“persistence”的搜索结果

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

中文简介正在准备中。当前显示原文说明。

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

中文简介正在准备中。当前显示原文说明。

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

中文简介正在准备中。当前显示原文说明。

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

中文简介正在准备中。当前显示原文说明。

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

中文简介正在准备中。当前显示原文说明。

Scheduled patrol that finds real persistence and error bugs and fixes them. Use when running the system-error repair patrol automation, or when stuck rows, SLA breaches, the system_errors queue, or app_log ERROR rows need a repair rather than a report.

中文简介正在准备中。当前显示原文说明。

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

中文简介正在准备中。当前显示原文说明。

Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe), 11 (File Create for task XML), and Windows Security Event 4698/4702. The analyst correlates task creation with suspicious parent processes, public directory paths, and encoded command arguments to identify persistence and lateral movement via scheduled tasks. Activates for requests involving scheduled task detection, Sysmon persistence hunting, or T1053.005 Scheduled Task/Job analysis.

中文简介正在准备中。当前显示原文说明。

Perform DCSync attacks to replicate Active Directory credentials and establish domain persistence by extracting KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

中文简介正在准备中。当前显示原文说明。

Detect and analyze Linux persistence mechanisms including crontab entries, systemd service units, LD_PRELOAD hijacking, bashrc modifications, and authorized_keys backdoors using auditd and file integrity monitoring

中文简介正在准备中。当前显示原文说明。

Use Sysinternals Autoruns to systematically identify and analyze malware persistence mechanisms across registry keys, scheduled tasks, services, drivers, and startup locations on Windows systems.

中文简介正在准备中。当前显示原文说明。

Comprehensive persistence tradecraft for authorized red team engagements covering Windows and Linux mechanisms. Windows techniques include registry Run/RunOnce keys, scheduled tasks, WMI event subscriptions, DLL search order hijacking, COM object hijacking, Startup folder drops, service creation, Security Support Provider (SSP) DLL injection, and Active Directory persistence (AdminSDHolder abuse, DCShadow, Golden Ticket, Silver Ticket, Skeleton Key, SID History injection). Linux techniques include cron and at jobs, systemd timers and services, SSH authorized_keys injection, shell profile backdoors (.bashrc/.bash_profile), PAM module backdoors, LD_PRELOAD hijacking, kernel module rootkits, web shells, and Git hook abuse. Provides operator-ready command sequences for SharPersist, Impacket ticketer, schtasks, sc.exe, crontab, and systemctl with OPSEC considerations for each method. Maps to MITRE ATT&CK T1547 (Boot or Logon Autostart), T1053 (Scheduled Task/Job), T1546 (Event Triggered Execution), T1556 (Modi...

中文简介正在准备中。当前显示原文说明。

通过先写测试的TDD流程，为Spring Boot添加功能、修复问题或整理代码，涵盖单元测试、Web层验证、数据持久化与集成测试，并检查代码覆盖率。

• 从测试开始添加Spring Boot API
• 编写防止问题复发的测试
• 验证数据保存与读取

使用Swift的actor管理共享数据访问，将内存缓存与JSON文件存储结合，设计避免并发访问时数据竞争的存储层，并提供与ViewModel配合的示例。

• 为iOS和macOS应用保存本地数据
• 设计以离线使用为主的存储层
• 替换基于锁的同步代码

Create a disposable Herdr session to reproduce terminal, process, API, or agent issues separately from the main session. Drive tests through the CLI or API, collect evidence of state changes, and clean up the temporary session afterward.

中文简介正在准备中。当前显示英语简介。

• Reproducing pane, terminal, or process issues in Herdr
• Checking agent detection and permission-related state changes
• Collecting commands, logs, and state for a reproducible bug report

Build an evidence-backed incident timeline in a CTF sandbox by correlating logs, network captures, and other artifacts. Trace attacker actions across sources, distinguish confirmed events from inferred gaps, and preserve the sequence that supports the conclusion.

中文简介正在准备中。当前显示英语简介。

• Combine logs and network captures into an incident timeline
• Trace attacker actions from initial access to persistence
• Separate confirmed event order from inferred gaps

Inspect browser storage and caches in a CTF sandbox to explain changes in authentication, page rendering, or requests. Compare clean and modified states, then document the smallest sequence that reproduces the relevant behavior.

中文简介正在准备中。当前显示英语简介。

• Investigating login behavior affected by stored browser state
• Explaining page differences caused by caches
• Reproducing behavior with clean and modified storage

Design storage for event sourcing, an approach that records changes as events. Compare database options and plan event ordering, duplicate handling, concurrent writes, and scaling to build a consistent event persistence layer.

中文简介正在准备中。当前显示英语简介。

• Compare event storage technologies
• Design event schemas and streams
• Handle concurrent and duplicate writes

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Analyze Windows event logs in Splunk to investigate suspicious logins, privilege changes, persistence, and movement between computers. Build detection searches and organize endpoint activity into timelines, with findings linked to MITRE ATT&CK attack techniques.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious Windows logins
• Building detection searches in Splunk
• Creating incident timelines

Analyze suspicious Linux ELF executables through file inspection, runtime tracing, and reverse engineering. Identify malware behavior, network destinations, and persistence mechanisms, then organize findings and indicators for investigations involving servers, containers, or cloud infrastructure.

中文简介正在准备中。当前显示英语简介。

• Triaging suspicious executables on Linux servers
• Investigating suspected cryptominers
• Analyzing malware found in containers

Observe malware in an isolated Cuckoo Sandbox environment and review its processes, network traffic, and system changes. Use the findings to trace infection stages, identify persistence mechanisms, and extract indicators of compromise for behavioral reports.

中文简介正在准备中。当前显示英语简介。

• Investigating suspicious files after static analysis
• Tracing multi-stage infections and persistence mechanisms
• Extracting indicators of compromise from observed behavior