Merge pull request #10 from Ekitji/main

striped version of suspicious_http_user_agents_list.csv with only focus on non bots
mthcht · Oct 21, 2023 · 97ded3e · 97ded3e
2 parents 6a43b86 + cc58848
commit 97ded3e
Show file tree

Hide file tree

Showing 5 changed files with 53 additions and 0 deletions.
diff --git a/elk/suspicious_named_pipe_elk.txt b/elk/suspicious_named_pipe_elk.txt
diff --git a/elk/suspicious_windows_services_names_elk.txt b/elk/suspicious_windows_services_names_elk.txt
@@ -0,0 +1,51 @@
+anydesk
+ateraagent
+btobto
+creatsvcrpc
+dcrypt
+dwagent
+goodsync
+gotomypc
+krbscm
+lmiguardiansvc
+lmimaint
+logmein
+magnetramcapture
+mesh
+meterpreter
+metsvc
+mimidrv
+mimikatz
+monblanking
+norebootsvc
+novapdf
+npcap
+paexec
+powerupservice
+pplblade
+psexesvc
+pulseway
+pwdump
+radmin
+remcom
+rustdesk
+screenconnect
+sesshijack
+sliver
+splashtop
+supremo
+tacticalrmm
+teamviewer
+testservice
+tightvnc
+wceservice
+webroot
+windowsmonitoring
+winring
+wrboot
+wrcore
+wrcoreservice
+wrkrn
+wrskyclient
+wrsmsvc
+wrsvc
diff --git a/elk/th_keywords_elk.txt b/elk/th_keywords_elk.txt
@@ -138,6 +138,7 @@ collectionmethod
 sharpmove
 eviltwinserver
 dcom
+dcip
 ms16
 eventhunter
 wce64

diff --git a/elk/th_keywords_processnames_elk.txt b/elk/th_keywords_processnames_elk.txt
@@ -148,6 +148,7 @@ ghostpack.exe
 netexec.exe
 fakelogonscreen.exe
 sharpldap.exe
+sharpldapmonitor.exe
 secretfinder.exe
 mystikal.exe
 dsquery.exe

diff --git a/elk/user_agent_elk.txt b/elk/user_agent_elk.txt
-Original file line number
+Diff line change
@@ Expand Up / @@ -138,6 +138,7 @@ collectionmethod @@
     sharpmove
     eviltwinserver
     dcom
+    dcip
     ms16
     eventhunter
     wce64
@@ Expand Down @@