ducnp

	TechniqueID	Data Source
	Technique/T1001	Packet capture,Process use of network,Process monitoring,Network protocol analysis
	Technique/T1002	File monitoring,Binary file metadata,Process command-line parameters,Process monitoring
	Technique/T1003	API monitoring,Process command-line parameters,Process monitoring,PowerShell logs
	Technique/T1004	Windows Registry,File monitoring,Process monitoring
	Technique/T1005	File monitoring,Process monitoring,Process command-line parameters
	Technique/T1006	API monitoring
	Technique/T1007	Process command-line parameters,Process monitoring
	Technique/T1008	Packet capture,Netflow/Enclave netflow,Malware reverse engineering,Process use of network,Process monitoring
	Technique/T1009

ssh -i keyfile.pem ubuntu@<ip>

sudo apt -y update && sudo apt -y upgrade
sudo apt install -y p7zip-full build-essential linux-image-extra-virtual linux-source

echo options nouveau modeset=0 | sudo tee -a /etc/modprobe.d/nouveau-kms.conf
sudo update-initramfs -u

# to activate latest kernel

	Windows version:
	reg query x64 HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion

	Users who have authed to the system:
	ls C:\Users\

	System env variables:
	reg query x64 HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Environment

	Saved outbound RDP connections:

	#!/bin/bash
	dir=$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )

	# magnet:?xt=urn:btih:7ffbcd8cee06aba2ce6561688cf68ce2addca0a3
	# 1. Fixed letter1, letter2, letter3 assignments for macOS compatibility
	# 2. Changed grep to sgrep (sorted grep), need to preinstall: npm i -g sgrep

	if [ "$1" != "" ]; then
	letter1=$(echo ${1:0:1})
	if [[ $letter1 == [a-zA-Z0-9] ]]; then

	wordlist created from original 41G stash via:

	grep -rohP '(?<=:).*$' \| uniq > breachcompilation.txt

	Then, compressed with:

	7z a breachcompilation.txt.7z breachcompilation.txt

	Size: