Back to search
Top Contributors
119
commits
End-to-end investigation of the APT29 emulation dataset using Splunk, including detection development, evidence-backed timelines, and MITRE ATT&CK mapping. The project covers decoded obfuscated PowerShell payloads, LSASS credential dumping, WinRM/WMI lateral movement, and covert credential staging and persistence, culminating in a full DFIR report.
Stars
0
Forks
0
Watchers
0
Open Issues
0
Overall repository health assessment
No package.json found
This might not be a Node.js project
119
commits
Update Add decoded PowerShell credential-theft payload
92766dcView on GitHubCreate 05b_splunk_winrm_child_process_execution.spl
011fdf2View on GitHubRename 05_splunk_winrm_lateral_movement.png to 05_splunk_winrm_activity_baseline.png
d85b50dView on GitHubUpdate Add decoded PowerShell credential-theft payload
c08c755View on GitHub