Tips-Of-Mine/PowerHuntShares
Tips-Of-Mine/PowerHuntShares
2
0
Fork 0
mirror of https://github.com/NetSPI/PowerHuntShares.git synced 2025-05-04 19:28:42 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source 
readme updates
This commit is contained in:
Scott Sutherland 2024-06-05 17:37:49 -05:00 committed by GitHub
parent af6a9f9b1d
commit 3589fa809b
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
README.md
View File

@ -225,7 +225,8 @@ Todos
* Create bloodhound import file / edge (highrisk share)
* Research to identify additional high risk share names based on common technology
* Add better support for IPv6
* Dynamic identification of spikes in high risk share creation/common groupings, need to better summarize supporting detail beyond just the timeline. For each of the data insights, add average number of shares created for insight grouping by year/month (for folder hash / name etc), and the increase the month/year it spikes. (attempt to provide some historical context); maybe even list the most common non default directories being used by each of those. Potentially adding "first seen date" as well.
* Dynamic identification of spikes in high risk share creation/common groupings, need to better summarize supporting detail beyond just the timeline. For each of the data insights, add average number of shares created for insight grouping by year/month (for folder hash / name etc), and the increase the month/year it spikes. (attempt to provide some historical context); maybe even list the most common non default directories being used by each of those. Potentially adding "first seen date" as well. (in alpha)
* Dynamic identification of share creation, modification, and access cadence across a share population that share a name and have a high similarity level.
* add showing share permissions (along with the already displayed NTFS permissions) and resultant access (most restrictive wins)
* Use LLM to categorize share name groups based on share name, affected file lists, share owners, and users with acls to the affected shares.