* This class is for interaction with the Windows Registry. A single instance of this * class represents a key in the registry, not to be confused wi

* \brief Combines two or more mitigation policy objects into just one object. The policy may require all of or just * one of the policies bei

* \brief Represents a mitigation that may be applied to the system. * * \note For mitigations that apply to the OS, each MITRE mitigation technique

* \brief A policy to be enforced by a mitigation. Each mitigation policy represents a single setting, * configuration, or change to be enforce

* \brief Represents a software package used by a mitigation. */

* \brief Represents the version of a program */

* This class serves as a way for BLUESPAWN's modules to interact with the user through a command line interface. * This class acts as a pseudo-single

* CLISink provides a sink for the logger that directs output to the console. * * Each log message is prepended with the severity of the log, as d

Represents the degree of certainty that a detection is malicious

* DebugSink provides a sink for the logger that directs output to the debug console. * * Each log message is prepended with the severity of the lo

* This indicates the level of detail in the log level. */

* Represents something that has been identified as potentially malicious. Each detection object can be further broken * down in to the types laid ou

Stores contextual information around a detection

* Keeps track of all detections found so far */

Identifies the type of detection a Detection object represents

* An event manager for seemlessly subscribing and unsubscribing to and from events. Since this * class can handle all types of events, there is no ne

* \brief Implements a MitigationPolicy for enabling event log channels */

* A class used to connect a HuntTriggerReaction to the Windows async call when an event is generated */

* Stores information about a file identified as possibly malicious */

Specify whether the type of connection should be allowed

* \brief Implements a FirewallRulePolicy for ensuring types of connections are or are not allowed. * * \note FirewallRulePolicy objects enforcing t

This struct is a POD type for storing information about a hunt to be logged.

* HuntRegister is a class meant to be used to manage running hunts and monitoring. * Rather than make HuntRegister a singleton, all members are inste

* HuntT1036 examines the local file system for executables in user writable * locations in %WINDIR% * * @scans Cursory checks all such writable

* HuntT1037 examines the registry and filesystem for logon scripts */

* HuntT1053 looks for malicious activity hidden in scheduled tasks/jobs * T1053.005: examines Windows events for new scheduled tasks * * @monit

* HuntT1055 examines all processes for shellcode injections, injected PE images, * function hooks, and doppelganging. This individual hunt will even

* HuntT1068 examines the registry and file system for evidence of CVE-2020-1048. */

* HuntT1070 looks for evidence attackers tried to cover their tracks. * Currently examines Sysmon logs looking for timestomp events * * @monitor

* HuntT1136 examines Windows events for new accounts created * T1136.001: looks for local Windows accounts that were created * * @monitor Tri

* HuntT1484 examines the local file system for presence of ntuser.man files which * can be used to override GPO settings */

* HuntT1505 looks for the abuse of legitimate extensible software components * T1505.003: examines the locations of web roots, looking for files

* HuntT1543 examines system services for evidence of bad. * T1543.003: examines Windows events for new services created * * @monitor Triggers

* HuntT1546 looks for event triggered persistence attacks. Currently works below: * T1546.002: examines the system for malicious screensavers

* HuntT1547 looks for malicious boot or logon autostart execution activity * * T1547.001: examines the registry for run keys and filesyste

* HuntT1553 looks for attackers blending in by abusing trust on the system. * T1553.003: examines Subject Interface Providers and Trust Providers

* HuntT1562 looks for ways attacks impair defenses. Currently examines the registry for firewall * settings that allow applications to override the

* HuntT1569 examines the system for malicious services * * @scans Cursory scans the services that are installed and their binaries * @scans Nor

* This class is used to serve as an abstract interface for all user interfaces. User interfaces will * implement at least the methods defined here, e

* \brief Represents an IP address, either in IPv4 or IPv6 */

* \brief Refers to a range of IP addresses */

* JSONSink provides a sink for the logger that saves log messages to an JSON file. */