate].md
41.
63594865+tali-ash@users.noreply.github.com
blstrom@microsoft.com
5 shared files
Defense evasion/ADFSDomainTrustMods[Solarigate].md
Persistence/NewAppOrServicePrincipalCredential[Solorigate].md
Defense evasion/ADFSDomainTrustMods[Solorigate].md
Defense evasion/MailPermissionsAddedToApplication[Solorigate].md
Persistence/NewAppOrServicePrincipalCredential[Solarigate].md
42.
66005183+darioongit@users.noreply.github.com
Dolcita.Montemayor@microsoft.com
5 shared files
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
43.
66005183+darioongit@users.noreply.github.com
379437+bstrom@users.noreply.github.com
4 shared files
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Solorigate].md
Campaigns/fireeye-red-team-tools-HASHs [Solorigate].md
Campaigns/compromised-certificate[Solorigate].md
Campaigns/fireeye-red-team-tools-CVEs [Solorigate].md
44.
66005183+darioongit@users.noreply.github.com
33941668+TomerAlpert@users.noreply.github.com
4 shared files
Delivery/Open email link.txt
Protection events/ExploitGuardBlockOfficeChildProcess.txt
Protection events/Antivirus detections.txt
General queries/Events surrounding alert.txt
45.
63594865+tali-ash@users.noreply.github.com
31686674+meni-braun@users.noreply.github.com
4 shared files
Discovery/Discover hosts doing possible network scans.txt
Protection events/ExploitGuardNetworkProtectionEvents.txt
Discovery/DetectTorrentUse.txt
README.md
46.
63594865+tali-ash@users.noreply.github.com
51508845+MiladMSFT@users.noreply.github.com
4 shared files
MTPAHCheatSheetv01-dark.pdf
MTPAHCheatSheetv01-light.pdf
Discovery/Detect-Not-Active-AD-User-Accounts.md
Initial access/identify-potential-missed-phishing-email-campaigns.md
47.
63594865+tali-ash@users.noreply.github.com
insider-threat-feedback@cert.org
4 shared files
Exfiltration/detect-archive-exfiltration-to-competitor.md
Exfiltration/detect-steganography-exfiltration.md
General queries/insider-threat-detection-queries.md
Exfiltration/detect-exfiltration-after-termination.md
48.
louie.mayor@microsoft.com
47709940+endisphotic@users.noreply.github.com
4 shared files
Execution/umworkerprocess-unusual-subprocess-activity.md
Execution/umworkerprocess-creating-webshell.md
README.md
Credential Access/procdump-lsass-credentials.md
49.
33941668+TomerAlpert@users.noreply.github.com
mwhamiltonut@gmail.com
4 shared files
Command and Control/ExternalDnsResolution.txt
Campaigns/MacOceanLotusBackdoor.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
50.
63594865+tali-ash@users.noreply.github.com
milada@microsoft.com
3 shared files
Campaigns/Abusing settingcontent-ms.txt
General queries/Failed Logon Attempt.txt
General queries/Network footprint.txt
51.
40626732+danaim1@users.noreply.github.com
milada@microsoft.com
3 shared files
Campaigns/Abusing settingcontent-ms.txt
General queries/Failed Logon Attempt.txt
General queries/Network footprint.txt
52.
makislev@microsoft.com
milada@microsoft.com
3 shared files
Campaigns/Abusing settingcontent-ms.txt
General queries/Failed Logon Attempt.txt
General queries/Network footprint.txt
53.
63594865+tali-ash@users.noreply.github.com
antonio.vasconcelos@gmail.com
3 shared files
Discovery/Discover hosts doing possible network scans.txt
Protection events/PUA ThreatName per Computer.txt
General queries/WD AV Signature and Platform Version.txt
54.
79610537+dreadphones@users.noreply.github.com
56367954+alimajalt@users.noreply.github.com
3 shared files
Campaigns/Jupyter-Solarmaker/successive-tk-domain-calls.md
Campaigns/Jupyter-Solarmaker/deimos-component-execution.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
55.
63594865+tali-ash@users.noreply.github.com
47076035+pawp81@users.noreply.github.com
3 shared files
00-query-submission-template.md
Initial access/WhenZAPed.md
General/Phish and Malware received by user vs total amount of email.md
56.
63594865+tali-ash@users.noreply.github.com
48328018+AntoineJo@users.noreply.github.com
3 shared files
Persistence/scheduled task creation.txt
Exfiltration/Data copied to other location than C:.txt
Persistence/localAdminAccountLogon.txt
57.
63594865+tali-ash@users.noreply.github.com
40575644+jing-microsoft@users.noreply.github.com
3 shared files
General queries/Network footprint.txt
General queries/File footprint.txt
General queries/Alert Events from Internal IP Address.txt
58.
40626732+danaim1@users.noreply.github.com
40575644+jing-microsoft@users.noreply.github.com
3 shared files
General queries/Network footprint.txt
General queries/File footprint.txt
General queries/Alert Events from Internal IP Address.txt
59.
makislev@microsoft.com
40575644+jing-microsoft@users.noreply.github.com
3 shared files
General queries/Network footprint.txt
General queries/File footprint.txt
General queries/Alert Events from Internal IP Address.txt
60.
63594865+tali-ash@users.noreply.github.com
mwhamiltonut@gmail.com
3 shared files
Campaigns/MacOceanLotusBackdoor.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
61.
40626732+danaim1@users.noreply.github.com
mwhamiltonut@gmail.com
3 shared files
Campaigns/MacOceanLotusBackdoor.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
62.
makislev@microsoft.com
mwhamiltonut@gmail.com
3 shared files
Campaigns/MacOceanLotusBackdoor.txt
Campaigns/MacOceanLotusDropper.txt
Execution/ExecuteBase64DecodedPayload.txt
63.
47709940+endisphotic@users.noreply.github.com
rony_123@protonmail.ch
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md
Campaigns/Bazacall/NTDS theft.md
64.
79610537+dreadphones@users.noreply.github.com
rony_123@protonmail.ch
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md
Campaigns/Bazacall/NTDS theft.md
65.
63594865+tali-ash@users.noreply.github.com
oh.jeongwook@gmail.com
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt
Exploits/AcroRd-Exploits.txt
66.
40626732+danaim1@users.noreply.github.com
oh.jeongwook@gmail.com
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt
Exploits/AcroRd-Exploits.txt
67.
makislev@microsoft.com
oh.jeongwook@gmail.com
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt
Exploits/AcroRd-Exploits.txt
68.
33941668+TomerAlpert@users.noreply.github.com
louie.mayor@microsoft.com
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt
README.md
69.
40626732+danaim1@users.noreply.github.com
antonio.vasconcelos@gmail.com
2 shared files
Discovery/Discover hosts doing possible network scans.txt
General queries/WD AV Signature and Platform Version.txt
70.
40626732+danaim1@users.noreply.github.com
31686674+meni-braun@users.noreply.github.com
2 shared files
Discovery/Discover hosts doing possible network scans.txt
Protection events/ExploitGuardNetworkProtectionEvents.txt
71.
makislev@microsoft.com
antonio.vasconcelos@gmail.com
2 shared files
Discovery/Discover hosts doing possible network scans.txt
General queries/WD AV Signature and Platform Version.txt
72.
makislev@microsoft.com
31686674+meni-braun@users.noreply.github.com
2 shared files
Discovery/Discover hosts doing possible network scans.txt
Protection events/ExploitGuardNetworkProtectionEvents.txt
73.
antonio.vasconcelos@gmail.com
31686674+meni-braun@users.noreply.github.com
2 shared files
Discovery/Discover hosts doing possible network scans.txt
Discovery/Discover hosts doing possible network scans
74.
63594865+tali-ash@users.noreply.github.com
m@manuelhauch.de
2 shared files
Execution/powershell-version-2.0-execution.md
General queries/WD AV Signature and Platform Version.txt
75.
40626732+danaim1@users.noreply.github.com
matt@chromeweb.com
2 shared files
Protection events/ExploitGuardNetworkProtectionEvents.txt
Protection events/ExploitGuardAsrDescriptions.txt
76.
makislev@microsoft.com
matt@chromeweb.com
2 shared files
Protection events/ExploitGuardNetworkProtectionEvents.txt
Protection events/ExploitGuardAsrDescriptions.txt
77.
379437+bstrom@users.noreply.github.com
blstrom@microsoft.com
2 shared files
Defense evasion/ADFSDomainTrustMods[Solarigate].md
Persistence/NewAppOrServicePrincipalCredential[Solarigate].md
78.
v-maave@microsoft.com
blstrom@microsoft.com
2 shared files
Defense evasion/ADFSDomainTrustMods[Solarigate].md
Persistence/NewAppOrServicePrincipalCredential[Solarigate].md
79.
63594865+tali-ash@users.noreply.github.com
45784740+YulelogPagoda@users.noreply.github.com
2 shared files
Exploits/CVE-2021-36934 usage detection.md
Exploits/printnightmare-cve-2021-1675 usage detection.md
80.
63594865+tali-ash@users.noreply.github.com
42285038+miflower@users.noreply.github.com
2 shared files
General queries/Baseline Comparison.txt
Lateral Movement/ServiceAccountsPerformingRemotePS.txt
81.
40626732+danaim1@users.noreply.github.com
42285038+miflower@users.noreply.github.com
2 shared files
General queries/Baseline Comparison.txt
Lateral Movement/ServiceAccountsPerformingRemotePS.txt
82.
makislev@microsoft.com
42285038+miflower@users.noreply.github.com
2 shared files
General queries/Baseline Comparison.txt
Lateral Movement/ServiceAccountsPerformingRemotePS.txt
83.
63594865+tali-ash@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
2 shared files
Campaigns/Bazacall/NTDS theft.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
84.
63594865+tali-ash@users.noreply.github.com
37783395+aprakash13@users.noreply.github.com
2 shared files
Execution/Malware_In_recyclebin.txt
Execution/Base64encodePEFile.txt
85.
40626732+danaim1@users.noreply.github.com
37783395+aprakash13@users.noreply.github.com
2 shared files
Execution/Malware_In_recyclebin.txt
Execution/Base64encodePEFile.txt
86.
makislev@microsoft.com
37783395+aprakash13@users.noreply.github.com
2 shared files
Execution/Malware_In_recyclebin.txt
Execution/Base64encodePEFile.txt
87.
33941668+TomerAlpert@users.noreply.github.com
40007564+jobaror@users.noreply.github.com
2 shared files
Exploits/Linux-DynoRoot-CVE-2018-1111
Exploits/Linux-DynoRoot-CVE-2018-1111.txt
88.
66005183+darioongit@users.noreply.github.com
insider-threat-feedback@cert.org
2 shared files
General queries/insider-threat-detection-queries.md
Exfiltration/detect-exfiltration-after-termination.md
89.
Dolcita.Montemayor@microsoft.com
56367954+alimajalt@users.noreply.github.com
2 shared files
Email Queries/referral-phish-emails.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
90.
33941668+TomerAlpert@users.noreply.github.com
31686674+meni-braun@users.noreply.github.com
2 shared files
README.md
Hunting Queries/Protection events/README.md
91.
63594865+tali-ash@users.noreply.github.com
66407692+YoshihiroIchinose@users.noreply.github.com
2 shared files
Exfiltration/Files copied to USB drives.md
General queries/Device uptime calculation.md
92.
63594865+tali-ash@users.noreply.github.com
23354952+Dylan-J@users.noreply.github.com
2 shared files
Credential Access/Active Directory Sensitive Group Modifications.md
Discovery/DetectTorRelayConnectivity.md
93.
63594865+tali-ash@users.noreply.github.com
37715501+elflorio@users.noreply.github.com
2 shared files
Exploits/Flash-CVE-2018-4848.txt
Exploits/Electron-CVE-2018-1000006.txt
94.
40626732+danaim1@users.noreply.github.com
37715501+elflorio@users.noreply.github.com
2 shared files
Exploits/Flash-CVE-2018-4848.txt
Exploits/Electron-CVE-2018-1000006.txt
95.
makislev@microsoft.com
37715501+elflorio@users.noreply.github.com
2 shared files
Exploits/Flash-CVE-2018-4848.txt
Exploits/Electron-CVE-2018-1000006.txt
96.
33941668+TomerAlpert@users.noreply.github.com
37715501+elflorio@users.noreply.github.com
2 shared files
Exploits/Flash-CVE-2018-4848.txt
Exploits/Electron-CVE-2018-1000006.txt
97.
37715501+elflorio@users.noreply.github.com
talpert@microsoft.com
2 shared files
Exploits/Flash-CVE-2018-4848.txt
Exploits/Electron-CVE-2018-1000006.txt
98.
79610537+dreadphones@users.noreply.github.com
Dolcita.Montemayor@microsoft.com
2 shared files
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
99.
63594865+tali-ash@users.noreply.github.com
alex.verboon@basevision.ch
2 shared files
Protection events/ExploitGuardControlledFolderAccess.txt
Persistence/LocalAdminGroupChanges.txt
100.
66005183+darioongit@users.noreply.github.com
louie.mayor@microsoft.com
2 shared files
Campaigns/Ransomware hits healthcare - Possible compromised accounts.txt
Campaigns/Ransomware hits healthcare - Backup deletion.txt
| Contributor 1 | Contributor 2 | # shared files | |
|---|---|---|---|
| 1. | 63594865+tali-ash@users.noreply.github.com | v-maave@microsoft.com |
102 shared files
Execution/python-based-attacks-on-macos.md Lateral Movement/doppelpaymer-psexec.md Campaigns/c2-lookup-from-nonbrowser[Solorigate]..md Campaigns/possible-affected-software-orion[Solorigate].md Privilege escalation/cve-2019-0808-nufsys-file creation.md Campaigns/robbinhood-driver.md Execution/sql-server-abuse.md Campaigns/Sysrv-botnet/tomcat-8-executing-powershell.md Defense evasion/clear-system-logs.md Discovery/qakbot-campaign-outlook.md Defense evasion/ADFSDomainTrustMods[Solarigate].md Execution/locate-shlayer-payload-decrytion-activity.md Privilege escalation/detect-cve-2019-1069-bearlpe-exploit.md Defense evasion/alt-data-streams.md 00-query-submission-template.md locate-surfbuyer-downloader-decoding-activity.md Campaigns/locate-dll-loaded-in-memory[Solorigate].md Campaigns/solorigate-locate-dll-loaded-in-memory.md Execution/detect-doublepulsar-execution.md Privilege escalation/detect-cve-2019-1053-sandboxescape-exploit.md Credential Access/doppelpaymer-procdump.md Campaigns/solarigate-c2-lookup-response.md Credential Access/identify-accounts-logged-on-to-endpoints-affected-by-cobalt-strike.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Execution/qakbot-campaign-suspicious-javascript.md Command and Control/check-for-shadowhammer-activity-download-domain.md Exploits/winrar-cve-2018-20250-file-creation.md Execution/detect-exploitation-of-cve-2018-8653.md Persistence/qakbot-campaign-registry-edit.md Execution/detect-suspicious-mshta-usage.md Campaigns/Sysrv-botnet/rce-on-vulnerable-server.md Campaigns/oceanlotus-apt32-files.md Discovery/doppelpaymer.md Campaigns/solarigate-possible-affected-software-orion.md Exfiltration/Data copied to other location than C drive.txt README.md Persistence/NewAppOrServicePrincipalCredential[Solarigate].md Campaigns/solarigate-locate-dll-created-locally.md Execution/detect-malicious-rar-extraction.md Campaigns/known-affected-software-orion[Nobelium].md Campaigns/Sysrv-botnet/kinsing-miner-download.md Privilege escalation/cve-2019-0808-c2.md Campaigns/oceanlotus-apt32-network.md Campaigns/Sysrv-botnet/app-armor-stopped.md Command and Control/python-use-by-ransomware-macos.md Privilege escalation/cve-2019-0808-set-scheduled-task.md Delivery/detect-jscript-file-creation.md Discovery/detect-suspicious-commands-initiated-by-web-server-processes.md Defense evasion/locate-files-possibly-signed-by-fraudulent-ecc-certificates.md Execution/detect-web-server-exploit-doublepulsar.md Execution/locate-surfbuyer-downloader-decoding-activity.md Defense evasion/qakbot-campaign-self-deletion.md Delivery/Gootkit-malware.md Defense evasion/deleting-data-w-cipher-tool.md Campaigns/detect-cyzfc-activity.md Persistence/CredentialsAddAfterAdminConsentedToApp[Solorigate].md Execution/detect-bluekeep-related-mining.md Campaigns/Sysrv-botnet/oracle-webLogic-executing-powershell.md Execution/detect-malcious-use-of-msiexec.md Exploits/winrar-cve-2018-20250-ace-files.md Campaigns/locate-dll-created-locally[Solorigate].md Campaigns/confluence-weblogic-targeted.md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Privilege escalation/detect-cve-2019-1129-byebear-exploit.md Execution/locate-shlayer-payload-decryption-activity.md Campaigns/launching-cmd-echo[Solorigate].md Lateral Movement/detect-suspicious-rdp-connections.md Campaigns/known-affected-software-orion[Solorigate].md Campaigns/c2-lookup-response[Solorigate].md Impact/ransom-note-creation-macos.md Initial access/jar-attachments.md Privilege escalation/detect-cve-2019-0973-installerbypass-exploit.md Campaigns/robbinhood-evasion.md Persistence/detect-prifou-pua.md Defense evasion/hiding-java-class-file.md Execution/office-apps-launching-wscipt.md Privilege escalation/detect-cve-2019-0863-AngryPolarBearBug2-exploit.md Initial access/PhishingEmailUrlRedirector.md Command and Control/reverse-shell-ransomware-macos.md Discovery/qakbot-campaign-esentutl.md Defense evasion/doppelpaymer-stop-services.md Campaigns/solarigate-launching-cmd-echo.md Execution/jse-launched-by-word.md Command and Control/recon-with-rundll.md Initial access/detect-mailsniper.md Campaigns/Sysrv-botnet/java-executing-cmd-to-run-powershell.md Impact/turn-off-system-restore.md Execution/launch-questd-w-osascript.md Execution/check-for-shadowhammer-activity-implant.md Discovery/detect-nbtscan-activity.md Campaigns/launching-base64-powershell[Solorigate].md Credential Access/wdigest-caching.md Initial access/detect-bluekeep-exploitation-attempts.md Credential Access/cobalt-strike.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Privilege escalation/locate-ALPC-local-privilege-elevation-exploit.md Defense evasion/qakbot-campaign-process-injection.md Campaigns/solarigate-launching-base64-powershell.md Execution/detect-office-products-spawning-wmic.md Campaigns/possible-affected-software-orion[Nobelium].md ... |
| 2. | 63594865+tali-ash@users.noreply.github.com | 40626732+danaim1@users.noreply.github.com |
60 shared files
Delivery/Open email link.txt Campaigns/Abusing settingcontent-ms.txt General queries/Network info of machine.txt Campaigns/apt sofacy zebrocy.txt Campaigns/DofoilNameCoinServerTraffic.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Execution/PowershellCommand footprint.txt Campaigns/OceanLotus registry activity.txt Discovery/Discover hosts doing possible network scans.txt Execution/PowershellCommand - uncommon commands on machine.txt Protection events/ExploitGuardNetworkProtectionEvents.txt Exploits/AcroRd-Exploits.txt Campaigns/apt tropictrooper.txt General queries/Baseline Comparison.txt Protection events/Antivirus detections.txt Protection events/ExploitGuardStats.txt Discovery/SMB shares discovery.txt Persistence/Create account.txt Execution/Malware_In_recyclebin.txt Lateral Movement/Account brute force.txt Delivery/Pivot from detections to related downloads.txt Persistence/scheduled task creation.txt Discovery/URL Detection.txt Execution/Base64encodePEFile.txt Fun/EmojiHunt.txt Campaigns/Hurricane Panda activity.txt Exfiltration/Map external devices.txt General queries/Failed Logon Attempt.txt Campaigns/Elise backdoor.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt General queries/Machine info from IP address.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt General queries/Network footprint.txt Campaigns/Equation Group C2 Communication.txt Campaigns/Judgement Panda exfil activity.txt Campaigns/MacOceanLotusBackdoor.txt Protection events/Windows filtering events (Firewall).txt Exploits/Linux-DynoRoot-CVE-2018-1111.txt General queries/File footprint.txt Lateral Movement/ServiceAccountsPerformingRemotePS.txt Campaigns/APT29 thinktanks.txt General queries/Events surrounding alert.txt Campaigns/Cloud Hopper.txt Campaigns/Dragon Fly.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt General queries/Alert Events from Internal IP Address.txt Campaigns/Bear Activity GTR 2019.txt Persistence/Accessibility Features.txt Campaigns/APT Baby Shark.txt Campaigns/MacOceanLotusDropper.txt General queries/WD AV Signature and Platform Version.txt Execution/ExecuteBase64DecodedPayload.txt Protection events/ExploitGuardAsrDescriptions.txt Delivery/Email link + download + SmartScreen warning.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 3. | 63594865+tali-ash@users.noreply.github.com | makislev@microsoft.com |
60 shared files
Delivery/Open email link.txt Campaigns/Abusing settingcontent-ms.txt General queries/Network info of machine.txt Campaigns/apt sofacy zebrocy.txt Campaigns/DofoilNameCoinServerTraffic.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Execution/PowershellCommand footprint.txt Campaigns/OceanLotus registry activity.txt Discovery/Discover hosts doing possible network scans.txt Execution/PowershellCommand - uncommon commands on machine.txt Protection events/ExploitGuardNetworkProtectionEvents.txt Exploits/AcroRd-Exploits.txt Campaigns/apt tropictrooper.txt General queries/Baseline Comparison.txt Protection events/Antivirus detections.txt Protection events/ExploitGuardStats.txt Discovery/SMB shares discovery.txt Persistence/Create account.txt Execution/Malware_In_recyclebin.txt Lateral Movement/Account brute force.txt Delivery/Pivot from detections to related downloads.txt Persistence/scheduled task creation.txt Discovery/URL Detection.txt Execution/Base64encodePEFile.txt Fun/EmojiHunt.txt Campaigns/Hurricane Panda activity.txt Exfiltration/Map external devices.txt General queries/Failed Logon Attempt.txt Campaigns/Elise backdoor.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt General queries/Machine info from IP address.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt General queries/Network footprint.txt Campaigns/Equation Group C2 Communication.txt Campaigns/Judgement Panda exfil activity.txt Campaigns/MacOceanLotusBackdoor.txt Protection events/Windows filtering events (Firewall).txt Exploits/Linux-DynoRoot-CVE-2018-1111.txt General queries/File footprint.txt Lateral Movement/ServiceAccountsPerformingRemotePS.txt Campaigns/APT29 thinktanks.txt General queries/Events surrounding alert.txt Campaigns/Cloud Hopper.txt Campaigns/Dragon Fly.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt General queries/Alert Events from Internal IP Address.txt Campaigns/Bear Activity GTR 2019.txt Persistence/Accessibility Features.txt Campaigns/APT Baby Shark.txt Campaigns/MacOceanLotusDropper.txt General queries/WD AV Signature and Platform Version.txt Execution/ExecuteBase64DecodedPayload.txt Protection events/ExploitGuardAsrDescriptions.txt Delivery/Email link + download + SmartScreen warning.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 4. | 40626732+danaim1@users.noreply.github.com | makislev@microsoft.com |
60 shared files
Delivery/Open email link.txt Campaigns/Abusing settingcontent-ms.txt General queries/Network info of machine.txt Campaigns/apt sofacy zebrocy.txt Campaigns/DofoilNameCoinServerTraffic.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Execution/PowershellCommand footprint.txt Campaigns/OceanLotus registry activity.txt Discovery/Discover hosts doing possible network scans.txt Execution/PowershellCommand - uncommon commands on machine.txt Protection events/ExploitGuardNetworkProtectionEvents.txt Exploits/AcroRd-Exploits.txt Campaigns/apt tropictrooper.txt General queries/Baseline Comparison.txt Protection events/Antivirus detections.txt Protection events/ExploitGuardStats.txt Discovery/SMB shares discovery.txt Persistence/Create account.txt Execution/Malware_In_recyclebin.txt Lateral Movement/Account brute force.txt Delivery/Pivot from detections to related downloads.txt Persistence/scheduled task creation.txt Discovery/URL Detection.txt Execution/Base64encodePEFile.txt Fun/EmojiHunt.txt Campaigns/Hurricane Panda activity.txt Exfiltration/Map external devices.txt General queries/Failed Logon Attempt.txt Campaigns/Elise backdoor.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt General queries/Machine info from IP address.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt General queries/Network footprint.txt Campaigns/Equation Group C2 Communication.txt Campaigns/Judgement Panda exfil activity.txt Campaigns/MacOceanLotusBackdoor.txt Protection events/Windows filtering events (Firewall).txt Exploits/Linux-DynoRoot-CVE-2018-1111.txt General queries/File footprint.txt Lateral Movement/ServiceAccountsPerformingRemotePS.txt Campaigns/APT29 thinktanks.txt General queries/Events surrounding alert.txt Campaigns/Cloud Hopper.txt Campaigns/Dragon Fly.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt General queries/Alert Events from Internal IP Address.txt Campaigns/Bear Activity GTR 2019.txt Persistence/Accessibility Features.txt Campaigns/APT Baby Shark.txt Campaigns/MacOceanLotusDropper.txt General queries/WD AV Signature and Platform Version.txt Execution/ExecuteBase64DecodedPayload.txt Protection events/ExploitGuardAsrDescriptions.txt Delivery/Email link + download + SmartScreen warning.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 5. | 64156578+mjmelone@users.noreply.github.com | 63594865+tali-ash@users.noreply.github.com |
47 shared files
General queries/Crashing Applications.csl Campaigns/WastedLocker.csl Execution/File Copy and Execution.md Webcasts/Airlift 2021 - Lets Invoke.csl Webcasts/TrackingTheAdversary/README.md Execution/Webserver Executing Suspicious Applications.md Command and Control/Device network events w low count FQDN.csl Persistence/Possible webshell drop.md General queries/Detect Azure RemoteIP.md Execution/Possible Ransomware Related Destruction Activity.csl Fun/Make FolderPath Vogon Poetry.md Lateral Movement/Network Logons with Local Accounts.md Campaigns/Dopplepaymer In-Memory Malware Implant.csl General queries/Firewall Policy Design Assistant.md Execution/Detect PowerShell v2 Downgrade.md Exfiltration/Possible File Copy to USB Drive.md Credential Access/Private Key Files.csl Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.csl General queries/AppLocker Policy Design Assistant.csl Exfiltration/Password Protected Archive Creation.md Webcasts/README.md Troubleshooting/Connectivity Failures by Domain.md Troubleshooting/Connectivity Failures by Device.md Execution/Suspicious Webserver Activity.csl Campaigns/WastedLocker Downloader.md Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.csl General queries/Devices by DNS Suffix.csl General queries/Crashing Applications.md Webcasts/TrackingTheAdversary/Episode 2 - Joins.csl Lateral Movement/Device Logons from Unknown IPs.csl Command and Control/Connection to Rare DNS Hosts.md Execution/Base64 Detector and Decoder.md Execution/Detect Encoded Powershell.md Execution/Possible Ransomware Related Destruction Activity.md Execution/Base64 Detector and Decoder.csl Fun/Make FolderPath Vogon Poetry.csl Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.csl General queries/Device Count by DNS Suffix.md General queries/AppLocker Policy Design Assistant.md General queries/Endpoint Status Report.csl Webcasts/l33tSpeak/l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl Exfiltration/Password Protected Archives.csl General queries/MD AV Signature and Platform Version.md Lateral Movement/Non-local logons with -500 account.csl General queries/WD AV Signature and Platform Version.txt Campaigns/Abuse.ch Recent Threat Feed.md General queries/Endpoint Agent Health Status Report.md |
| 6. | Dolcita.Montemayor@microsoft.com | v-maave@microsoft.com |
44 shared files
Command and Control/DNSPattern [Nobelium].md Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Nobelium].md Persistence/CredentialsAddAfterAdminConsentedToApp[Nobelium].md Privilege escalation/ServicePrincipalAddedToRole [Nobelium].md Campaigns/encoded-powershell-structure-snip3.md Discovery/SuspiciousEnumerationUsingAdfind[Nobelium].md Command and Control/EncodedDomainURL [Nobelium].md Campaigns/malicious-network-connectivity-snip3.md Campaigns/locate-dll-loaded-in-memory[Nobelium].md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Campaigns/c2-lookup-response[Nobelium].md Campaigns/snip3-encoded-powershell-structure.md Campaigns/snip3-aviation-targeting-emails.md Campaigns/launching-cmd-echo[Nobelium].md Campaigns/cypherpunk-exclusive-commands.md Collection/Anomaly of MailItemAccess by Other Users Mailbox [Nobelium].md Campaigns/revengerat-c2-exfiltration-snip3.md Campaigns/known-affected-software-orion[Nobelium].md Defense evasion/MailPermissionsAddedToApplication[Nobelium].md Campaigns/fireeye-red-team-tools-HASHs [Nobelium].md Defense evasion/Discovering potentially tampered devices [Nobelium].md Campaigns/detectsanboxie-function-call-snip3.md Exfiltration/MailItemsAccessed Throttling [Nobelium].md Defense evasion/ADFSDomainTrustMods[Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/aviation-targeting-emails-snip3.md Campaigns/snip3-detectsanboxie-function-call.md Persistence/NewAppOrServicePrincipalCredential[Nobelium].md Exfiltration/Anomaly of MailItemAccess by GraphAPI [Nobelium].md Campaigns/compromised-certificate[Nobelium].md Campaigns/launching-base64-powershell[Nobelium].md Exfiltration/OAuth Apps reading mail both via GraphAPI and directly [Nobelium].md Campaigns/locate-dll-created-locally[Nobelium].md Campaigns/jupyter-solarmarker-evasive-powershell-strings.md Campaigns/c2-lookup-from-nonbrowser[Nobelium].md Campaigns/jupyter-solarmarker-evasive-powershell-executions.md Campaigns/snip3-revengerat-c2-exfiltration.md Campaigns/cypherpunk-remote-exec-w-psexesvc.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Privilege escalation/dell-driver-vulnerability-2021.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/snip3-malicious-network-connectivity.md Privilege escalation/Add uncommon credential type to application [Nobelium].md Exfiltration/OAuth Apps accessing user mail via GraphAPI [Nobelium].md |
| 7. | 47709940+endisphotic@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
38 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md Campaigns/Qakbot/Qakbot reconnaissance activities.md Campaigns/Log4J/Alerts related to Log4j vulnerability.md Campaigns/Macaw Ransomware/Imminent Ransomware.md Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md Campaigns/Bazacall/Cobalt Strike Lateral Movement Campaigns/Macaw Ransomware/Inhibit recovery by disabling tools and functionality.md Campaigns/Qakbot/Qakbot email theft.md Campaigns/Log4J/Suspicious PowerShell curl flags.md Campaigns/Bazacall/Malicious Excel Delivery.md Campaigns/Bazacall/NTDS theft.md Campaigns/ZLoader/Suspicious Registry Keys.md Campaigns/Qakbot/General attempts to access local email store.md Campaigns/Bazacall/Excel Macro Execution.md Campaigns/Bazarloader/Zip-Doc - Creation of JPG Payload File.md Campaigns/Bazarloader/Stolen Images Execution.md Campaigns/Qakbot/Qakbot Craigslist Domains.md Email Queries/Appspot Phishing Abuse.md Campaigns/Macaw Ransomware/Use of MSBuild as LOLBin.md Campaigns/Bazacall/Renamed Rclone Exfil.md Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md Campaigns/Bazacall/Bazacall Emails.md Email Queries/Appspot Phishing Abuse Campaigns/Bazacall/RunDLL Suspicious Network Connection.md Campaigns/Macaw Ransomware/Mass account password change.md Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md Campaigns/StrRAT malware/StrRAT-Email-Delivery.md Campaigns/StrRAT malware/StrRAT-Email-Delivery Campaigns/ZLoader/Payload Delivery.md Campaigns/Macaw Ransomware/Disable Controlled Folders.md Campaigns/Log4J/Suspicious JScript staging comment.md Campaigns/ZLoader/Malicious bat file.md Campaigns/Macaw Ransomware/PSExec Attrib commands.md Campaigns/Qakbot/Excel launching anomalous processes.md Email Queries/PhishingEmailUrlRedirector.md Campaigns/StrRAT malware/StrRAT-AV-Discovery.md Campaigns/StrRAT malware/StrRAT-Malware-Persistence.md Campaigns/Bazarloader/Zip-Doc - Word Launching MSHTA.md |
| 8. | 63594865+tali-ash@users.noreply.github.com | 33941668+TomerAlpert@users.noreply.github.com |
36 shared files
Delivery/Open email link.txt Campaigns/Abusing settingcontent-ms.txt General queries/Network info of machine.txt Campaigns/DofoilNameCoinServerTraffic.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Execution/PowershellCommand footprint.txt Execution/PowershellCommand - uncommon commands on machine.txt Protection events/Antivirus detections.txt Protection events/ExploitGuardStats.txt Discovery/SMB shares discovery.txt Persistence/Create account.txt Lateral Movement/Account brute force.txt Delivery/Pivot from detections to related downloads.txt Fun/EmojiHunt.txt Exfiltration/Map external devices.txt README.md Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt General queries/Machine info from IP address.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt Campaigns/MacOceanLotusBackdoor.txt Protection events/Windows filtering events (Firewall).txt Exploits/Linux-DynoRoot-CVE-2018-1111.txt General queries/File footprint.txt General queries/Events surrounding alert.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt Protection events/ExploitGuardAsrDescriptions.txt Delivery/Email link + download + SmartScreen warning.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 9. | 40626732+danaim1@users.noreply.github.com | 33941668+TomerAlpert@users.noreply.github.com |
35 shared files
Delivery/Open email link.txt Campaigns/Abusing settingcontent-ms.txt General queries/Network info of machine.txt Campaigns/DofoilNameCoinServerTraffic.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Execution/PowershellCommand footprint.txt Execution/PowershellCommand - uncommon commands on machine.txt Protection events/Antivirus detections.txt Protection events/ExploitGuardStats.txt Discovery/SMB shares discovery.txt Persistence/Create account.txt Lateral Movement/Account brute force.txt Delivery/Pivot from detections to related downloads.txt Fun/EmojiHunt.txt Exfiltration/Map external devices.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt General queries/Machine info from IP address.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt Campaigns/MacOceanLotusBackdoor.txt Protection events/Windows filtering events (Firewall).txt Exploits/Linux-DynoRoot-CVE-2018-1111.txt General queries/File footprint.txt General queries/Events surrounding alert.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt Protection events/ExploitGuardAsrDescriptions.txt Delivery/Email link + download + SmartScreen warning.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 10. | makislev@microsoft.com | 33941668+TomerAlpert@users.noreply.github.com |
35 shared files
Delivery/Open email link.txt Campaigns/Abusing settingcontent-ms.txt General queries/Network info of machine.txt Campaigns/DofoilNameCoinServerTraffic.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Execution/PowershellCommand footprint.txt Execution/PowershellCommand - uncommon commands on machine.txt Protection events/Antivirus detections.txt Protection events/ExploitGuardStats.txt Discovery/SMB shares discovery.txt Persistence/Create account.txt Lateral Movement/Account brute force.txt Delivery/Pivot from detections to related downloads.txt Fun/EmojiHunt.txt Exfiltration/Map external devices.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt General queries/Machine info from IP address.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt Campaigns/MacOceanLotusBackdoor.txt Protection events/Windows filtering events (Firewall).txt Exploits/Linux-DynoRoot-CVE-2018-1111.txt General queries/File footprint.txt General queries/Events surrounding alert.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt Protection events/ExploitGuardAsrDescriptions.txt Delivery/Email link + download + SmartScreen warning.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 11. | 63594865+tali-ash@users.noreply.github.com | 379437+bstrom@users.noreply.github.com |
31 shared files
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Solorigate].md Exfiltration/OAuth Apps reading mail both via GraphAPI and directly [Solorigate].md Campaigns/c2-lookup-from-nonbrowser[Solorigate]..md Campaigns/possible-affected-software-orion[Solorigate].md Campaigns/fireeye-red-team-tools-HASHs [Solorigate].md Privilege escalation/ServicePrincipalAddedToRole [Solorigate].md Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].md Defense evasion/ADFSDomainTrustMods[Solarigate].md Persistence/Possible webshell drop.md Campaigns/locate-dll-loaded-in-memory[Solorigate].md Command and Control/DNSPattern [Solorigate].md Exfiltration/Anomaly of MailItemAccess by GraphAPI [Solorigate].md Collection/Anomaly of MailItemAccess by Other Users Mailbox [Solorigate].md Campaigns/compromised-certificate[Solorigate].md Command and Control/EncodedDomainURL [Solorigate].md Persistence/NewAppOrServicePrincipalCredential[Solarigate].md Defense evasion/UpdateStsRefreshToken[Solorigate].md Discovery/DetectTorRelayConnectivity.md Persistence/CredentialsAddAfterAdminConsentedToApp[Solorigate].md Privilege escalation/Add uncommon credential type to application [Solorigate].md Exfiltration/MailItemsAccessed Throttling [Solorigate].md Campaigns/locate-dll-created-locally[Solorigate].md Discovery/SuspiciousEnumerationUsingAdfind[Solarigate].md Campaigns/launching-cmd-echo[Solorigate].md Campaigns/known-affected-software-orion[Solorigate].md Campaigns/c2-lookup-response[Solorigate].md Collection/HostExportingMailboxAndRemovingExport[Solarigate].md Defense evasion/Discovering potentially tampered devices [Solorigate].md Exfiltration/OAuth Apps accessing user mail via GraphAPI [Solorigate].md Campaigns/launching-base64-powershell[Solorigate].md Campaigns/fireeye-red-team-tools-CVEs [Solorigate].md |
| 12. | 47709940+endisphotic@users.noreply.github.com | 63594865+tali-ash@users.noreply.github.com |
29 shared files
Network/Defender for Endpoint Telemetry.txt Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt General queries/MD AV Signature and Platform Version.txt Command and Control/Device network events w low count FQDN.txt 00-query-submission-template.md Campaigns/Bazacall/NTDS theft.md Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt Lateral Movement/Device Logons from Unknown IPs.txt Credential Access/Private Key Files.txt Campaigns/Dopplepaymer In-Memory Malware Implant.txt Ransomware/Turning off services using sc exe.md Ransomware/IcedId Delivery.md README.md Ransomware/Turning off System Restore.md Ransomware/Check for multiple signs of ransomware activity.md Delivery/Gootkit-malware.md Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md Ransomware/Backup deletion.md Ransomware/Stopping multiple processes using taskkill.md Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt Lateral Movement/Non-local logons with -500 account.txt Ransomware/Clearing of forensic evidence from event logs using wevtutil.md Initial access/PhishingEmailUrlRedirector.md Ransomware/Stopping processes using net stop.md Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt Ransomware/IcedId attachments.md Ransomware/Deletion of data on multiple drives using cipher exe.md Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt |
| 13. | 63594865+tali-ash@users.noreply.github.com | 66005183+darioongit@users.noreply.github.com |
22 shared files
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Solorigate].md Delivery/Open email link.txt Campaigns/fireeye-red-team-tools-HASHs [Solorigate].md Protection events/ExploitGuardBlockOfficeChildProcess.txt M365-PowerBi Dashboard/readme.txt General queries/Baseline Comparison.txt Protection events/Antivirus detections.txt Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md General queries/insider-threat-detection-queries.md Campaigns/compromised-certificate[Solorigate].md Campaigns/known-affected-software-orion[Nobelium].md Exfiltration/detect-exfiltration-after-termination.md TVM/devices_with_vuln_and_users_received_payload.md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/Ransomware hits healthcare - Possible compromised accounts.txt General queries/Events surrounding alert.txt Campaigns/Ransomware hits healthcare - Backup deletion.txt General queries/Alert Events from Internal IP Address.txt Credential Access/cobalt-strike.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/fireeye-red-team-tools-CVEs [Solorigate].md Campaigns/possible-affected-software-orion[Nobelium].md |
| 14. | Dolcita.Montemayor@microsoft.com | 47709940+endisphotic@users.noreply.github.com |
22 shared files
Exploits/Print Spooler RCE/Suspicious DLLs in spool folder.md Ransomware/IcedId email delivery.md Ransomware/Suspicious Image Load related to IcedId.md Ransomware/Potential ransomware activity related to Cobalt Strike.md Ransomware/Distribution from remote location.md Ransomware/DarkSide.md Ransomware/IcedId Delivery.md Ransomware/Qakbot discovery activies.md Ransomware/LaZagne Credential Theft.md Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md Ransomware/Fake Replies.md Ransomware/HTA Startup Persistence.md Ransomware/Suspicious Bitlocker Encryption.md Ransomware/Gootkit File Delivery.md Ransomware/Sticky Keys.md Ransomware/IcedId attachments.md Ransomware/File Backup Deletion Alerts.md Ransomware/Suspicious Google Doc Links.md Ransomware/Discovery for highly-privileged accounts.md Campaigns/snip3-malicious-network-connectivity.md Exploits/Print Spooler RCE/Suspicious files in spool folder.md |
| 15. | 63594865+tali-ash@users.noreply.github.com | jan@geisbauer.de |
16 shared files
Campaigns/apt sofacy zebrocy.txt Campaigns/OceanLotus registry activity.txt Campaigns/apt sofacy.txt Campaigns/apt tropictrooper.txt Persistence/scheduled task creation.txt Campaigns/Hurricane Panda activity.txt Campaigns/Elise backdoor.txt Campaigns/Equation Group C2 Communication.txt Campaigns/Judgement Panda exfil activity.txt Campaigns/APT29 thinktanks.txt Campaigns/Cloud Hopper.txt Campaigns/Dragon Fly.txt Campaigns/Bear Activity GTR 2019.txt Campaigns/APT Baby Shark.txt Campaigns/apt unidentified nov 18.txt Campaigns/apt ta17 293a ps.txt |
| 16. | 33941668+TomerAlpert@users.noreply.github.com | talpert@microsoft.com |
15 shared files
Delivery/Open email link.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt Hunting Queries/Discovery/Enumeration of users & groups for lateral movement.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Fun/HiddenMessage.txt Exploits/Flash-CVE-2018-4848.txt Protection events/README.md Hunting Queries/Execution/PowerShell downloads.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 17. | louie.mayor@microsoft.com | v-maave@microsoft.com |
15 shared files
Persistence/wadhrama-ransomware.md Execution/umworkerprocess-unusual-subprocess-activity.md locate-surfbuyer-downloader-decoding-activity.md Lateral Movement/remote-file-creation-with-psexec.md Execution/umworkerprocess-creating-webshell.md Credential Access/lazagne.md README.md Credential Access/procdump-lsass-credentials.md Campaigns/cobalt-strike-invoked-w-wmi.md Execution/reverse-shell-nishang.md Exfiltration/7-zip-prep-for-exfiltration.md Delivery/powercat-download.md Credential Access/wadhrama-credential-dump.md Impact/wadhrama-data-destruction.md Exfiltration/exchange-powershell-snapin-loaded.md |
| 18. | 63594865+tali-ash@users.noreply.github.com | martyavedon@gmail.com |
14 shared files
Execution/python-based-attacks-on-macos.md Campaigns/robbinhood-driver.md locate-surfbuyer-downloader-decoding-activity.md Execution/detect-doublepulsar-execution.md Command and Control/check-for-shadowhammer-activity-download-domain.md Impact/ransom-note-creation-macos.md Initial access/jar-attachments.md Defense evasion/hiding-java-class-file.md Command and Control/reverse-shell-ransomware-macos.md Execution/launch-questd-w-osascript.md Execution/check-for-shadowhammer-activity-implant.md Credential Access/cobalt-strike.md Privilege escalation/locate-ALPC-local-privilege-elevation-exploit.md Impact/backup-deletion.md |
| 19. | martyavedon@gmail.com | v-maave@microsoft.com |
14 shared files
Execution/python-based-attacks-on-macos.md Campaigns/robbinhood-driver.md locate-surfbuyer-downloader-decoding-activity.md Execution/detect-doublepulsar-execution.md Command and Control/check-for-shadowhammer-activity-download-domain.md Impact/ransom-note-creation-macos.md Initial access/jar-attachments.md Defense evasion/hiding-java-class-file.md Command and Control/reverse-shell-ransomware-macos.md Execution/launch-questd-w-osascript.md Execution/check-for-shadowhammer-activity-implant.md Credential Access/cobalt-strike.md Privilege escalation/locate-ALPC-local-privilege-elevation-exploit.md Impact/backup-deletion.md |
| 20. | 40626732+danaim1@users.noreply.github.com | jan@geisbauer.de |
14 shared files
Campaigns/apt sofacy zebrocy.txt Campaigns/OceanLotus registry activity.txt Campaigns/apt tropictrooper.txt Persistence/scheduled task creation.txt Campaigns/Hurricane Panda activity.txt Campaigns/Elise backdoor.txt Campaigns/Equation Group C2 Communication.txt Campaigns/Judgement Panda exfil activity.txt Campaigns/APT29 thinktanks.txt Campaigns/Cloud Hopper.txt Campaigns/Dragon Fly.txt Campaigns/crime fireball.txt Campaigns/Bear Activity GTR 2019.txt Campaigns/APT Baby Shark.txt |
| 21. | makislev@microsoft.com | jan@geisbauer.de |
13 shared files
Campaigns/apt sofacy zebrocy.txt Campaigns/OceanLotus registry activity.txt Campaigns/apt tropictrooper.txt Persistence/scheduled task creation.txt Campaigns/Hurricane Panda activity.txt Campaigns/Elise backdoor.txt Campaigns/Equation Group C2 Communication.txt Campaigns/Judgement Panda exfil activity.txt Campaigns/APT29 thinktanks.txt Campaigns/Cloud Hopper.txt Campaigns/Dragon Fly.txt Campaigns/Bear Activity GTR 2019.txt Campaigns/APT Baby Shark.txt |
| 22. | 47709940+endisphotic@users.noreply.github.com | orshemesh@microsoft.com |
12 shared files
Network/Defender for Endpoint Telemetry.txt Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt Command and Control/Device network events w low count FQDN.txt Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt Lateral Movement/Device Logons from Unknown IPs.txt Credential Access/Private Key Files.txt Campaigns/Dopplepaymer In-Memory Malware Implant.txt Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt Lateral Movement/Non-local logons with -500 account.txt Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt |
| 23. | 63594865+tali-ash@users.noreply.github.com | orshemesh@microsoft.com |
12 shared files
Network/Defender for Endpoint Telemetry.txt Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt Command and Control/Device network events w low count FQDN.txt Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt Lateral Movement/Device Logons from Unknown IPs.txt Credential Access/Private Key Files.txt Campaigns/Dopplepaymer In-Memory Malware Implant.txt Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt Lateral Movement/Non-local logons with -500 account.txt Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt |
| 24. | 63594865+tali-ash@users.noreply.github.com | talpert@microsoft.com |
11 shared files
Delivery/Open email link.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 25. | 40626732+danaim1@users.noreply.github.com | talpert@microsoft.com |
11 shared files
Delivery/Open email link.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 26. | makislev@microsoft.com | talpert@microsoft.com |
11 shared files
Delivery/Open email link.txt Protection events/SmartScreen URL block ignored by user.txt Execution/PowerShell downloads.txt Delivery/Dropbox downloads linked from other site.txt Discovery/Enumeration of users & groups for lateral movement.txt Exploits/Flash-CVE-2018-4848.txt Delivery/Doc attachment with link to download.txt Exploits/Electron-CVE-2018-1000006.txt Persistence/Accessibility Features.txt Command and Control/Tor.txt Protection events/SmartScreen app block ignored by user.txt |
| 27. | 379437+bstrom@users.noreply.github.com | v-maave@microsoft.com |
11 shared files
Campaigns/c2-lookup-from-nonbrowser[Solorigate]..md Campaigns/possible-affected-software-orion[Solorigate].md Defense evasion/ADFSDomainTrustMods[Solarigate].md Campaigns/locate-dll-loaded-in-memory[Solorigate].md Persistence/NewAppOrServicePrincipalCredential[Solarigate].md Persistence/CredentialsAddAfterAdminConsentedToApp[Solorigate].md Campaigns/locate-dll-created-locally[Solorigate].md Campaigns/launching-cmd-echo[Solorigate].md Campaigns/known-affected-software-orion[Solorigate].md Campaigns/c2-lookup-response[Solorigate].md Campaigns/launching-base64-powershell[Solorigate].md |
| 28. | v-maave@microsoft.com | 47709940+endisphotic@users.noreply.github.com |
11 shared files
Delivery/Gootkit Malware Execution/umworkerprocess-unusual-subprocess-activity.md 00-query-submission-template.md Execution/umworkerprocess-creating-webshell.md README.md Credential Access/procdump-lsass-credentials.md Delivery/Gootkit-malware.md Campaigns/Bazacall/Dropping payload via certutil.md Initial access/PhishingEmailUrlRedirector.md Campaigns/Bazacall/Excel file download domain pattern.md Campaigns/snip3-malicious-network-connectivity.md |
| 29. | 47709940+endisphotic@users.noreply.github.com | 56367954+alimajalt@users.noreply.github.com |
9 shared files
Campaigns/LemonDuck/LemonDuck-control-structure.md Campaigns/LemonDuck/LemonDuck-id-generation.md Campaigns/LemonDuck/LemonDuck-component-download-structure.md Campaigns/LemonDuck/LemonDuck/LemonDuck-component-names.md Campaigns/LemonDuck/LemonDuck-email-subjects.md Campaigns/LemonDuck/LemonDuck-component-names.md Campaigns/LemonDuck/LemonDuck-defender-exclusions.md Campaigns/LemonDuck/LemonDuck-registration-function.md Campaigns/LemonDuck/LemonDuck-competition-killer.md |
| 30. | 63594865+tali-ash@users.noreply.github.com | Dolcita.Montemayor@microsoft.com |
8 shared files
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Ransomware/IcedId Delivery.md Campaigns/known-affected-software-orion[Nobelium].md Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Ransomware/IcedId attachments.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md |
| 31. | 66005183+darioongit@users.noreply.github.com | 40626732+danaim1@users.noreply.github.com |
6 shared files
Delivery/Open email link.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt General queries/Baseline Comparison.txt Protection events/Antivirus detections.txt General queries/Events surrounding alert.txt General queries/Alert Events from Internal IP Address.txt |
| 32. | 66005183+darioongit@users.noreply.github.com | makislev@microsoft.com |
6 shared files
Delivery/Open email link.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt General queries/Baseline Comparison.txt Protection events/Antivirus detections.txt General queries/Events surrounding alert.txt General queries/Alert Events from Internal IP Address.txt |
| 33. | 63594865+tali-ash@users.noreply.github.com | 56391590+morRubin@users.noreply.github.com |
6 shared files
Discovery/PasswordSearch.md Discovery/VulnComputers.md Discovery/Roasting.md Discovery/MultipleLdaps.md Discovery/SensitiveLdaps.md Discovery/MultipleSensitiveLdaps.md |
| 34. | 33941668+tomeralpert@users.noreply.github.com | 31686674+meni-braun@users.noreply.github.com |
6 shared files
Hunting Queries/Enumeration of users & groups for lateral movement.txt Hunting Queries/PowerShell downloads.txt Hunting Queries/Sticky key attacks.txt Hunting Queries/0-day Flash.txt Hunting Queries/Electron framework vulnerability.txt Hunting Queries/Persistence/Accessibility Features.txt |
| 35. | 63594865+tali-ash@users.noreply.github.com | stesell@microsoft.com |
6 shared files
Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].md Collection/Anomaly of MailItemAccess by Other Users Mailbox [Solorigate].md Defense evasion/UpdateStsRefreshToken[Solorigate].md Discovery/SuspiciousEnumerationUsingAdfind[Solarigate].md Collection/HostExportingMailboxAndRemovingExport[Solarigate].md Collection/MailItemsAccessedTimeSeries[Solarigate].md |
| 36. | 66005183+darioongit@users.noreply.github.com | v-maave@microsoft.com |
6 shared files
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Credential Access/cobalt-strike.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md |
| 37. | 63594865+tali-ash@users.noreply.github.com | 51991841+sco-sim@users.noreply.github.com |
5 shared files
General queries/MITRE - Suspicious Events.txt Protection events/AV Detections with Source.txt Protection events/AV Detections with USB Disk Drive.txt Execution/Masquerading system executable.txt General queries/Services.txt |
| 38. | 63594865+tali-ash@users.noreply.github.com | louie.mayor@microsoft.com |
5 shared files
Campaigns/DofoilNameCoinServerTraffic.txt locate-surfbuyer-downloader-decoding-activity.md README.md Campaigns/Ransomware hits healthcare - Possible compromised accounts.txt Campaigns/Ransomware hits healthcare - Backup deletion.txt |
| 39. | 63594865+tali-ash@users.noreply.github.com | matt@chromeweb.com |
5 shared files
Protection events/ExploitGuardNetworkProtectionEvents.txt Protection events/WindowsDefenderAVEvents.txt General queries/System Guard Security Level Baseline.txt General queries/System Guard Security Level Drop.txt Protection events/ExploitGuardAsrDescriptions.txt |
| 40. | 379437+bstrom@users.noreply.github.com | stesell@microsoft.com |
5 shared files
Defense evasion/PotentialMicrosoftDefenderTampering[Solarigate].md Collection/Anomaly of MailItemAccess by Other Users Mailbox [Solorigate].md Defense evasion/UpdateStsRefreshToken[Solorigate].md Discovery/SuspiciousEnumerationUsingAdfind[Solarigate].md Collection/HostExportingMailboxAndRemovingExport[Solarigate].md |
| 41. | 63594865+tali-ash@users.noreply.github.com | blstrom@microsoft.com |
5 shared files
Defense evasion/ADFSDomainTrustMods[Solarigate].md Persistence/NewAppOrServicePrincipalCredential[Solorigate].md Defense evasion/ADFSDomainTrustMods[Solorigate].md Defense evasion/MailPermissionsAddedToApplication[Solorigate].md Persistence/NewAppOrServicePrincipalCredential[Solarigate].md |
| 42. | 66005183+darioongit@users.noreply.github.com | Dolcita.Montemayor@microsoft.com |
5 shared files
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md |
| 43. | 66005183+darioongit@users.noreply.github.com | 379437+bstrom@users.noreply.github.com |
4 shared files
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Solorigate].md Campaigns/fireeye-red-team-tools-HASHs [Solorigate].md Campaigns/compromised-certificate[Solorigate].md Campaigns/fireeye-red-team-tools-CVEs [Solorigate].md |
| 44. | 66005183+darioongit@users.noreply.github.com | 33941668+TomerAlpert@users.noreply.github.com |
4 shared files
Delivery/Open email link.txt Protection events/ExploitGuardBlockOfficeChildProcess.txt Protection events/Antivirus detections.txt General queries/Events surrounding alert.txt |
| 45. | 63594865+tali-ash@users.noreply.github.com | 31686674+meni-braun@users.noreply.github.com |
4 shared files
Discovery/Discover hosts doing possible network scans.txt Protection events/ExploitGuardNetworkProtectionEvents.txt Discovery/DetectTorrentUse.txt README.md |
| 46. | 63594865+tali-ash@users.noreply.github.com | 51508845+MiladMSFT@users.noreply.github.com |
4 shared files
MTPAHCheatSheetv01-dark.pdf MTPAHCheatSheetv01-light.pdf Discovery/Detect-Not-Active-AD-User-Accounts.md Initial access/identify-potential-missed-phishing-email-campaigns.md |
| 47. | 63594865+tali-ash@users.noreply.github.com | insider-threat-feedback@cert.org |
4 shared files
Exfiltration/detect-archive-exfiltration-to-competitor.md Exfiltration/detect-steganography-exfiltration.md General queries/insider-threat-detection-queries.md Exfiltration/detect-exfiltration-after-termination.md |
| 48. | louie.mayor@microsoft.com | 47709940+endisphotic@users.noreply.github.com |
4 shared files
Execution/umworkerprocess-unusual-subprocess-activity.md Execution/umworkerprocess-creating-webshell.md README.md Credential Access/procdump-lsass-credentials.md |
| 49. | 33941668+TomerAlpert@users.noreply.github.com | mwhamiltonut@gmail.com |
4 shared files
Command and Control/ExternalDnsResolution.txt Campaigns/MacOceanLotusBackdoor.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt |
| 50. | 63594865+tali-ash@users.noreply.github.com | milada@microsoft.com |
3 shared files
Campaigns/Abusing settingcontent-ms.txt General queries/Failed Logon Attempt.txt General queries/Network footprint.txt |
| 51. | 40626732+danaim1@users.noreply.github.com | milada@microsoft.com |
3 shared files
Campaigns/Abusing settingcontent-ms.txt General queries/Failed Logon Attempt.txt General queries/Network footprint.txt |
| 52. | makislev@microsoft.com | milada@microsoft.com |
3 shared files
Campaigns/Abusing settingcontent-ms.txt General queries/Failed Logon Attempt.txt General queries/Network footprint.txt |
| 53. | 63594865+tali-ash@users.noreply.github.com | antonio.vasconcelos@gmail.com |
3 shared files
Discovery/Discover hosts doing possible network scans.txt Protection events/PUA ThreatName per Computer.txt General queries/WD AV Signature and Platform Version.txt |
| 54. | 79610537+dreadphones@users.noreply.github.com | 56367954+alimajalt@users.noreply.github.com |
3 shared files
Campaigns/Jupyter-Solarmaker/successive-tk-domain-calls.md Campaigns/Jupyter-Solarmaker/deimos-component-execution.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 55. | 63594865+tali-ash@users.noreply.github.com | 47076035+pawp81@users.noreply.github.com |
3 shared files
00-query-submission-template.md Initial access/WhenZAPed.md General/Phish and Malware received by user vs total amount of email.md |
| 56. | 63594865+tali-ash@users.noreply.github.com | 48328018+AntoineJo@users.noreply.github.com |
3 shared files
Persistence/scheduled task creation.txt Exfiltration/Data copied to other location than C:.txt Persistence/localAdminAccountLogon.txt |
| 57. | 63594865+tali-ash@users.noreply.github.com | 40575644+jing-microsoft@users.noreply.github.com |
3 shared files
General queries/Network footprint.txt General queries/File footprint.txt General queries/Alert Events from Internal IP Address.txt |
| 58. | 40626732+danaim1@users.noreply.github.com | 40575644+jing-microsoft@users.noreply.github.com |
3 shared files
General queries/Network footprint.txt General queries/File footprint.txt General queries/Alert Events from Internal IP Address.txt |
| 59. | makislev@microsoft.com | 40575644+jing-microsoft@users.noreply.github.com |
3 shared files
General queries/Network footprint.txt General queries/File footprint.txt General queries/Alert Events from Internal IP Address.txt |
| 60. | 63594865+tali-ash@users.noreply.github.com | mwhamiltonut@gmail.com |
3 shared files
Campaigns/MacOceanLotusBackdoor.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt |
| 61. | 40626732+danaim1@users.noreply.github.com | mwhamiltonut@gmail.com |
3 shared files
Campaigns/MacOceanLotusBackdoor.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt |
| 62. | makislev@microsoft.com | mwhamiltonut@gmail.com |
3 shared files
Campaigns/MacOceanLotusBackdoor.txt Campaigns/MacOceanLotusDropper.txt Execution/ExecuteBase64DecodedPayload.txt |
| 63. | 47709940+endisphotic@users.noreply.github.com | rony_123@protonmail.ch |
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md Campaigns/Bazacall/NTDS theft.md |
| 64. | 79610537+dreadphones@users.noreply.github.com | rony_123@protonmail.ch |
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md Campaigns/Bazacall/NTDS theft.md |
| 65. | 63594865+tali-ash@users.noreply.github.com | oh.jeongwook@gmail.com |
