diff --git a/.github/latest_archiver_output.md b/.github/latest_archiver_output.md
index b7a0a1862751..1c5efb0142cd 100644
--- a/.github/latest_archiver_output.md
+++ b/.github/latest_archiver_output.md
@@ -1,6 +1,6 @@
 # Reference Archiver Results
 
-Last Execution: 2024-07-15 02:26:13
+Last Execution: 2024-08-15 02:11:09
 
 ### Archiver Script Results
 
@@ -11,154 +11,142 @@ N/A
 
 #### Already Archived References
 
-- https://github.com/redcanaryco/atomic-red-team/blob/4d6c4e8e23d465af7a2388620cfe3f8c76e16cf0/atomics/T1082/T1082.md
-- https://www.sans.org/blog/protecting-privileged-domain-accounts-lm-hashes-the-good-the-bad-and-the-ugly/
-- https://unit42.paloaltonetworks.com/chromeloader-malware/
-- https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html
-- https://github.com/api0cradle/LOLBAS/blob/d148d278f5f205ce67cfaf49afdfb68071c7252a/OSScripts/pester.md
-- https://github.com/wavestone-cdt/EDRSandblast
-- https://attackerkb.com/topics/2faW2CxJgQ/cve-2023-4966
-- https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
-- https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9af72f8aa552dc4aaeca3/behavior
-- https://objective-see.org/blog/blog_0x6D.html
-- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
-- https://www.x86matthew.com/view_post?id=create_svc_rpc
+- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
+- https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
+- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
+- https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
+- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
+- https://github.com/antonioCoco/RoguePotato
+- https://www.intrinsec.com/akira_ransomware/
+- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
+- https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
+- https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh
+- https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
+- https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
+- https://ss64.com/mac/system_profiler.html
 
 #### Error While Archiving References
 
-- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
-- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
-- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
-- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
-- https://linux.die.net/man/1/arecord
-- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
-- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
 - https://www.ihteam.net/advisory/terramaster-tos-multiple-vulnerabilities/
-- https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
-- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
-- https://lolbas-project.github.io/lolbas/Binaries/Tar/
+- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
+- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
+- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
+- https://social.technet.microsoft.com/wiki/contents/articles/7535.adfind-command-examples.aspx
+- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
+- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
+- https://www.tarasco.org/security/pwdump_7/
+- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101
 - https://research.checkpoint.com/2023/the-rhysida-ransomware-activity-analysis-and-ties-to-vice-society/
-- https://github.com/fortra/nanodump
-- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
+- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
+- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
 - https://www.malwarebytes.com/blog/detections/pum-optional-nodispbackgroundpage
-- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
-- https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh
-- https://www.group-ib.com/blog/apt41-world-tour-2021/
-- https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
-- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010
-- https://github.com/netero1010/EDRSilencer
-- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
-- https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
+- https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
+- https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
 - https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.ControlPanelDisplay::CPL_Personalization_NoDesktopBackgroundUI
-- https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
-- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper
-- https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
-- https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
-- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
-- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
-- https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
-- https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
-- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
-- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/
-- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
-- https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
-- https://objective-see.org/blog/blog_0x62.html
-- https://www.intrinsec.com/akira_ransomware/
-- https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
-- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
-- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
-- https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
-- https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
-- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
-- https://www.hexacorn.com/blog/2023/12/31/1-little-known-secret-of-forfiles-exe/
+- https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
+- https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296
+- https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
 - https://www.cyberciti.biz/faq/linux-remove-user-command/
-- https://twitter.com/bohops/status/1740022869198037480
+- https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html
 - https://www.cyberciti.biz/tips/linux-iptables-how-to-flush-all-rules.html
-- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
-- https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
-- https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl
-- https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
-- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
-- https://www.group-ib.com/resources/threat-research/red-curl-2.html
-- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
-- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
-- https://www.hexacorn.com/blog/2022/01/16/beyond-good-ol-run-key-part-135/
+- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
+- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
+- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
+- https://support.citrix.com/article/CTX579459/netscaler-adc-and-netscaler-gateway-security-bulletin-for-cve20234966-and-cve20234967
+- https://www.hexacorn.com/blog/2018/04/23/beyond-good-ol-run-key-part-77/
+- https://github.com/fortra/nanodump
 - http://www.hexacorn.com/blog/2016/07/22/beyond-good-ol-run-key-part-42/
+- https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_22.12.2023.txt
+- https://github.com/netero1010/EDRSilencer
+- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
+- https://www.hexacorn.com/blog/2017/01/14/beyond-good-ol-run-key-part-53/
 - https://www.welivesecurity.com/2017/10/20/osx-proton-supply-chain-attack-elmedia/
+- https://www.sans.org/cyber-security-summit/archives
+- https://www.attackiq.com/2023/09/20/emulating-rhysida/
+- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
+- https://www.virustotal.com/gui/file/39102fb7bb6a74a9c8cb6d46419f9015b381199ea8524c1376672b30fffd69d2
+- https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
+- http://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
+- https://twitter.com/bohops/status/1740022869198037480
+- https://posts.specterops.io/the-tale-of-settingcontent-ms-files-f1ea253e4d39
