How to defend against

Detection and prevention for attack techniques seen on Windows. Each detection rule is run on attack recordings and on the logs of a clean Windows 10 client; the page shows what it caught and what it flagged by mistake.

1. How to defend against mshta script executionT1218.005
2. How to defend against encoded PowerShell commandsT1059.001, T1027
3. How to defend against Run key persistenceT1547.001
4. How to defend against LSASS credential dumpingT1003.001
5. How to defend against scheduled task abuseT1053.005
6. How to defend against remote execution through services and WMIT1021.002, T1047, T1569.002
7. How to defend against copying the password hivesT1003.002, T1003.003, T1003.004
8. How to defend against logging turned off through the registryT1562.002, T1562.006
9. How to defend against logging turned off from the command lineT1562.002, T1562.001
10. How to defend against command-and-control traffic from hijacked processesT1055, T1574.001, T1071.001