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt Exploits/AcroRd-Exploits.txt |
| 66. | 40626732+danaim1@users.noreply.github.com | oh.jeongwook@gmail.com |
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt Exploits/AcroRd-Exploits.txt |
| 67. | makislev@microsoft.com | oh.jeongwook@gmail.com |
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt Exploits/AcroRd-Exploits.txt |
| 68. | 33941668+TomerAlpert@users.noreply.github.com | louie.mayor@microsoft.com |
2 shared files
Campaigns/DofoilNameCoinServerTraffic.txt README.md |
| 69. | 40626732+danaim1@users.noreply.github.com | antonio.vasconcelos@gmail.com |
2 shared files
Discovery/Discover hosts doing possible network scans.txt General queries/WD AV Signature and Platform Version.txt |
| 70. | 40626732+danaim1@users.noreply.github.com | 31686674+meni-braun@users.noreply.github.com |
2 shared files
Discovery/Discover hosts doing possible network scans.txt Protection events/ExploitGuardNetworkProtectionEvents.txt |
| 71. | makislev@microsoft.com | antonio.vasconcelos@gmail.com |
2 shared files
Discovery/Discover hosts doing possible network scans.txt General queries/WD AV Signature and Platform Version.txt |
| 72. | makislev@microsoft.com | 31686674+meni-braun@users.noreply.github.com |
2 shared files
Discovery/Discover hosts doing possible network scans.txt Protection events/ExploitGuardNetworkProtectionEvents.txt |
| 73. | antonio.vasconcelos@gmail.com | 31686674+meni-braun@users.noreply.github.com |
2 shared files
Discovery/Discover hosts doing possible network scans.txt Discovery/Discover hosts doing possible network scans |
| 74. | 63594865+tali-ash@users.noreply.github.com | m@manuelhauch.de |
2 shared files
Execution/powershell-version-2.0-execution.md General queries/WD AV Signature and Platform Version.txt |
| 75. | 40626732+danaim1@users.noreply.github.com | matt@chromeweb.com |
2 shared files
Protection events/ExploitGuardNetworkProtectionEvents.txt Protection events/ExploitGuardAsrDescriptions.txt |
| 76. | makislev@microsoft.com | matt@chromeweb.com |
2 shared files
Protection events/ExploitGuardNetworkProtectionEvents.txt Protection events/ExploitGuardAsrDescriptions.txt |
| 77. | 379437+bstrom@users.noreply.github.com | blstrom@microsoft.com |
2 shared files
Defense evasion/ADFSDomainTrustMods[Solarigate].md Persistence/NewAppOrServicePrincipalCredential[Solarigate].md |
| 78. | v-maave@microsoft.com | blstrom@microsoft.com |
2 shared files
Defense evasion/ADFSDomainTrustMods[Solarigate].md Persistence/NewAppOrServicePrincipalCredential[Solarigate].md |
| 79. | 63594865+tali-ash@users.noreply.github.com | 45784740+YulelogPagoda@users.noreply.github.com |
2 shared files
Exploits/CVE-2021-36934 usage detection.md Exploits/printnightmare-cve-2021-1675 usage detection.md |
| 80. | 63594865+tali-ash@users.noreply.github.com | 42285038+miflower@users.noreply.github.com |
2 shared files
General queries/Baseline Comparison.txt Lateral Movement/ServiceAccountsPerformingRemotePS.txt |
| 81. | 40626732+danaim1@users.noreply.github.com | 42285038+miflower@users.noreply.github.com |
2 shared files
General queries/Baseline Comparison.txt Lateral Movement/ServiceAccountsPerformingRemotePS.txt |
| 82. | makislev@microsoft.com | 42285038+miflower@users.noreply.github.com |
2 shared files
General queries/Baseline Comparison.txt Lateral Movement/ServiceAccountsPerformingRemotePS.txt |
| 83. | 63594865+tali-ash@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
2 shared files
Campaigns/Bazacall/NTDS theft.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 84. | 63594865+tali-ash@users.noreply.github.com | 37783395+aprakash13@users.noreply.github.com |
2 shared files
Execution/Malware_In_recyclebin.txt Execution/Base64encodePEFile.txt |
| 85. | 40626732+danaim1@users.noreply.github.com | 37783395+aprakash13@users.noreply.github.com |
2 shared files
Execution/Malware_In_recyclebin.txt Execution/Base64encodePEFile.txt |
| 86. | makislev@microsoft.com | 37783395+aprakash13@users.noreply.github.com |
2 shared files
Execution/Malware_In_recyclebin.txt Execution/Base64encodePEFile.txt |
| 87. | 33941668+TomerAlpert@users.noreply.github.com | 40007564+jobaror@users.noreply.github.com |
2 shared files
Exploits/Linux-DynoRoot-CVE-2018-1111 Exploits/Linux-DynoRoot-CVE-2018-1111.txt |
| 88. | 66005183+darioongit@users.noreply.github.com | insider-threat-feedback@cert.org |
2 shared files
General queries/insider-threat-detection-queries.md Exfiltration/detect-exfiltration-after-termination.md |
| 89. | Dolcita.Montemayor@microsoft.com | 56367954+alimajalt@users.noreply.github.com |
2 shared files
Email Queries/referral-phish-emails.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 90. | 33941668+TomerAlpert@users.noreply.github.com | 31686674+meni-braun@users.noreply.github.com |
2 shared files
README.md Hunting Queries/Protection events/README.md |
| 91. | 63594865+tali-ash@users.noreply.github.com | 66407692+YoshihiroIchinose@users.noreply.github.com |
2 shared files
Exfiltration/Files copied to USB drives.md General queries/Device uptime calculation.md |
| 92. | 63594865+tali-ash@users.noreply.github.com | 23354952+Dylan-J@users.noreply.github.com |
2 shared files
Credential Access/Active Directory Sensitive Group Modifications.md Discovery/DetectTorRelayConnectivity.md |
| 93. | 63594865+tali-ash@users.noreply.github.com | 37715501+elflorio@users.noreply.github.com |
2 shared files
Exploits/Flash-CVE-2018-4848.txt Exploits/Electron-CVE-2018-1000006.txt |
| 94. | 40626732+danaim1@users.noreply.github.com | 37715501+elflorio@users.noreply.github.com |
2 shared files
Exploits/Flash-CVE-2018-4848.txt Exploits/Electron-CVE-2018-1000006.txt |
| 95. | makislev@microsoft.com | 37715501+elflorio@users.noreply.github.com |
2 shared files
Exploits/Flash-CVE-2018-4848.txt Exploits/Electron-CVE-2018-1000006.txt |
| 96. | 33941668+TomerAlpert@users.noreply.github.com | 37715501+elflorio@users.noreply.github.com |
2 shared files
Exploits/Flash-CVE-2018-4848.txt Exploits/Electron-CVE-2018-1000006.txt |
| 97. | 37715501+elflorio@users.noreply.github.com | talpert@microsoft.com |
2 shared files
Exploits/Flash-CVE-2018-4848.txt Exploits/Electron-CVE-2018-1000006.txt |
| 98. | 79610537+dreadphones@users.noreply.github.com | Dolcita.Montemayor@microsoft.com |
2 shared files
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 99. | 63594865+tali-ash@users.noreply.github.com | alex.verboon@basevision.ch |
2 shared files
Protection events/ExploitGuardControlledFolderAccess.txt Persistence/LocalAdminGroupChanges.txt |
| 100. | 66005183+darioongit@users.noreply.github.com | louie.mayor@microsoft.com |
2 shared files
Campaigns/Ransomware hits healthcare - Possible compromised accounts.txt Campaigns/Ransomware hits healthcare - Backup deletion.txt |
3 contributors (16 commits):
| # | Contributor |
First Commit |
Latest Commit |
Commits Count |
File Updates (per extension) |
|---|---|---|---|---|---|
| 1. | 63594865+tali-ash@users.noreply.github.com | 2020-04-22 | 2022-01-19 | 10 (62%) | md (7), txt (3) |
| 2. | 79610537+dreadphones@users.noreply.github.com | 2021-03-09 | 2022-01-11 | 5 (31%) | md (5) |
| 3. | 47709940+endisphotic@users.noreply.github.com | 2021-02-12 | 2022-01-11 | 1 (6%) | md (5) |
Contributor Dependencies
A contributor dependency is detected if two contributors have changed the same files in the past 30 days.
C-median: 1.0
A half of the contributors has more than 1.0 connections, and a half has less than this number.
C-mean: 1.0
An average number of connections a contributor has with other contributors.
C-index: 1.0
There are 1.0 contributors with 1.0 or more connections.
Most Connected Contributors
| Contributor | # connections | # commits | |
|---|---|---|---|
| 1. | 79610537+dreadphones@users.noreply.github.com | 1 | 5 |
| 2. | 47709940+endisphotic@users.noreply.github.com | 1 | 1 |
| 3. | 63594865+tali-ash@users.noreply.github.com | 0 | 10 |
Contributor Dependencies via Shared Files
show graph...
The number on lines shows the number of same files that both persons changed in past 30 days.
- open 3D force graph
Contributor 1
Contributor 2
# shared files
1.
47709940+endisphotic@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
5 shared files
Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md
Campaigns/Log4J/Suspicious JScript staging comment.md
Campaigns/Log4J/Alerts related to Log4j vulnerability.md
Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md
Campaigns/Log4J/Suspicious PowerShell curl flags.md
| Contributor 1 | Contributor 2 | # shared files | |
|---|---|---|---|
| 1. | 47709940+endisphotic@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
5 shared files
Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md Campaigns/Log4J/Suspicious JScript staging comment.md Campaigns/Log4J/Alerts related to Log4j vulnerability.md Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md Campaigns/Log4J/Suspicious PowerShell curl flags.md |
5 contributors (30 commits):
| # | Contributor |
First Commit |
Latest Commit |
Commits Count |
File Updates (per extension) |
|---|---|---|---|---|---|
| 1. | 63594865+tali-ash@users.noreply.github.com | 2020-04-22 | 2022-01-19 | 12 (40%) | md (9), txt (3) |
| 2. | 79610537+dreadphones@users.noreply.github.com | 2021-03-09 | 2022-01-11 | 12 (40%) | md (12) |
| 3. | 38123224+mcyr5@users.noreply.github.com | 2021-08-12 | 2021-11-02 | 3 (10%) | md (3) |
| 4. | 47709940+endisphotic@users.noreply.github.com | 2021-02-12 | 2022-01-11 | 2 (6%) | md (10) |
| 5. | 40626732+danaim1@users.noreply.github.com | 2019-06-19 | 2021-12-15 | 1 (3%) | (1) |
Contributor Dependencies
A contributor dependency is detected if two contributors have changed the same files in the past 90 days.
C-median: 1.0
A half of the contributors has more than 1.0 connections, and a half has less than this number.
C-mean: 1.3
An average number of connections a contributor has with other contributors.
C-index: 1.0
There are 1.0 contributors with 1.0 or more connections.
Most Connected Contributors
| Contributor | # connections | # commits | |
|---|---|---|---|
| 1. | 79610537+dreadphones@users.noreply.github.com | 2 | 12 |
| 2. | 38123224+mcyr5@users.noreply.github.com | 1 | 3 |
| 3. | 47709940+endisphotic@users.noreply.github.com | 1 | 2 |
| 4. | 63594865+tali-ash@users.noreply.github.com | 0 | 12 |
| 5. | 40626732+danaim1@users.noreply.github.com | 0 | 1 |
Contributor Dependencies via Shared Files
show graph...
The number on lines shows the number of same files that both persons changed in past 90 days.
- open 3D force graph
Contributor 1
Contributor 2
# shared files
1.
47709940+endisphotic@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
10 shared files
Campaigns/Qakbot/Qakbot Craigslist Domains.md
Campaigns/Qakbot/General attempts to access local email store.md
Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md
Campaigns/Qakbot/Qakbot reconnaissance activities.md
Campaigns/Log4J/Suspicious JScript staging comment.md
Campaigns/Qakbot/Excel launching anomalous processes.md
Campaigns/Qakbot/Qakbot email theft.md
Campaigns/Log4J/Alerts related to Log4j vulnerability.md
Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md
Campaigns/Log4J/Suspicious PowerShell curl flags.md
2.
79610537+dreadphones@users.noreply.github.com
38123224+mcyr5@users.noreply.github.com
1 shared file
Delivery/Qakbot Craigslist Domains.md
| Contributor 1 | Contributor 2 | # shared files | |
|---|---|---|---|
| 1. | 47709940+endisphotic@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
10 shared files
Campaigns/Qakbot/Qakbot Craigslist Domains.md Campaigns/Qakbot/General attempts to access local email store.md Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md Campaigns/Qakbot/Qakbot reconnaissance activities.md Campaigns/Log4J/Suspicious JScript staging comment.md Campaigns/Qakbot/Excel launching anomalous processes.md Campaigns/Qakbot/Qakbot email theft.md Campaigns/Log4J/Alerts related to Log4j vulnerability.md Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md Campaigns/Log4J/Suspicious PowerShell curl flags.md |
| 2. | 79610537+dreadphones@users.noreply.github.com | 38123224+mcyr5@users.noreply.github.com |
1 shared file
Delivery/Qakbot Craigslist Domains.md |
9 contributors (97 commits):
| # | Contributor |
First Commit |
Latest Commit |
Commits Count |
|---|---|---|---|---|
| 1. | 79610537+dreadphones@users.noreply.github.com | 2021-03-09 | 2022-01-11 | 29 (29%) |
| 2. | 56367954+alimajalt@users.noreply.github.com | 2021-07-29 | 2021-08-18 | 20 (20%) |
| 3. | 63594865+tali-ash@users.noreply.github.com | 2020-04-22 | 2022-01-19 | 16 (16%) |
| 4. | 47709940+endisphotic@users.noreply.github.com | 2021-02-12 | 2022-01-11 | 16 (16%) |
| 5. | 38123224+mcyr5@users.noreply.github.com | 2021-08-12 | 2021-11-02 | 6 (6%) |
| 6. | Iveco@users.noreply.github.com | 2021-08-17 | 2021-08-17 | 5 (5%) |
| 7. | 64156578+mjmelone@users.noreply.github.com | 2020-04-22 | 2021-10-11 | 3 (3%) |
| 8. | 40626732+danaim1@users.noreply.github.com | 2019-06-19 | 2021-12-15 | 1 (1%) |
| 9. | iveco@gmx.net | 2021-08-17 | 2021-08-17 | 1 (1%) |
Contributor Dependencies
A contributor dependency is detected if two contributors have changed the same files in the past 180 days.
C-median: 2.0
A half of the contributors has more than 2.0 connections, and a half has less than this number.
C-mean: 2.2
An average number of connections a contributor has with other contributors.
C-index: 2.0
There are 2.0 contributors with 2.0 or more connections.
Most Connected Contributors
| Contributor | # connections | # commits | |
|---|---|---|---|
| 1. | 79610537+dreadphones@users.noreply.github.com | 3 | 29 |
| 2. | 63594865+tali-ash@users.noreply.github.com | 3 | 16 |
| 3. | 47709940+endisphotic@users.noreply.github.com | 3 | 16 |
| 4. | 56367954+alimajalt@users.noreply.github.com | 2 | 20 |
| 5. | 38123224+mcyr5@users.noreply.github.com | 2 | 6 |
| 6. | Iveco@users.noreply.github.com | 2 | 5 |
| 7. | iveco@gmx.net | 2 | 1 |
| 8. | 64156578+mjmelone@users.noreply.github.com | 1 | 3 |
| 9. | 40626732+danaim1@users.noreply.github.com | 0 | 1 |
Contributor Dependencies via Shared Files
show graph...
The number on lines shows the number of same files that both persons changed in past 180 days.
- open 3D force graph
Contributor 1
Contributor 2
# shared files
1.
47709940+endisphotic@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
22 shared files
Campaigns/Qakbot/Qakbot Craigslist Domains.md
Campaigns/Qakbot/Excel launching anomalous processes.md
Campaigns/Bazarloader/Zip-Doc - Creation of JPG Payload File.md
Campaigns/Macaw Ransomware/Mass account password change.md
Campaigns/ZLoader/Suspicious Registry Keys.md
Campaigns/Qakbot/General attempts to access local email store.md
Campaigns/Macaw Ransomware/Inhibit recovery by disabling tools and functionality.md
Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md
Campaigns/Qakbot/Qakbot reconnaissance activities.md
Campaigns/Qakbot/Qakbot email theft.md
Campaigns/Log4J/Alerts related to Log4j vulnerability.md
Campaigns/Macaw Ransomware/Imminent Ransomware.md
Campaigns/Log4J/Suspicious PowerShell curl flags.md
Campaigns/ZLoader/Payload Delivery.md
Campaigns/Macaw Ransomware/Disable Controlled Folders.md
Campaigns/Macaw Ransomware/Use of MSBuild as LOLBin.md
Campaigns/Log4J/Suspicious JScript staging comment.md
Campaigns/Bazarloader/Stolen Images Execution.md
Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md
Campaigns/ZLoader/Malicious bat file.md
Campaigns/Bazarloader/Zip-Doc - Word Launching MSHTA.md
Campaigns/Macaw Ransomware/PSExec Attrib commands.md
2.