+- https://cydefops.com/devtunnels-unleashed
+- https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
 - https://www.virustotal.com/gui/file/a864282fea5a536510ae86c77ce46f7827687783628e4f2ceb5bf2c41b8cd3c6/behavior
-- https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
-- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
-- https://us-cert.cisa.gov/ncas/analysis-reports/ar21-126a
-- https://www.aon.com/cyber-solutions/aon_cyber_labs/linux-based-inter-process-code-injection-without-ptrace2/
-- https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
+- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
+- https://petrusviet.medium.com/dancing-on-the-architecture-of-vmware-workspace-one-access-eng-ad592ae1b6dd
+- https://github.com/grayhatkiller/SharpExShell
+- https://objective-see.org/blog/blog_0x62.html
+- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5001
+- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
+- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
+- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+- https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
+- https://posts.specterops.io/lateral-movement-scm-and-dll-hijacking-primer-d2f61e8ab992
+- https://paper.seebug.org/1495/
+- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
+- https://www.hexacorn.com/blog/2013/01/19/beyond-good-ol-run-key-part-3/
+- https://www.hexacorn.com/blog/2018/04/20/kernel-hacking-tool-you-might-have-never-heard-of-xuetr-pchunter/
+- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
 - https://www.cyberciti.biz/faq/how-force-kill-process-linux/
-- https://www.group-ib.com/blog/cve-2023-38831-winrar-zero-day/
-- https://cydefops.com/devtunnels-unleashed
-- https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
-- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5101
-- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
-- https://github.com/antonioCoco/RoguePotato
+- https://linux.die.net/man/1/arecord
+- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
+- https://medium.com/@msuiche/the-nsa-compromised-swift-network-50ec3000b195
+- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
+- https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
+- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
+- https://www.hexacorn.com/blog/2019/02/15/beyond-good-ol-run-key-part-103/
+- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
+- https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
 - https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/
+- https://megatools.megous.com/
 - https://developers.cloudflare.com/cloudflare-one/connections/connect-networks/do-more-with-tunnels/trycloudflare/
+- http://www.hexacorn.com/blog/2018/05/01/wab-exe-as-a-lolbin/
+- https://unit42.paloaltonetworks.com/cloaked-ursa-phishing/
 - https://www.hexacorn.com/blog/2018/12/30/beyond-good-ol-run-key-part-98/
-- https://linux.die.net/man/8/useradd
-- https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior
-- https://www.sans.org/cyber-security-summit/archives
-- https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_30.10.2023.txt
+- http://www.hexacorn.com/blog/2019/03/30/sqirrel-packages-manager-as-a-lolbin-a-k-a-many-electron-apps-are-lolbins-by-default/
+- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
+- https://lolbas-project.github.io/lolbas/Binaries/Tar/
 - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
-- https://www.deepinstinct.com/blog/nofilter-abusing-windows-filtering-platform-for-privilege-escalation
-- http://www.hexacorn.com/blog/2017/07/31/the-wizard-of-x-oppa-plugx-style/
-- https://www.virustotal.com/gui/file/39102fb7bb6a74a9c8cb6d46419f9015b381199ea8524c1376672b30fffd69d2
-- https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
 - http://www.hexacorn.com/blog/2017/05/01/running-programs-via-proxy-jumping-on-a-edr-bypass-trampoline/
-- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e
-- https://www.rapid7.com/blog/post/2023/10/25/etr-cve-2023-4966-exploitation-of-citrix-netscaler-information-disclosure-vulnerability/
-- https://www.hexacorn.com/blog/2017/01/18/beyond-good-ol-run-key-part-55/
-- https://www.hexacorn.com/blog/2020/08/23/odbcconf-lolbin-trifecta/
-- https://www.fireeye.com/blog/threat-research/2020/01/saigon-mysterious-ursnif-fork.html
-- https://docs.connectwise.com/ConnectWise_Control_Documentation/Get_started/Host_client/View_menu/Backstage_mode
-- https://www.aon.com/cyber-solutions/aon_cyber_labs/yours-truly-signed-av-driver-weaponizing-an-antivirus-driver/
-- https://news.ycombinator.com/item?id=29504755
-- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
-- https://megatools.megous.com/
-- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
-- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
-- https://x.com/_st0pp3r_/status/1742203752361128162?s=20
-- http://www.hexacorn.com/blog/2020/05/25/how-to-con-your-host/
-- https://www.hexacorn.com/blog/2018/09/02/beyond-good-ol-run-key-part-86/
-- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a
-- https://www.hexacorn.com/blog/2018/04/27/i-shot-the-sigverif-exe-the-gui-based-lolbin/
-- https://www.hexacorn.com/blog/2018/04/22/beyond-good-ol-run-key-part-76/
-- https://www.reverse.it/sample/0b4ef455e385b750d9f90749f1467eaf00e46e8d6c2885c260e1b78211a51684?environmentId=100
-- https://blogs.vmware.com/security/2023/11/jupyter-rising-an-update-on-jupyter-infostealer.html
-- https://community.f5.com/t5/technical-forum/icontrolrest-11-5-execute-bash-command/td-p/203029
+- https://www.group-ib.com/resources/threat-research/red-curl-2.html
+- https://www.hexacorn.com/blog/2013/12/08/beyond-good-ol-run-key-part-5/
+- https://www.hexacorn.com/blog/2019/09/20/beyond-good-ol-run-key-part-116/
+- https://www.virustotal.com/gui/file/05a2adb266ec6c0ba9ed176d87d8530e71e845348c13caf9f60049760c312cd3/behavior
