forked from Velocidex/velociraptor-docs
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy path.wordlist.txt
1459 lines (1390 loc) · 12.5 KB
/
.wordlist.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
aca
accelerometer
accessor
accessor's
accessors
adhoc
acl
ACLs
acls
ACSC
ActiveScript
ActiveXObject
adbe
ADDomain
AddPrinterDriverEx
admin's
admins
AEST
afp
Agentless
agentless
AGPL
alex
alice
allocs
amd
analyse
analysed
analysing
analystbob
analytics
andreafortuna
api
API's
APIs
apis
applet
apps
Arg
arg
args
argv
arn
arp
ASCII
async
atexit
Atim
atime
atoi
Att
AttackerKB
auditable
auditd
Auscert
auth
authenticator
authenticators
Authenticode
autocert
autoexec
autoplay
autorun
autoruns
backdoors
backend
backtick
backticks
backtrace
backtraces
balancer
BAM
basename
BasicCollection
Bigtable
binarydefense
BitField
bitfield
BitFields
bitfields
Bitlocker
bitsadmin
Blackhat
BlackJack
blockquote
blocksize
blog
blogs
blogspot
bool
boolean
btime
btn
BTV
bugfix
bugfixes
busybox
bzip
CA's
callgrind
cancelled
cancelling
CAs
catdb
CatRoot
catroot
CDN
CDROM
CentOS
centralized
centric
certbot
certs
CertUtil
changelog
charset
checkbox
Chromebook
CIDR
CLA
CIMV
clayscode
ClientId
cmd
Cmdline
CmdShell
CNTUSER
CobaltStrike
cocoatime
codebase
codebases
codec
commandlet
CommandLine
commandline
comms
Compat
COMPlus
complus
COMPUTERNAME
COMSPEC
conf
Conffiles
config
CPU
crashdump
creds
cron
crosshairs
crowdsourcing
crypto
cryptographic
csv
Ctrl
curated
CurrentControlSet
CurrentVersion
customizable
customizations
CVE
cyber
CyberChef
cybersecurity
datafile
dataset
datastore
ddclient
DDoS
debconf
debian
decrypt
decrypting
decrypts
dedup
deduplicate
deduplication
DefCon
deobfuscation
deployers
deps
DER
dereference
dereferences
dest
DstAddr
destructors
detections
DFIR
DFRWS
dhclient
dhcp
dict's
dicts
discoverable
dit
dll
DLLs
dlls
DNS
docx
facto
downsides
dpkg
drilldown
DSL
DWORD
DynDNS
ECS
EDR
EFS
eg
ElasticSearch
elasticsearch
ElfFile
emails
Encrypt's
Encrypt’s
endian
EndTime
EntryNumber
env
environ
EQL
ESE
ESEDatabaseView
ESEDatabaseViewer
ESM
EVTX
ETW
eval
EventConsumer
EventConsumers
EventData
evented
EventFilter
EventID
eventing
EventLog
eventlog
EventLogs
EventMessageFile
eventquery
EventRecordID
EVT
EvtxHunter
EWT
exe
exe's
executables
execve
exfiltration
ExpectedHash
Facebook
defacto
FailedEventData
failedLogonTimeWindow
FailedSystem
failureCount
fas
FatTimestamp
FC
FetchBinary
fifo
Fifos
FileBaseDataStore
FileFinder
FileFox
fileio
Fileless
FileName
filepath
filestore
filesystem
filesystem's
filesystems
FileTime
Filetime
FilterToConsumerBinding
FindByMagics
FindFile
FindFirstFile
Firefox
firewalls
FleetDM
fmt
foreach
FQDN
frontend
Frontend's
frontends
fs
FSP
fsutil
Fullname
FULLPATH
FullPath
FullPathRegex
fullscreen
func
Gb
gb
GCP
GEfw
GeoIP
geolocation
getpid
GetShortPathName
gif
github
gitlab
GLIBC
GLOBALROOT
globals
globbing