47709940+endisphotic@users.noreply.github.com
56367954+alimajalt@users.noreply.github.com
9 shared files
Campaigns/LemonDuck/LemonDuck-control-structure.md
Campaigns/LemonDuck/LemonDuck/LemonDuck-component-names.md
Campaigns/LemonDuck/LemonDuck-id-generation.md
Campaigns/LemonDuck/LemonDuck-registration-function.md
Campaigns/LemonDuck/LemonDuck-competition-killer.md
Campaigns/LemonDuck/LemonDuck-component-names.md
Campaigns/LemonDuck/LemonDuck-component-download-structure.md
Campaigns/LemonDuck/LemonDuck-defender-exclusions.md
Campaigns/LemonDuck/LemonDuck-email-subjects.md
3.
79610537+dreadphones@users.noreply.github.com
56367954+alimajalt@users.noreply.github.com
3 shared files
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/Jupyter-Solarmaker/deimos-component-execution.md
Campaigns/Jupyter-Solarmaker/successive-tk-domain-calls.md
4.
63594865+tali-ash@users.noreply.github.com
64156578+mjmelone@users.noreply.github.com
3 shared files
Webcasts/Airlift 2021 - Lets Invoke.csl
Webcasts/l33tSpeak/l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl
Troubleshooting/Connectivity Failures by Device.md
5.
63594865+tali-ash@users.noreply.github.com
Iveco@users.noreply.github.com
1 shared file
Command and Control/C2-NamedPipe.md
6.
63594865+tali-ash@users.noreply.github.com
iveco@gmx.net
1 shared file
Command and Control/C2-NamedPipe.md
7.
Iveco@users.noreply.github.com
iveco@gmx.net
1 shared file
Command and Control/C2-NamedPipe.md
8.
47709940+endisphotic@users.noreply.github.com
38123224+mcyr5@users.noreply.github.com
1 shared file
Email Queries/JNLP-File-Attachment.md
9.
79610537+dreadphones@users.noreply.github.com
38123224+mcyr5@users.noreply.github.com
1 shared file
Delivery/Qakbot Craigslist Domains.md
| Contributor 1 | Contributor 2 | # shared files | |
|---|---|---|---|
| 1. | 47709940+endisphotic@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
22 shared files
Campaigns/Qakbot/Qakbot Craigslist Domains.md Campaigns/Qakbot/Excel launching anomalous processes.md Campaigns/Bazarloader/Zip-Doc - Creation of JPG Payload File.md Campaigns/Macaw Ransomware/Mass account password change.md Campaigns/ZLoader/Suspicious Registry Keys.md Campaigns/Qakbot/General attempts to access local email store.md Campaigns/Macaw Ransomware/Inhibit recovery by disabling tools and functionality.md Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md Campaigns/Qakbot/Qakbot reconnaissance activities.md Campaigns/Qakbot/Qakbot email theft.md Campaigns/Log4J/Alerts related to Log4j vulnerability.md Campaigns/Macaw Ransomware/Imminent Ransomware.md Campaigns/Log4J/Suspicious PowerShell curl flags.md Campaigns/ZLoader/Payload Delivery.md Campaigns/Macaw Ransomware/Disable Controlled Folders.md Campaigns/Macaw Ransomware/Use of MSBuild as LOLBin.md Campaigns/Log4J/Suspicious JScript staging comment.md Campaigns/Bazarloader/Stolen Images Execution.md Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md Campaigns/ZLoader/Malicious bat file.md Campaigns/Bazarloader/Zip-Doc - Word Launching MSHTA.md Campaigns/Macaw Ransomware/PSExec Attrib commands.md |
| 2. | 47709940+endisphotic@users.noreply.github.com | 56367954+alimajalt@users.noreply.github.com |
9 shared files
Campaigns/LemonDuck/LemonDuck-control-structure.md Campaigns/LemonDuck/LemonDuck/LemonDuck-component-names.md Campaigns/LemonDuck/LemonDuck-id-generation.md Campaigns/LemonDuck/LemonDuck-registration-function.md Campaigns/LemonDuck/LemonDuck-competition-killer.md Campaigns/LemonDuck/LemonDuck-component-names.md Campaigns/LemonDuck/LemonDuck-component-download-structure.md Campaigns/LemonDuck/LemonDuck-defender-exclusions.md Campaigns/LemonDuck/LemonDuck-email-subjects.md |
| 3. | 79610537+dreadphones@users.noreply.github.com | 56367954+alimajalt@users.noreply.github.com |
3 shared files
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/Jupyter-Solarmaker/deimos-component-execution.md Campaigns/Jupyter-Solarmaker/successive-tk-domain-calls.md |
| 4. | 63594865+tali-ash@users.noreply.github.com | 64156578+mjmelone@users.noreply.github.com |
3 shared files
Webcasts/Airlift 2021 - Lets Invoke.csl Webcasts/l33tSpeak/l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl Troubleshooting/Connectivity Failures by Device.md |
| 5. | 63594865+tali-ash@users.noreply.github.com | Iveco@users.noreply.github.com |
1 shared file
Command and Control/C2-NamedPipe.md |
| 6. | 63594865+tali-ash@users.noreply.github.com | iveco@gmx.net |
1 shared file
Command and Control/C2-NamedPipe.md |
| 7. | Iveco@users.noreply.github.com | iveco@gmx.net |
1 shared file
Command and Control/C2-NamedPipe.md |
| 8. | 47709940+endisphotic@users.noreply.github.com | 38123224+mcyr5@users.noreply.github.com |
1 shared file
Email Queries/JNLP-File-Attachment.md |
| 9. | 79610537+dreadphones@users.noreply.github.com | 38123224+mcyr5@users.noreply.github.com |
1 shared file
Delivery/Qakbot Craigslist Domains.md |
24 contributors (337 commits):
| # | Contributor |
First Commit |
Latest Commit |
Commits Count |
|---|---|---|---|---|
| 1. | 47709940+endisphotic@users.noreply.github.com | 2021-02-12 | 2022-01-11 | 80 (23%) |
| 2. | 63594865+tali-ash@users.noreply.github.com | 2020-04-22 | 2022-01-19 | 76 (22%) |
| 3. | 79610537+dreadphones@users.noreply.github.com | 2021-03-09 | 2022-01-11 | 54 (16%) |
| 4. | v-maave@microsoft.com | 2020-05-14 | 2021-07-09 | 36 (10%) |
| 5. | 56367954+alimajalt@users.noreply.github.com | 2021-07-29 | 2021-08-18 | 22 (6%) |
| 6. | Dolcita.Montemayor@microsoft.com | 2021-03-09 | 2021-07-30 | 13 (3%) |
| 7. | 64156578+mjmelone@users.noreply.github.com | 2020-04-22 | 2021-10-11 | 11 (3%) |
| 8. | 66005183+darioongit@users.noreply.github.com | 2020-12-22 | 2021-07-08 | 9 (2%) |
| 9. | louie.mayor@microsoft.com | 2018-04-03 | 2021-03-05 | 6 (1%) |
| 10. | 38123224+mcyr5@users.noreply.github.com | 2021-08-12 | 2021-11-02 | 6 (1%) |
| 11. | Iveco@users.noreply.github.com | 2021-08-17 | 2021-08-17 | 5 (1%) |
| 12. | 45784740+YulelogPagoda@users.noreply.github.com | 2021-07-01 | 2021-07-21 | 3 (<1%) |
| 13. | 66407692+YoshihiroIchinose@users.noreply.github.com | 2020-10-21 | 2021-06-09 | 2 (<1%) |
| 14. | 23354952+Dylan-J@users.noreply.github.com | 2021-01-06 | 2021-03-03 | 2 (<1%) |
| 15. | 66640150+Shivammalaviya@users.noreply.github.com | 2021-07-19 | 2021-07-21 | 2 (<1%) |
| 16. | rony_123@protonmail.ch | 2021-06-23 | 2021-06-23 | 2 (<1%) |
| 17. | 40626732+danaim1@users.noreply.github.com | 2019-06-19 | 2021-12-15 | 1 (<1%) |
| 18. | anvascon@microsoft.com | 2020-04-20 | 2021-02-17 | 1 (<1%) |
| 19. | iveco@gmx.net | 2021-08-17 | 2021-08-17 | 1 (<1%) |
| 20. | yujiao@microsoft.com | 2021-07-15 | 2021-07-15 | 1 (<1%) |
| 21. | powell.mike@gmail.com | 2021-07-12 | 2021-07-12 | 1 (<1%) |
| 22. | HeathL17@users.noreply.github.com | 2021-03-23 | 2021-03-23 | 1 (<1%) |
| 23. | 65675989+julihooper@users.noreply.github.com | 2021-03-19 | 2021-03-19 | 1 (<1%) |
| 24. | orshemesh@microsoft.com | 2021-02-22 | 2021-02-22 | 1 (<1%) |
Contributor Dependencies
A contributor dependency is detected if two contributors have changed the same files in the past 365 days.
C-median: 3.0
A half of the contributors has more than 3.0 connections, and a half has less than this number.
C-mean: 4.1
An average number of connections a contributor has with other contributors.
C-index: 5.0
There are 5.0 contributors with 5.0 or more connections.
Most Connected Contributors
| Contributor | # connections | # commits | |
|---|---|---|---|
| 1. | 63594865+tali-ash@users.noreply.github.com | 19 | 76 |
| 2. | 47709940+endisphotic@users.noreply.github.com | 10 | 80 |
| 3. | 79610537+dreadphones@users.noreply.github.com | 8 | 54 |
| 4. | v-maave@microsoft.com | 7 | 36 |
| 5. | Dolcita.Montemayor@microsoft.com | 7 | 13 |
| 6. | 56367954+alimajalt@users.noreply.github.com | 6 | 22 |
| 7. | 66005183+darioongit@users.noreply.github.com | 5 | 9 |
| 8. | 64156578+mjmelone@users.noreply.github.com | 3 | 11 |
| 9. | rony_123@protonmail.ch | 3 | 2 |
| 10. | yujiao@microsoft.com | 3 | 1 |
| 11. | powell.mike@gmail.com | 3 | 1 |
| 12. | 65675989+julihooper@users.noreply.github.com | 3 | 1 |
| 13. | louie.mayor@microsoft.com | 2 | 6 |
| 14. | 38123224+mcyr5@users.noreply.github.com | 2 | 6 |
| 15. | Iveco@users.noreply.github.com | 2 | 5 |
| 16. | iveco@gmx.net | 2 | 1 |
| 17. | orshemesh@microsoft.com | 2 | 1 |
| 18. | 45784740+YulelogPagoda@users.noreply.github.com | 1 | 3 |
| 19. | 66407692+YoshihiroIchinose@users.noreply.github.com | 1 | 2 |
| 20. | 23354952+Dylan-J@users.noreply.github.com | 1 | 2 |
| 21. | anvascon@microsoft.com | 1 | 1 |
| 22. | HeathL17@users.noreply.github.com | 1 | 1 |
| 23. | 66640150+Shivammalaviya@users.noreply.github.com | 0 | 2 |
| 24. | 40626732+danaim1@users.noreply.github.com | 0 | 1 |
Contributor Dependencies via Shared Files
show graph...
The number on lines shows the number of same files that both persons changed in past 365 days.
- open 3D force graph
Contributor 1
Contributor 2
# shared files
1.
Dolcita.Montemayor@microsoft.com
v-maave@microsoft.com
44 shared files
Command and Control/DNSPattern [Nobelium].md
Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Nobelium].md
Campaigns/fireeye-red-team-tools-HASHs [Nobelium].md
Persistence/CredentialsAddAfterAdminConsentedToApp[Nobelium].md
Defense evasion/Discovering potentially tampered devices [Nobelium].md
Privilege escalation/ServicePrincipalAddedToRole [Nobelium].md
Campaigns/detectsanboxie-function-call-snip3.md
Exfiltration/MailItemsAccessed Throttling [Nobelium].md
Defense evasion/ADFSDomainTrustMods[Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/encoded-powershell-structure-snip3.md
Discovery/SuspiciousEnumerationUsingAdfind[Nobelium].md
Campaigns/aviation-targeting-emails-snip3.md
Command and Control/EncodedDomainURL [Nobelium].md
Campaigns/malicious-network-connectivity-snip3.md
Campaigns/locate-dll-loaded-in-memory[Nobelium].md
Campaigns/snip3-detectsanboxie-function-call.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Persistence/NewAppOrServicePrincipalCredential[Nobelium].md
Exfiltration/Anomaly of MailItemAccess by GraphAPI [Nobelium].md
Campaigns/compromised-certificate[Nobelium].md
Campaigns/launching-base64-powershell[Nobelium].md
Campaigns/c2-lookup-response[Nobelium].md
Exfiltration/OAuth Apps reading mail both via GraphAPI and directly [Nobelium].md
Campaigns/locate-dll-created-locally[Nobelium].md
Campaigns/snip3-encoded-powershell-structure.md
Campaigns/jupyter-solarmarker-evasive-powershell-strings.md
Campaigns/snip3-aviation-targeting-emails.md
Campaigns/launching-cmd-echo[Nobelium].md
Campaigns/c2-lookup-from-nonbrowser[Nobelium].md
Campaigns/cypherpunk-exclusive-commands.md
Campaigns/jupyter-solarmarker-evasive-powershell-executions.md
Campaigns/snip3-revengerat-c2-exfiltration.md
Campaigns/cypherpunk-remote-exec-w-psexesvc.md
Collection/Anomaly of MailItemAccess by Other Users Mailbox [Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Privilege escalation/dell-driver-vulnerability-2021.md
Campaigns/revengerat-c2-exfiltration-snip3.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
Campaigns/snip3-malicious-network-connectivity.md
Privilege escalation/Add uncommon credential type to application [Nobelium].md
Defense evasion/MailPermissionsAddedToApplication[Nobelium].md
Exfiltration/OAuth Apps accessing user mail via GraphAPI [Nobelium].md
2.
47709940+endisphotic@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
38 shared files
Campaigns/Qakbot/Qakbot Craigslist Domains.md
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md
Email Queries/Appspot Phishing Abuse.md
Campaigns/Qakbot/Qakbot reconnaissance activities.md
Campaigns/Log4J/Alerts related to Log4j vulnerability.md
Campaigns/Macaw Ransomware/Imminent Ransomware.md
Campaigns/Macaw Ransomware/Use of MSBuild as LOLBin.md
Campaigns/Bazacall/Renamed Rclone Exfil.md
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md
Campaigns/Bazacall/Cobalt Strike Lateral Movement
Campaigns/Bazacall/Bazacall Emails.md
Email Queries/Appspot Phishing Abuse
Campaigns/Bazacall/RunDLL Suspicious Network Connection.md
Campaigns/Macaw Ransomware/Mass account password change.md
Campaigns/Macaw Ransomware/Inhibit recovery by disabling tools and functionality.md
Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md
Campaigns/Qakbot/Qakbot email theft.md
Campaigns/Log4J/Suspicious PowerShell curl flags.md
Campaigns/Bazacall/Malicious Excel Delivery.md
Campaigns/StrRAT malware/StrRAT-Email-Delivery.md
Campaigns/StrRAT malware/StrRAT-Email-Delivery
Campaigns/Bazacall/NTDS theft.md
Campaigns/ZLoader/Suspicious Registry Keys.md
Campaigns/Qakbot/General attempts to access local email store.md
Campaigns/ZLoader/Payload Delivery.md
Campaigns/Macaw Ransomware/Disable Controlled Folders.md
Campaigns/Log4J/Suspicious JScript staging comment.md
Campaigns/Bazacall/Excel Macro Execution.md
Campaigns/ZLoader/Malicious bat file.md
Campaigns/Macaw Ransomware/PSExec Attrib commands.md
Campaigns/Qakbot/Excel launching anomalous processes.md
Campaigns/Bazarloader/Zip-Doc - Creation of JPG Payload File.md
Email Queries/PhishingEmailUrlRedirector.md
Campaigns/StrRAT malware/StrRAT-AV-Discovery.md
Campaigns/Bazarloader/Stolen Images Execution.md
Campaigns/StrRAT malware/StrRAT-Malware-Persistence.md
Campaigns/Bazarloader/Zip-Doc - Word Launching MSHTA.md
3.
