Results for “starton”

Detect T1547.001 startup folder persistence by monitoring Windows startup directories for suspicious file creation, analyzing autoruns entries, and using Python watchdog for real-time filesystem monitoring.

Prepare safe production launches — pre-launch checklist, monitoring, staged rollout, and rollback. Load when deploying to production, releasing a major change, opening beta access, or the user asks for a launch checklist, go-live plan, rollout strategy, or rollback plan. Not for local-only prototypes. Pairs with ci-cd-and-automation and app-security-hardening.

Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.

Entry P1 category router for reconnaissance and methodology. Use when mapping scope, discovering assets, fingerprinting technology, building endpoint inventory, and choosing the first high-value security testing path.