How to use the lists

• Suspicious Windows Services
  • suspicious_windows_services_names_list.csv - https://mthcht.medium.com/threat-hunting-suspicious-windows-service-names-2f0dceea204c
• Suspicious User Agents
  • suspicious_http_user_agents_list.csv - https://mthcht.medium.com/threat-hunting-suspicious-user-agents-3dd764470bd0
• Suspicious TLDs
  • suspicious_tlds_list.csv - https://mthcht.medium.com/threat-hunting-suspicious-tlds-a742c2adbf58
• DNS over https
  • dns_over_https_servers_list.csv - https://mthcht.medium.com/detecting-dns-over-https-30fddb55ac78
• DNSTwist Phishing detection
  • [DNSTWIST] - https://medium.com/detect-fyi/detecting-phishing-attempts-with-dnstwist-37c426b3bbb8
• Detecting DLL Hijacking
  • hijacklibs_list.csv hijacklibs_list.csv
  • https://mthcht.medium.com/detect-dll-hijacking-techniques-from-hijacklibs-with-splunk-c760d2e0656f
• Suspicious Named pipes
  • suspicious_named_pipe_list.csv - https://medium.com/detect-fyi/threat-hunting-suspicious-named-pipes-a4206e8a4bc8

... todo