47709940+endisphotic@users.noreply.github.com
63594865+tali-ash@users.noreply.github.com
28 shared files
Network/Defender for Endpoint Telemetry.txt
Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt
Delivery/Gootkit-malware.md
General queries/MD AV Signature and Platform Version.txt
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
Ransomware/Backup deletion.md
Command and Control/Device network events w low count FQDN.txt
00-query-submission-template.md
Ransomware/Stopping multiple processes using taskkill.md
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt
Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt
Campaigns/Bazacall/NTDS theft.md
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt
Lateral Movement/Non-local logons with -500 account.txt
Ransomware/Clearing of forensic evidence from event logs using wevtutil.md
Lateral Movement/Device Logons from Unknown IPs.txt
Initial access/PhishingEmailUrlRedirector.md
Ransomware/Stopping processes using net stop.md
Credential Access/Private Key Files.txt
Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt
Campaigns/Dopplepaymer In-Memory Malware Implant.txt
Ransomware/IcedId attachments.md
Ransomware/Turning off services using sc exe.md
Ransomware/Deletion of data on multiple drives using cipher exe.md
Ransomware/IcedId Delivery.md
Ransomware/Turning off System Restore.md
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt
Ransomware/Check for multiple signs of ransomware activity.md
4.
Dolcita.Montemayor@microsoft.com
47709940+endisphotic@users.noreply.github.com
22 shared files
Ransomware/Qakbot discovery activies.md
Exploits/Print Spooler RCE/Suspicious DLLs in spool folder.md
Ransomware/IcedId email delivery.md
Ransomware/LaZagne Credential Theft.md
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
Ransomware/Suspicious Image Load related to IcedId.md
Ransomware/Fake Replies.md
Ransomware/HTA Startup Persistence.md
Ransomware/Suspicious Bitlocker Encryption.md
Ransomware/Gootkit File Delivery.md
Ransomware/Potential ransomware activity related to Cobalt Strike.md
Ransomware/Sticky Keys.md
Ransomware/Distribution from remote location.md
Ransomware/IcedId attachments.md
Ransomware/File Backup Deletion Alerts.md
Ransomware/DarkSide.md
Ransomware/IcedId Delivery.md
Ransomware/Suspicious Google Doc Links.md
Ransomware/Discovery for highly-privileged accounts.md
Campaigns/snip3-malicious-network-connectivity.md
Exploits/Print Spooler RCE/Suspicious files in spool folder.md
5.
63594865+tali-ash@users.noreply.github.com
v-maave@microsoft.com
13 shared files
Delivery/Gootkit-malware.md
Campaigns/Sysrv-botnet/oracle-webLogic-executing-powershell.md
Campaigns/Sysrv-botnet/tomcat-8-executing-powershell.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Initial access/PhishingEmailUrlRedirector.md
Campaigns/Sysrv-botnet/rce-on-vulnerable-server.md
Campaigns/Sysrv-botnet/java-executing-cmd-to-run-powershell.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
Campaigns/Sysrv-botnet/kinsing-miner-download.md
Campaigns/Sysrv-botnet/app-armor-stopped.md
6.
47709940+endisphotic@users.noreply.github.com
orshemesh@microsoft.com
12 shared files
Network/Defender for Endpoint Telemetry.txt
Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt
Command and Control/Device network events w low count FQDN.txt
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt
Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt
Lateral Movement/Non-local logons with -500 account.txt
Lateral Movement/Device Logons from Unknown IPs.txt
Credential Access/Private Key Files.txt
Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt
Campaigns/Dopplepaymer In-Memory Malware Implant.txt
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt
7.
63594865+tali-ash@users.noreply.github.com
orshemesh@microsoft.com
12 shared files
Network/Defender for Endpoint Telemetry.txt
Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt
Command and Control/Device network events w low count FQDN.txt
Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt
Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt
Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt
Lateral Movement/Non-local logons with -500 account.txt
Lateral Movement/Device Logons from Unknown IPs.txt
Credential Access/Private Key Files.txt
Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt
Campaigns/Dopplepaymer In-Memory Malware Implant.txt
Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt
8.
47709940+endisphotic@users.noreply.github.com
v-maave@microsoft.com
10 shared files
Delivery/Gootkit-malware.md
Delivery/Gootkit Malware
Execution/umworkerprocess-unusual-subprocess-activity.md
Campaigns/Bazacall/Dropping payload via certutil.md
Initial access/PhishingEmailUrlRedirector.md
Execution/umworkerprocess-creating-webshell.md
Campaigns/Bazacall/Excel file download domain pattern.md
README.md
Credential Access/procdump-lsass-credentials.md
Campaigns/snip3-malicious-network-connectivity.md
9.
47709940+endisphotic@users.noreply.github.com
56367954+alimajalt@users.noreply.github.com
9 shared files
Campaigns/LemonDuck/LemonDuck-control-structure.md
Campaigns/LemonDuck/LemonDuck-id-generation.md
Campaigns/LemonDuck/LemonDuck-component-download-structure.md
Campaigns/LemonDuck/LemonDuck/LemonDuck-component-names.md
Campaigns/LemonDuck/LemonDuck-defender-exclusions.md
Campaigns/LemonDuck/LemonDuck-email-subjects.md
Campaigns/LemonDuck/LemonDuck-registration-function.md
Campaigns/LemonDuck/LemonDuck-competition-killer.md
Campaigns/LemonDuck/LemonDuck-component-names.md
10.
63594865+tali-ash@users.noreply.github.com
66005183+darioongit@users.noreply.github.com
9 shared files
Protection events/ExploitGuardBlockOfficeChildProcess.txt
TVM/devices_with_vuln_and_users_received_payload.md
M365-PowerBi Dashboard/readme.txt
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
General queries/insider-threat-detection-queries.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
11.
63594865+tali-ash@users.noreply.github.com
64156578+mjmelone@users.noreply.github.com
8 shared files
Webcasts/Airlift 2021 - Lets Invoke.csl
General queries/Detect Azure RemoteIP.md
Execution/Detect PowerShell v2 Downgrade.md
Exfiltration/Possible File Copy to USB Drive.md
Webcasts/l33tSpeak/l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl
General queries/MD AV Signature and Platform Version.md
Campaigns/Abuse.ch Recent Threat Feed.md
Troubleshooting/Connectivity Failures by Device.md
12.
63594865+tali-ash@users.noreply.github.com
Dolcita.Montemayor@microsoft.com
8 shared files
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Ransomware/IcedId attachments.md
Ransomware/IcedId Delivery.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
13.
louie.mayor@microsoft.com
v-maave@microsoft.com
7 shared files
Execution/reverse-shell-nishang.md
Exfiltration/7-zip-prep-for-exfiltration.md
Execution/umworkerprocess-unusual-subprocess-activity.md
Delivery/powercat-download.md
Execution/umworkerprocess-creating-webshell.md
Credential Access/procdump-lsass-credentials.md
Exfiltration/exchange-powershell-snapin-loaded.md
14.
66005183+darioongit@users.noreply.github.com
Dolcita.Montemayor@microsoft.com
5 shared files
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
15.
66005183+darioongit@users.noreply.github.com
v-maave@microsoft.com
5 shared files
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md
Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
Campaigns/possible-affected-software-orion[Nobelium].md
Campaigns/known-affected-software-orion[Nobelium].md
16.
79610537+dreadphones@users.noreply.github.com
56367954+alimajalt@users.noreply.github.com
3 shared files
Campaigns/Jupyter-Solarmaker/successive-tk-domain-calls.md
Campaigns/Jupyter-Solarmaker/deimos-component-execution.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
17.
louie.mayor@microsoft.com
47709940+endisphotic@users.noreply.github.com
3 shared files
Execution/umworkerprocess-unusual-subprocess-activity.md
Execution/umworkerprocess-creating-webshell.md
Credential Access/procdump-lsass-credentials.md
18.
47709940+endisphotic@users.noreply.github.com
rony_123@protonmail.ch
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md
Campaigns/Bazacall/NTDS theft.md
19.
79610537+dreadphones@users.noreply.github.com
rony_123@protonmail.ch
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md
Campaigns/Bazacall/NTDS theft.md
20.
79610537+dreadphones@users.noreply.github.com
Dolcita.Montemayor@microsoft.com
2 shared files
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
21.
63594865+tali-ash@users.noreply.github.com
45784740+YulelogPagoda@users.noreply.github.com
2 shared files
Exploits/CVE-2021-36934 usage detection.md
Exploits/printnightmare-cve-2021-1675 usage detection.md
22.
63594865+tali-ash@users.noreply.github.com
79610537+dreadphones@users.noreply.github.com
2 shared files
Campaigns/Bazacall/NTDS theft.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
23.
Dolcita.Montemayor@microsoft.com
56367954+alimajalt@users.noreply.github.com
2 shared files
Email Queries/referral-phish-emails.md
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
24.
63594865+tali-ash@users.noreply.github.com
23354952+Dylan-J@users.noreply.github.com
1 shared file
Credential Access/Active Directory Sensitive Group Modifications.md
25.
63594865+tali-ash@users.noreply.github.com
powell.mike@gmail.com
1 shared file
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
26.
powell.mike@gmail.com
Dolcita.Montemayor@microsoft.com
1 shared file
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
27.
powell.mike@gmail.com
47709940+endisphotic@users.noreply.github.com
1 shared file
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md
28.
47709940+endisphotic@users.noreply.github.com
38123224+mcyr5@users.noreply.github.com
1 shared file
Email Queries/JNLP-File-Attachment.md
29.
63594865+tali-ash@users.noreply.github.com
66407692+YoshihiroIchinose@users.noreply.github.com
1 shared file
General queries/Device uptime calculation.md
30.
79610537+dreadphones@users.noreply.github.com
38123224+mcyr5@users.noreply.github.com
1 shared file
Delivery/Qakbot Craigslist Domains.md
31.
63594865+tali-ash@users.noreply.github.com
rony_123@protonmail.ch
1 shared file
Campaigns/Bazacall/NTDS theft.md
32.
63594865+tali-ash@users.noreply.github.com
Iveco@users.noreply.github.com
1 shared file
Command and Control/C2-NamedPipe.md
33.
63594865+tali-ash@users.noreply.github.com
iveco@gmx.net
1 shared file
Command and Control/C2-NamedPipe.md
34.
Iveco@users.noreply.github.com
iveco@gmx.net
1 shared file
Command and Control/C2-NamedPipe.md
35.
64156578+mjmelone@users.noreply.github.com
yujiao@microsoft.com
1 shared file
General queries/MD AV Signature and Platform Version.md
36.
64156578+mjmelone@users.noreply.github.com
65675989+julihooper@users.noreply.github.com
1 shared file
General queries/MD AV Signature and Platform Version.md
37.
yujiao@microsoft.com
63594865+tali-ash@users.noreply.github.com
1 shared file
General queries/MD AV Signature and Platform Version.md
38.
yujiao@microsoft.com
65675989+julihooper@users.noreply.github.com
1 shared file
General queries/MD AV Signature and Platform Version.md
39.
63594865+tali-ash@users.noreply.github.com
65675989+julihooper@users.noreply.github.com
1 shared file
General queries/MD AV Signature and Platform Version.md
40.
79610537+dreadphones@users.noreply.github.com
66005183+darioongit@users.noreply.github.com
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
41.
79610537+dreadphones@users.noreply.github.com
v-maave@microsoft.com
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
42.
56367954+alimajalt@users.noreply.github.com
63594865+tali-ash@users.noreply.github.com
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
43.
56367954+alimajalt@users.noreply.github.com
66005183+darioongit@users.noreply.github.com
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
44.
56367954+alimajalt@users.noreply.github.com
v-maave@microsoft.com
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md
45.
63594865+tali-ash@users.noreply.github.com
anvascon@microsoft.com
1 shared file
General queries/WD AV Signature and Platform Version.txt
46.
63594865+tali-ash@users.noreply.github.com
HeathL17@users.noreply.github.com
1 shared file
Exfiltration/Files copied to USB drives.md
| Contributor 1 | Contributor 2 | # shared files | |
|---|---|---|---|
| 1. | Dolcita.Montemayor@microsoft.com | v-maave@microsoft.com |
44 shared files
Command and Control/DNSPattern [Nobelium].md Exfiltration/OAuth Apps reading mail via GraphAPI anomaly [Nobelium].md Campaigns/fireeye-red-team-tools-HASHs [Nobelium].md Persistence/CredentialsAddAfterAdminConsentedToApp[Nobelium].md Defense evasion/Discovering potentially tampered devices [Nobelium].md Privilege escalation/ServicePrincipalAddedToRole [Nobelium].md Campaigns/detectsanboxie-function-call-snip3.md Exfiltration/MailItemsAccessed Throttling [Nobelium].md Defense evasion/ADFSDomainTrustMods[Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/encoded-powershell-structure-snip3.md Discovery/SuspiciousEnumerationUsingAdfind[Nobelium].md Campaigns/aviation-targeting-emails-snip3.md Command and Control/EncodedDomainURL [Nobelium].md Campaigns/malicious-network-connectivity-snip3.md Campaigns/locate-dll-loaded-in-memory[Nobelium].md Campaigns/snip3-detectsanboxie-function-call.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Persistence/NewAppOrServicePrincipalCredential[Nobelium].md Exfiltration/Anomaly of MailItemAccess by GraphAPI [Nobelium].md Campaigns/compromised-certificate[Nobelium].md Campaigns/launching-base64-powershell[Nobelium].md Campaigns/c2-lookup-response[Nobelium].md Exfiltration/OAuth Apps reading mail both via GraphAPI and directly [Nobelium].md Campaigns/locate-dll-created-locally[Nobelium].md Campaigns/snip3-encoded-powershell-structure.md Campaigns/jupyter-solarmarker-evasive-powershell-strings.md Campaigns/snip3-aviation-targeting-emails.md Campaigns/launching-cmd-echo[Nobelium].md Campaigns/c2-lookup-from-nonbrowser[Nobelium].md Campaigns/cypherpunk-exclusive-commands.md Campaigns/jupyter-solarmarker-evasive-powershell-executions.md Campaigns/snip3-revengerat-c2-exfiltration.md Campaigns/cypherpunk-remote-exec-w-psexesvc.md Collection/Anomaly of MailItemAccess by Other Users Mailbox [Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Privilege escalation/dell-driver-vulnerability-2021.md Campaigns/revengerat-c2-exfiltration-snip3.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md Campaigns/snip3-malicious-network-connectivity.md Privilege escalation/Add uncommon credential type to application [Nobelium].md Defense evasion/MailPermissionsAddedToApplication[Nobelium].md Exfiltration/OAuth Apps accessing user mail via GraphAPI [Nobelium].md |
| 2. | 47709940+endisphotic@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
38 shared files
Campaigns/Qakbot/Qakbot Craigslist Domains.md Campaigns/Bazacall/Cobalt Strike Lateral Movement.md Email Queries/Appspot Phishing Abuse.md Campaigns/Qakbot/Qakbot reconnaissance activities.md Campaigns/Log4J/Alerts related to Log4j vulnerability.md Campaigns/Macaw Ransomware/Imminent Ransomware.md Campaigns/Macaw Ransomware/Use of MSBuild as LOLBin.md Campaigns/Bazacall/Renamed Rclone Exfil.md Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md Campaigns/Log4J/Devices with Log4j vulnerability alerts and additional other alert related context.md Campaigns/Bazacall/Cobalt Strike Lateral Movement Campaigns/Bazacall/Bazacall Emails.md Email Queries/Appspot Phishing Abuse Campaigns/Bazacall/RunDLL Suspicious Network Connection.md Campaigns/Macaw Ransomware/Mass account password change.md Campaigns/Macaw Ransomware/Inhibit recovery by disabling tools and functionality.md Campaigns/Log4J/Suspicious process event creation from VMWare Horizon TomcatService.md Campaigns/Qakbot/Qakbot email theft.md Campaigns/Log4J/Suspicious PowerShell curl flags.md Campaigns/Bazacall/Malicious Excel Delivery.md Campaigns/StrRAT malware/StrRAT-Email-Delivery.md Campaigns/StrRAT malware/StrRAT-Email-Delivery Campaigns/Bazacall/NTDS theft.md Campaigns/ZLoader/Suspicious Registry Keys.md Campaigns/Qakbot/General attempts to access local email store.md Campaigns/ZLoader/Payload Delivery.md Campaigns/Macaw Ransomware/Disable Controlled Folders.md Campaigns/Log4J/Suspicious JScript staging comment.md Campaigns/Bazacall/Excel Macro Execution.md Campaigns/ZLoader/Malicious bat file.md Campaigns/Macaw Ransomware/PSExec Attrib commands.md Campaigns/Qakbot/Excel launching anomalous processes.md Campaigns/Bazarloader/Zip-Doc - Creation of JPG Payload File.md Email Queries/PhishingEmailUrlRedirector.md Campaigns/StrRAT malware/StrRAT-AV-Discovery.md Campaigns/Bazarloader/Stolen Images Execution.md Campaigns/StrRAT malware/StrRAT-Malware-Persistence.md Campaigns/Bazarloader/Zip-Doc - Word Launching MSHTA.md |
| 3. | 47709940+endisphotic@users.noreply.github.com | 63594865+tali-ash@users.noreply.github.com |
28 shared files
Network/Defender for Endpoint Telemetry.txt Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt Delivery/Gootkit-malware.md General queries/MD AV Signature and Platform Version.txt Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md Ransomware/Backup deletion.md Command and Control/Device network events w low count FQDN.txt 00-query-submission-template.md Ransomware/Stopping multiple processes using taskkill.md Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt Campaigns/Bazacall/NTDS theft.md Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt Lateral Movement/Non-local logons with -500 account.txt Ransomware/Clearing of forensic evidence from event logs using wevtutil.md Lateral Movement/Device Logons from Unknown IPs.txt Initial access/PhishingEmailUrlRedirector.md Ransomware/Stopping processes using net stop.md Credential Access/Private Key Files.txt Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt Campaigns/Dopplepaymer In-Memory Malware Implant.txt Ransomware/IcedId attachments.md Ransomware/Turning off services using sc exe.md Ransomware/Deletion of data on multiple drives using cipher exe.md Ransomware/IcedId Delivery.md Ransomware/Turning off System Restore.md Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt Ransomware/Check for multiple signs of ransomware activity.md |
| 4. | Dolcita.Montemayor@microsoft.com | 47709940+endisphotic@users.noreply.github.com |
22 shared files
Ransomware/Qakbot discovery activies.md Exploits/Print Spooler RCE/Suspicious DLLs in spool folder.md Ransomware/IcedId email delivery.md Ransomware/LaZagne Credential Theft.md Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md Ransomware/Suspicious Image Load related to IcedId.md Ransomware/Fake Replies.md Ransomware/HTA Startup Persistence.md Ransomware/Suspicious Bitlocker Encryption.md Ransomware/Gootkit File Delivery.md Ransomware/Potential ransomware activity related to Cobalt Strike.md Ransomware/Sticky Keys.md Ransomware/Distribution from remote location.md Ransomware/IcedId attachments.md Ransomware/File Backup Deletion Alerts.md Ransomware/DarkSide.md Ransomware/IcedId Delivery.md Ransomware/Suspicious Google Doc Links.md Ransomware/Discovery for highly-privileged accounts.md Campaigns/snip3-malicious-network-connectivity.md Exploits/Print Spooler RCE/Suspicious files in spool folder.md |
| 5. | 63594865+tali-ash@users.noreply.github.com | v-maave@microsoft.com |
13 shared files
Delivery/Gootkit-malware.md Campaigns/Sysrv-botnet/oracle-webLogic-executing-powershell.md Campaigns/Sysrv-botnet/tomcat-8-executing-powershell.md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Initial access/PhishingEmailUrlRedirector.md Campaigns/Sysrv-botnet/rce-on-vulnerable-server.md Campaigns/Sysrv-botnet/java-executing-cmd-to-run-powershell.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md Campaigns/Sysrv-botnet/kinsing-miner-download.md Campaigns/Sysrv-botnet/app-armor-stopped.md |
| 6. | 47709940+endisphotic@users.noreply.github.com | orshemesh@microsoft.com |
12 shared files
Network/Defender for Endpoint Telemetry.txt Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt Command and Control/Device network events w low count FQDN.txt Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt Lateral Movement/Non-local logons with -500 account.txt Lateral Movement/Device Logons from Unknown IPs.txt Credential Access/Private Key Files.txt Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt Campaigns/Dopplepaymer In-Memory Malware Implant.txt Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt |
| 7. | 63594865+tali-ash@users.noreply.github.com | orshemesh@microsoft.com |
12 shared files
Network/Defender for Endpoint Telemetry.txt Webcasts/Ignite 2020 - Best practices for hunting across domains with Microsoft 365 Defender.txt Command and Control/Device network events w low count FQDN.txt Webcasts/TrackingTheAdversary/Episode 4 - Lets Hunt.txt Webcasts/TrackingTheAdversary/Episode 2 - Joins.txt Webcasts/TrackingTheAdversary/Episode 3 - Summarizing, Pivoting, and Joining.txt Lateral Movement/Non-local logons with -500 account.txt Lateral Movement/Device Logons from Unknown IPs.txt Credential Access/Private Key Files.txt Webcasts/l33tSpeak/Performance, Json and dynamics operator, external data.txt Campaigns/Dopplepaymer In-Memory Malware Implant.txt Webcasts/TrackingTheAdversary/Episode 1 - KQL Fundamentals.txt |
| 8. | 47709940+endisphotic@users.noreply.github.com | v-maave@microsoft.com |
10 shared files
Delivery/Gootkit-malware.md Delivery/Gootkit Malware Execution/umworkerprocess-unusual-subprocess-activity.md Campaigns/Bazacall/Dropping payload via certutil.md Initial access/PhishingEmailUrlRedirector.md Execution/umworkerprocess-creating-webshell.md Campaigns/Bazacall/Excel file download domain pattern.md README.md Credential Access/procdump-lsass-credentials.md Campaigns/snip3-malicious-network-connectivity.md |
| 9. | 47709940+endisphotic@users.noreply.github.com | 56367954+alimajalt@users.noreply.github.com |
9 shared files
Campaigns/LemonDuck/LemonDuck-control-structure.md Campaigns/LemonDuck/LemonDuck-id-generation.md Campaigns/LemonDuck/LemonDuck-component-download-structure.md Campaigns/LemonDuck/LemonDuck/LemonDuck-component-names.md Campaigns/LemonDuck/LemonDuck-defender-exclusions.md Campaigns/LemonDuck/LemonDuck-email-subjects.md Campaigns/LemonDuck/LemonDuck-registration-function.md Campaigns/LemonDuck/LemonDuck-competition-killer.md Campaigns/LemonDuck/LemonDuck-component-names.md |
| 10. | 63594865+tali-ash@users.noreply.github.com | 66005183+darioongit@users.noreply.github.com |
9 shared files
Protection events/ExploitGuardBlockOfficeChildProcess.txt TVM/devices_with_vuln_and_users_received_payload.md M365-PowerBi Dashboard/readme.txt Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md General queries/insider-threat-detection-queries.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md |
| 11. | 63594865+tali-ash@users.noreply.github.com | 64156578+mjmelone@users.noreply.github.com |
8 shared files
Webcasts/Airlift 2021 - Lets Invoke.csl General queries/Detect Azure RemoteIP.md Execution/Detect PowerShell v2 Downgrade.md Exfiltration/Possible File Copy to USB Drive.md Webcasts/l33tSpeak/l33tspeak 11 Oct 2021 - externaldata and query partitioning.csl General queries/MD AV Signature and Platform Version.md Campaigns/Abuse.ch Recent Threat Feed.md Troubleshooting/Connectivity Failures by Device.md |
| 12. | 63594865+tali-ash@users.noreply.github.com | Dolcita.Montemayor@microsoft.com |
8 shared files
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Ransomware/IcedId attachments.md Ransomware/IcedId Delivery.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md |
| 13. | louie.mayor@microsoft.com | v-maave@microsoft.com |
7 shared files
Execution/reverse-shell-nishang.md Exfiltration/7-zip-prep-for-exfiltration.md Execution/umworkerprocess-unusual-subprocess-activity.md Delivery/powercat-download.md Execution/umworkerprocess-creating-webshell.md Credential Access/procdump-lsass-credentials.md Exfiltration/exchange-powershell-snapin-loaded.md |
| 14. | 66005183+darioongit@users.noreply.github.com | Dolcita.Montemayor@microsoft.com |
5 shared files
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md |
| 15. | 66005183+darioongit@users.noreply.github.com | v-maave@microsoft.com |
5 shared files
Campaigns/Jupyter-Solarmaker/evasive-powershell-strings.md Campaigns/fireeye-red-team-tools-CVEs [Nobelium].md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md Campaigns/possible-affected-software-orion[Nobelium].md Campaigns/known-affected-software-orion[Nobelium].md |
| 16. | 79610537+dreadphones@users.noreply.github.com | 56367954+alimajalt@users.noreply.github.com |
3 shared files
Campaigns/Jupyter-Solarmaker/successive-tk-domain-calls.md Campaigns/Jupyter-Solarmaker/deimos-component-execution.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 17. | louie.mayor@microsoft.com | 47709940+endisphotic@users.noreply.github.com |
3 shared files
Execution/umworkerprocess-unusual-subprocess-activity.md Execution/umworkerprocess-creating-webshell.md Credential Access/procdump-lsass-credentials.md |
| 18. | 47709940+endisphotic@users.noreply.github.com | rony_123@protonmail.ch |
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md Campaigns/Bazacall/NTDS theft.md |
| 19. | 79610537+dreadphones@users.noreply.github.com | rony_123@protonmail.ch |
2 shared files
Campaigns/Bazacall/Cobalt Strike Lateral Movement.md Campaigns/Bazacall/NTDS theft.md |
| 20. | 79610537+dreadphones@users.noreply.github.com | Dolcita.Montemayor@microsoft.com |
2 shared files
Exploits/Print Spooler RCE/Suspicious Spoolsv Child Process.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 21. | 63594865+tali-ash@users.noreply.github.com | 45784740+YulelogPagoda@users.noreply.github.com |
2 shared files
Exploits/CVE-2021-36934 usage detection.md Exploits/printnightmare-cve-2021-1675 usage detection.md |
| 22. | 63594865+tali-ash@users.noreply.github.com | 79610537+dreadphones@users.noreply.github.com |
2 shared files
Campaigns/Bazacall/NTDS theft.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 23. | Dolcita.Montemayor@microsoft.com | 56367954+alimajalt@users.noreply.github.com |
2 shared files
Email Queries/referral-phish-emails.md Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 24. | 63594865+tali-ash@users.noreply.github.com | 23354952+Dylan-J@users.noreply.github.com |
1 shared file
Credential Access/Active Directory Sensitive Group Modifications.md |
| 25. | 63594865+tali-ash@users.noreply.github.com | powell.mike@gmail.com |
1 shared file
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md |
| 26. | powell.mike@gmail.com | Dolcita.Montemayor@microsoft.com |
1 shared file
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md |
| 27. | powell.mike@gmail.com | 47709940+endisphotic@users.noreply.github.com |
1 shared file
Exploits/Print Spooler RCE/Spoolsv Spawning Rundll32.md |
| 28. | 47709940+endisphotic@users.noreply.github.com | 38123224+mcyr5@users.noreply.github.com |
1 shared file
Email Queries/JNLP-File-Attachment.md |
| 29. | 63594865+tali-ash@users.noreply.github.com | 66407692+YoshihiroIchinose@users.noreply.github.com |
1 shared file
General queries/Device uptime calculation.md |
| 30. | 79610537+dreadphones@users.noreply.github.com | 38123224+mcyr5@users.noreply.github.com |
1 shared file
Delivery/Qakbot Craigslist Domains.md |
| 31. | 63594865+tali-ash@users.noreply.github.com | rony_123@protonmail.ch |
1 shared file
Campaigns/Bazacall/NTDS theft.md |
| 32. | 63594865+tali-ash@users.noreply.github.com | Iveco@users.noreply.github.com |
1 shared file
Command and Control/C2-NamedPipe.md |
| 33. | 63594865+tali-ash@users.noreply.github.com | iveco@gmx.net |
1 shared file
Command and Control/C2-NamedPipe.md |
| 34. | Iveco@users.noreply.github.com | iveco@gmx.net |
1 shared file
Command and Control/C2-NamedPipe.md |
| 35. | 64156578+mjmelone@users.noreply.github.com | yujiao@microsoft.com |
1 shared file
General queries/MD AV Signature and Platform Version.md |
| 36. | 64156578+mjmelone@users.noreply.github.com | 65675989+julihooper@users.noreply.github.com |
1 shared file
General queries/MD AV Signature and Platform Version.md |
| 37. | yujiao@microsoft.com | 63594865+tali-ash@users.noreply.github.com |
1 shared file
General queries/MD AV Signature and Platform Version.md |
| 38. | yujiao@microsoft.com | 65675989+julihooper@users.noreply.github.com |
1 shared file
General queries/MD AV Signature and Platform Version.md |
| 39. | 63594865+tali-ash@users.noreply.github.com | 65675989+julihooper@users.noreply.github.com |
1 shared file
General queries/MD AV Signature and Platform Version.md |
| 40. | 79610537+dreadphones@users.noreply.github.com | 66005183+darioongit@users.noreply.github.com |
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 41. | 79610537+dreadphones@users.noreply.github.com | v-maave@microsoft.com |
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 42. | 56367954+alimajalt@users.noreply.github.com | 63594865+tali-ash@users.noreply.github.com |
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 43. | 56367954+alimajalt@users.noreply.github.com | 66005183+darioongit@users.noreply.github.com |
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 44. | 56367954+alimajalt@users.noreply.github.com | v-maave@microsoft.com |
1 shared file
Campaigns/Jupyter-Solarmaker/evasive-powershell-executions.md |
| 45. | 63594865+tali-ash@users.noreply.github.com | anvascon@microsoft.com |
1 shared file
General queries/WD AV Signature and Platform Version.txt |
| 46. | 63594865+tali-ash@users.noreply.github.com | HeathL17@users.noreply.github.com |
1 shared file
Exfiltration/Files copied to USB drives.md |