<?xml version="1.0" encoding="UTF-8"?>
<urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9">
<url>
<loc>https://research.nasbench.dev/</loc>
<changefreq>weekly</changefreq>
<priority>1</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research</loc>
<changefreq>daily</changefreq>
<priority>0.95</priority>
</url>
<url>
<loc>https://research.nasbench.dev/tooling</loc>
<changefreq>weekly</changefreq>
<priority>0.82</priority>
</url>
<url>
<loc>https://research.nasbench.dev/about</loc>
<changefreq>monthly</changefreq>
<priority>0.6</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/categories/field-notes</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/categories/living-off-the-land</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/categories/process-anatomy</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/categories/event-tracing</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/categories/tracelogging</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>weekly</changefreq>
<priority>0.8</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/windowsterminal</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/sensorlogontask</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/calc-execution-choice</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/suspicious-com-powershell</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/curl</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/react-next-child-processes-notes</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/security-logs-generated-at-boot</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/etw/microsoft-windows-smbclient</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/agentexecutor</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/windows-processes/fsutil</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/tracelogging-providers/microsoft.windows.terminal.app</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/tracelogging-providers/microsoft.windows.terminal.win32host</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/windows-processes/at</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/shim-database-xml-format</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/tracking-parent-child-process-relationship-via-bam</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/windows-compatibility-quirks</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/etw/microsoft-windows-kernel-general</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/datacollector</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/libz-inject-dll-artefact</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/dism-temporary-directory</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/list-of-application-calling-registerapplicationrestart</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/finding-shimdbc</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/documented-compat-application-layers</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/persistence-via-registerapprestart-shim</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/undocumented-flags-sdbinst</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/living-of-the-shims</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/standalonerunner</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/documented-compat-application-shims</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/uwp-applications-persistence</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/notepad-tabstate</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/odbcconf</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/trendmicro-tisezins</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/built-in-powershell-aliases</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/etw/microsoft-windows-windows-firewall-with-advanced-security-dfir-updates</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/symantec-winexec</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/netlimiter-psrun</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/onedrive</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/winget</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/dumpminitool</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/lolbins/microsoft.nodejstools.pressanykey</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/invoke-commandindesktoppackage-cmdlet-usage</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/research/other/powershell-suspicious-keywords-list</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.76</priority>
</url>
<url>
<loc>https://research.nasbench.dev/tooling/proof-of-concept/custom-console-handoff</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.68</priority>
</url>
<url>
<loc>https://research.nasbench.dev/tooling/proof-of-concept/builtin-shim-hijacking</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.68</priority>
</url>
<url>
<loc>https://research.nasbench.dev/tooling/proof-of-concept/ffiddler-classic-extension-persistence</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.68</priority>
</url>
<url>
<loc>https://research.nasbench.dev/tooling/proof-of-concept/malicious-chm</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.68</priority>
</url>
<url>
<loc>https://research.nasbench.dev/tooling/pentest/brutegf</loc>
<lastmod>2026-04-17</lastmod>
<changefreq>monthly</changefreq>
<priority>0.68</priority>
</url>
</urlset>
