<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# API Reference — Detecting Living-off-the-Land on Endpoints

## Commands

| Command | Description |
|---|---|
| `Get-WinEvent Sysmon EID 1` | Get process creation events |
| `Get-WinEvent Security EID 4688` | Get Windows process creation events |
| `Get-WinEvent Sysmon EID 3` | Get network connection events |
| `Get-Process` | List currently running processes |
| `Get-CimInstance Win32_Process` | Get detailed process information |
| `wevtutil qe` | Query Windows event logs |
| `auditctl -l` | List active Linux audit rules |

## Agent Script

```bash
# node agent.js analyze --process <value> --cmdline <value>
# node agent.js hunt --binary <value>
# node agent.js baseline --hostname <value>
```
