A Sigma rule for cleared event logs catches one of the noisiest things an attacker can do on the way out: wiping the Windows event ...
Sigma Rule for Cleared Event Logs: Event 1102
Detecting Kerberoasting with Windows Event ID 4769
Showing posts with label Defense Evasion. Show all posts
Showing posts with label Defense Evasion. Show all posts
Subscribe to:
Posts (Atom)
