'persistence' 검색 결과

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Scheduled patrol that finds real persistence and error bugs and fixes them. Use when running the system-error repair patrol automation, or when stuck rows, SLA breaches, the system_errors queue, or app_log ERROR rows need a repair rather than a report.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered Execution), T1556 (Modi...

한국어 요약은 준비 중입니다. 원문 설명을 표시하고 있습니다.

Design local data storage in Swift using actors, which control concurrent access to shared data. Combine an in-memory cache with JSON file storage, implement save and lookup operations, and connect the repository to an observable ViewModel.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Building local storage for an iOS or macOS app
• Designing local storage for an offline-first app
• Replacing lock-based synchronization with Swift actors

Develop Spring Boot features and fixes by writing tests before implementation. Guides unit, web, persistence, and integration testing with JUnit 5, Mockito, MockMvc, and Testcontainers, plus JaCoCo measurement of how much code tests cover.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Adding Spring Boot endpoints with tests first
• Writing regression tests for bug fixes
• Testing database persistence and retrieval

Create a disposable Herdr session to reproduce terminal, process, API, or agent issues separately from the main session. Drive tests through the CLI or API, collect evidence of state changes, and clean up the temporary session afterward.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Reproducing pane, terminal, or process issues in Herdr
• Checking agent detection and permission-related state changes
• Collecting commands, logs, and state for a reproducible bug report

Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Combine logs and network captures into an incident timeline
• Trace attacker actions from initial access to persistence
• Separate confirmed event order from inferred gaps

Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating login behavior affected by stored browser state
• Explaining page differences caused by caches
• Reproducing behavior with clean and modified storage

Design storage for event sourcing, an approach that records changes as events. Compare database options and plan event ordering, duplicate handling, concurrent writes, and scaling to build a consistent event persistence layer.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Compare event storage technologies
• Design event schemas and streams
• Handle concurrent and duplicate writes

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious Windows logins
• Building detection searches in Splunk
• Creating incident timelines

Investigate malware hidden in boot records, UEFI firmware, or the operating system’s core. The skill guides evidence collection, boot integrity checks, firmware and memory analysis, and reporting of persistence mechanisms and remediation steps when compromise survives an OS reinstall.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating infections that survive an OS reinstall
• Examining unexplained Secure Boot integrity violations
• Finding hidden processes and suspicious kernel drivers

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

한국어 요약은 준비 중입니다. 영어 요약을 표시하고 있습니다.

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior