Matt Hand
Matt Hand
When a user deletes the mock directory `C:\Windows \System32\`, Windows will attempt to delete the real System32. Need to implement a cleanup function to do this as an argument. This...
I believe this is possible through the registry, but this would be valuable to potentially match discovered PPK files and where they might go.
The registry key it checks for is only present on Windows 10, so since it doesn't exist in Win7, it will error out and not run.
See below: ``` PS > .\InspectAssembly.exe path=".\server.exe" Assembly Name: C:\foo\server.exe WCFServer Gadgets: CommunicationObject::Open() is called in the following methods: Service.OnStart Serialization Gadgets: CommunicationObject::Open() is called in the following methods: PS...
In the data, the `name` field in the `T1205.002` technique is "Socket Filters" but on the primary site, it is "Traffic Signaling: Socket Filters". I would really like to have...