+- http://www.hexacorn.com/blog/2020/02/05/stay-positive-lolbins-not/
 - https://web.archive.org/web/20160727113019/https://answers.microsoft.com/en-us/protect/forum/mse-protect_scanning/microsoft-antimalware-has-removed-history-of/f15af6c9-01a9-4065-8c6c-3f2bdc7de45e
-- https://ss64.com/osx/sw_vers.html
-- https://paper.seebug.org/1495/
+- https://doublepulsar.com/kaseya-supply-chain-attack-delivers-mass-ransomware-event-to-us-companies-76e4ec6ec64b
+- https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_30.10.2023.txt
+- https://www.group-ib.com/blog/apt41-world-tour-2021/
+- https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
+- https://www.malwarebytes.com/blog/detections/pum-optional-nodispcpl
+- https://www.linkedin.com/pulse/guntior-story-advanced-bootkit-doesnt-rely-windows-disk-baranov-wue8e/
+- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
+- https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.3
+- https://www.fireeye.com/blog/threat-research/2020/05/tactics-techniques-procedures-associated-with-maze-ransomware-incidents.html
+- https://admx.help/?Category=Windows_10_2016&Policy=Microsoft.Policies.WindowsDesktop::Wallpaper
+- https://x.com/_st0pp3r_/status/1742203752361128162?s=20
+- https://reconshell.com/winpwn-tool-for-internal-windows-pentesting-and-ad-security/
+- https://www.hexacorn.com/blog/2020/02/02/settingsynchost-exe-as-a-lolbin
+- https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/troubleshoot-microsoft-defender-antivirus?view=o365-worldwide#event-id-5010
 - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_30.10.2023.txt
-- https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296
-- https://github.com/grayhatkiller/SharpExShell
-- https://github.com/pr0xylife/Pikabot/blob/main/Pikabot_22.12.2023.txt
-- https://ss64.com/mac/system_profiler.html
+- https://ss64.com/osx/csrutil.html
+- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4662
+- https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
 - https://www.hexacorn.com/blog/2015/01/13/beyond-good-ol-run-key-part-24/
+- https://www.lifars.com/wp-content/uploads/2022/01/GriefRansomware_Whitepaper-2.pdf
+- https://www.optiv.com/blog/post-exploitation-using-netntlm-downgrade-attacks
+- https://linux.die.net/man/8/useradd
 - https://github.com/gentilkiwi/mimikatz
-- https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
-- https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
-- https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
-- https://www.hexacorn.com/blog/2018/05/28/beyond-good-ol-run-key-part-78-2/
-- https://www.cyberciti.biz/faq/xclip-linux-insert-files-command-output-intoclipboard/
-- https://www.hexacorn.com/blog/2013/09/19/beyond-good-ol-run-key-part-4/
+- https://news.ycombinator.com/item?id=29504755
 - https://github.com/pr0xylife/Pikabot/blob/7f7723a74ca325ec54c6e61e076acce9a4b20538/Pikabot_22.12.2023.txt
-- https://www.fortinet.com/blog/threat-research/konni-campaign-distributed-via-malicious-document
-- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
-- https://www.hexacorn.com/blog/2023/06/07/this-lolbin-doesnt-exist/
-- https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
+- https://www.hexacorn.com/blog/2018/08/31/beyond-good-ol-run-key-part-85/
+- https://us-cert.cisa.gov/ncas/alerts/aa21-259a
+- http://www.hexacorn.com/blog/2018/08/16/squirrel-as-a-lolbin/
+- https://www.publicnow.com/view/EB87DB49C654D9B63995FAD4C9DE3D3CC4F6C3ED?1671634841
+- http://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
+- https://ss64.com/osx/sw_vers.html
+- https://learn.microsoft.com/en-us/dotnet/core/runtime-config/debugging-profiling
 - https://github.com/xuanxuan0/DripLoader
-- https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf
-- https://ss64.com/osx/csrutil.html
-- https://www.splunk.com/en_us/blog/security/you-bet-your-lsass-hunting-lsass-access.html
-- https://www.rnbo.gov.ua/files/2023_YEAR/CYBERCENTER/november/APT29%20attacks%20Embassies%20using%20CVE-2023-38831%20-%20report%20en.pdf
-- https://peterjson.medium.com/reproducing-the-proxyshell-pwn2own-exploit-49743a4ea9a1
-- https://www.attackiq.com/2023/09/20/emulating-rhysida/
-- https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
-- https://www.tarasco.org/security/pwdump_7/
+- https://github.com/deepinstinct/NoFilter/blob/121d215ab130c5e8e3ad45a7e7fcd56f4de97b4d/NoFilter/Consts.cpp
diff --git a/tests/rule-references.txt b/tests/rule-references.txt
index c579f2b4635e..9a6d7e1c5940 100644
--- a/tests/rule-references.txt
+++ b/tests/rule-references.txt
@@ -3519,3 +3519,18 @@ https://www.virustotal.com/gui/file/d6f6bc10ae0e634ed4301d584f61418cee18e5d58ad9
 https://objective-see.org/blog/blog_0x6D.html
 https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a
 https://www.x86matthew.com/view_post?id=create_svc_rpc
+https://www.assetnote.io/resources/research/citrix-bleed-leaking-session-tokens-with-cve-2023-4966
+https://www.virustotal.com/gui/file/16bafdf741e7a13137c489f3c8db1334f171c7cb13b62617d691b0a64783cc48/behavior
+https://mp.weixin.qq.com/s/wUoBy7ZiqJL2CUOMC-8Wdg
+https://learn.microsoft.com/en-us/troubleshoot/windows-server/windows-security/prevent-windows-store-lm-hash-password
+https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html
+https://github.com/antonioCoco/RoguePotato
+https://www.intrinsec.com/akira_ransomware/
+https://f5-sdk.readthedocs.io/en/latest/apidoc/f5.bigip.tm.util.html#module-f5.bigip.tm.util.bash
+https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
+https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
+https://github.com/AonCyberLabs/Cexigua/blob/34d338620afae4c6335ba8d8d499e1d7d3d5d7b5/overwrite.sh
+https://www.crowdstrike.com/blog/windows-restart-manager-part-1/
+https://www.virustotal.com/gui/file/483fafc64a2b84197e1ef6a3f51e443f84dc5742602e08b9e8ec6ad690b34ed0/behavior
+https://ss64.com/mac/system_profiler.html