- Suspicious Windows Services
suspicious_windows_services_names_list.csv- https://mthcht.medium.com/threat-hunting-suspicious-windows-service-names-2f0dceea204c
- Suspicious User Agents
suspicious_http_user_agents_list.csv- https://mthcht.medium.com/threat-hunting-suspicious-user-agents-3dd764470bd0
- Suspicious TLDs
suspicious_tlds_list.csv- https://mthcht.medium.com/threat-hunting-suspicious-tlds-a742c2adbf58
- DNS over https
dns_over_https_servers_list.csv- https://mthcht.medium.com/detecting-dns-over-https-30fddb55ac78
- DNSTwist Phishing detection
- Detecting DLL Hijacking
- Suspicious Named pipes
suspicious_named_pipe_list.csv- https://medium.com/detect-fyi/threat-hunting-suspicious-named-pipes-a4206e8a4bc8
... todo