gmail
golang
Golang's
google
googlegroups
goroutine
goroutines
gpg
gpupdate
Graeber
Graphana
grep
grok
gRPC
grpc
GRR
Grr
GRR's
gui
GUID
guid
GUIDs
gz
gzip
Harddisk
HashFunction
HashSize
HEC
Hexview
HFS
homedir
Homepage
hostkey
hostname
hostnames
hosts's
http
https
HuntId
IAM
IIS
ImagePath
img
impactful
ImportCollection
indx
InfoSec
Infosec
Infosec's
initialised
inode
inodes
InsightIDR
Inspiron
InstalledSize
instantiation
intel
interdependency
interoperability
ints
InUse
investigatoralice
IOC
IOCs
ip
IPC
ipconfig
IPS
ipup
IPv
iro
isabled
ISDIR
IsDir
IsLink
IsSlack
iterable
javascript
JECmd
jitter
Jonny
journaling
jpeg
jpg
Jrnl
JS
js
JSecurity
json
jsonl
jupyter
Jupyter's
KAPE
Kape
KapeFile
KapeFiles
KapeTriage
kb
kcachegrind
keepalive
Khatri
Kibana
killkillkill
kleinco
kolide
Koppeling
Kroll's
Laddr
Landers
langauge
LargestPid
lastaccesstime
LastModified
LastUserLogin
lastwritetime
launchctl
launchd
layed
LazyExpr
LegacyQuery
Lego
len
Letsencrypt
LHS
libcap
libmagic
librally
libsoup
libyara
libyara's
lifecycle
liftingm
LinkedIn
Linux
linuxDpkgStatus
ListDirectory
ListProcesses
livepatch
lnk
localaccounts
LocalGroupMember
localgroupmember
LocalHashes
localhost
localizations
LogFileCleared
logman
logon
logons
LogonTime
logstash
lolbas
Lolbin
LookupAccountSid
lookups
lookupSID
loopback
lowcase
lpd
linux
LPE
Lpid
lsass
MacOS
mactime
MagicID
Magid
MagidID
mailto
maintainance
MajorVersion
makeslice
malpedia
malware
MappingName
matcher
matplotlib
Mattos
MaxMind
maxmind
mb
md
MDR
MDRlY
mdsec
mdShell
memoize
menutitle
messagedb
MessageList
metadata
metasploit
metdata
mft
MFTId
mgreen
mic
microsoft
MimiKatz
mimikatz
mimilib
MinorVersion
mis
misp
MITM
Mitre
mmap
Modelling
ModuleAnalysisCache
ModuleLength
MOF
motd
motivators
mozallowfullscreen
mru
MSBuild
msg
msh
msha
mshta
msi
msiexec
msrc
Mti
Mtim
mtime
mtimefrom
MUI
multifrontend
Multiline
multithreaded
mutex
mutexes
mxdwdrv
MyBadMutex
MyCode
myconfig
mydb
myexternalip
myhashes
myhostname
myprocess
myRules
mysql
mystat
n'th
namespace
namespaces
NameType
Nano
natively
nd
netaddr
netcat
netspi
netstat
NetUserEnum
NewQuarantine
NewQuery
NFS
nginx
nirsoft
nobanner
NOOP
nPrivileges
ns
nSubject
ntds
ntfs
ntfswalker
ntuser
NTUserPath
nviso
NZA
NZITF
OAuth
oauth
objtree
OIDC
ok
Okta
oleparse
OleParser
olevba
OneDrive
onlinehashcrack
opensource
openssl
ordereddict
OriginalFileName
OSDFC
OSINT
OSQuery
osquery
OSQuery's
OSs
OWASP
pagefile
Palantir
parallelization
parallelize
params
Parsers
parsers
passwd
patchboard
PathName
PathRegex
pathspec
PayloadType
pc
pdf
pDriverContainer
pe
PEB
pem
performant
PermanentWMIEvents
phishing
PHP
pid
PidLookup
PII
PKCS
PKI
placeholders
plist
plugin
plugins
pmem
png
POC
postgres
postprocessing
PowerShell
powershell
powershell's
PPID
Ppid
ppp
pprof
pre
preconfigure
preconfigured
predictiple
prefetch
prepended
prepends
PrinterNightmare
printf
PrintNightmare
printnightmare
privatekey
PrivilegeList
proactively
proc
procdump
procedurally
proces
ProcessCreation
ProcessHollowing
ProcessID
ProcessInfo
ProcessMemory
ProcessNames
procmon
Procs
programmatically
proto
protobuf
protobufs
PRs
ps
psexe
PsExec
psexec
PsexecService
psexesv
psexesvc
pslist
psql
Pstree
publically
PublishDate
PubSub
Pubsub
pubsub
pulldown
py
pydata
pyvelociraptor
QoS
QPS
QWORD
RabbitMQ
ransomware
RawSec
RBAC
rcuos
RDP
README
realtime
RecordLength
recurse
recursed
recursing
recusive
recyclebin
refactored
regex
RegEx
regexes
regexp
regparser
RegRipper
rekall
Rekall's
relpath
relref
remediations
remoting
repo
repos
represent's
representable
responder
responders
RESTfull
resx
resync
reusability
rhq
RHS
roadmap
RootCAStore
rootkit
RPC
rpcrt
RPCs
RSA
rsync
rubo
runas
runkey
runlist
runme
RunOnce
runtime
rwxr
saml
sbin
sc
scalability
scalable
SCCM
SCHTASKS
scop
scp
screencast
screenshot
screenshots
secfs
securityLogFile
SeDebugPrivilege
sedebugprivilege
SelectMyParent
selectmyparent
sep
serializable
serversideencryption
ServiceCreation
ServiceName
ServiceType
setshortname
SFTP
sftp
SHA
sha
Shae
sharable
shellcode
shimcache
shortname
shoutout
sid
SIEM
signficant
silcollector
SIze
SlackOffset
sleuthkit
sm
SmallestPid
SMB
SMS
smtp
sneakernet
someuser
sourced
sourcetype
spam
speced
specing
splunk
Spooler
spoolsv
Sprintf
sql
SQL's
SQLite
src
SrcAddr
SRUDB
srum
ssd
SSDs
ssh
ssl
ssltls
SSO
stager
standalone
starl
starlark
STDERR
Stderr
stdout
StoredQuery
str
stringifier
struct
struct's
StructName
StructObject
structs
subdirectories
subdirectory
SubjectUserName
SubjectUserSid
subkey
subnet
suboptimal
subqueries
subquery
subscope
subselects
substr
substring
SuccessEventData
SuccessSystem
sudo
summarise
supertimeline
Supertimeline's
svg
swiss
symlink
symlinks
sys
sysadmins
sysinfo
Sysinternal
Sysinternal's
sysinternals
syslog
syslogs
sysmon
Sysmon's
systemctl
systemd
SystemLog
systemLogFile
SystemRoot
systemroot
SystemTime
SysWOW
SZ
Tanium
taskschd
TaskScheduler
tcp
teamers
tempdir
tempfile
Terabytes
Terraform
testcomputer
testdata
th
thirdparty
Thumbdrives
TimeCreated
timeframe
timeline
timelines
timerange
Timestomp
timestomping
timetracker
timezone
timezones
tkape
TLS
tmp
TokenIsElevated
toml
toolbar
TotalUsers
tradeoff
tradeoffs
TriageCapa
triaged
TriageGene
TriageUpload
triaging
trojan
TTP
txt
TypeName
UAC
Ubuntu
UI
uid
uint
unallocated
UNC
unchecking
unhex
uninstall
unix
UnixNano
unpatched
unquarantine
unsplash
untrusted
upcase
Uptime
uri
URIs
url
urls
UrlSize
USD
UseBasicParsing
usec
UserData
UserID
username
usernames
UserSID
userspace
usn
UsnJrnl
usr
UsrClass
utf
utils
uuid
vad
varname
VBA
VBox
vectorpouch
velocidex
velociraptor
velociraptor's
velociraptors
verifications
versioned
versioning
vfilter
VFS
VFSListDirectoryflow
VIRT
VirusTotal
VM
VMs
vmware
vql
VQL's
vqlargs
VQLCollectorArgs
VQLResponse