This repository was created with the aim of assisting companies and independent researchers about Tactics, Techniques and Procedures adopted by Ransomware Operators/Groups active or not and also threat actors that are operating in society.
In addition to mapping Tactics, Techniques and Procedures, I am inserting data on commands, tools, useful locations for researching artifacts and others.
The main focus is to assist organizations and individual researchers on each type of actor, providing a summary of their trajectory and additional information that can be used.
| FOLDER | DESCRIPTION |
|---|---|
| Actor’s Name | Description of activities, operation details, TTPs and Tools used |
| Commands | Repository intended to insert commands captured based on DFIR and CTI activities of Threat Actors, Ransomware groups and affiliates |
| Payload locations | Repository designed to inform locations commonly used to execute ransomware and other threats |
The rsync command in Linux synchronizes files and directories between two locations, locally or over SSH. Unlike scp,…
The patch command in Linux applies a set of changes from a diff file to one or…
The basename command in Linux extracts the last component of a file path, removing the leading directory…
The timeout command in Linux runs a command with a time limit and terminates it when the limit is reached. It is part of GNU coreutils, available on virtually every Linux distribution. It is most useful for commands with no built-in timeout option, such as ping, curl, tcpdump, or a custom script that might hang indefinitely. How the timeout Command Works in Linux The syntax is: bashtimeout [OPTIONS] DURATION COMMAND [ARG]...…
The rmmod command in Linux removes a loaded module from the running kernel. Because the kernel has…
The free command in Linux gives you a quick summary of RAM and swap usage. It reads…