v1.0.3 (May 2025)

• Update DLL sideload TID from T1574.002 to T1574.001 as T1574.002 was revoked in ATT&CK v17 (see: https://attack.mitre.org/resources/updates/updates-april-2025/)

v1.0.2 (February 2025)

• Update detection link for Azure diagnostic

v1.0.2

• Misc cleanup

v1.0.1

• Fix for Winlogon command

2024 Indexes release

ID updates

FSI Changelog v1.1

Test Cases

Credential Access

• Updated hashdump guidance to also include mimikatz equivalent command

Discovery

• Updated local/domain enumeration test case guidance to remove overlapping commands
• Added LDAP user enumeration

Execution

• Cut LNK exe

Defense Evasion

• Added rundll32 exe proxy execution

Persistence

• Cut webshell

Misc RHI/HI

• Updated guidance for hashdump test case