PowerShell event log management has two halves that are usually written about separately and shouldn't be: querying the logs ...
PowerShell Event Log Management for Windows Security
From Logs to Threats: SIEM Correlation Rules for Real Attacks
Showing posts with label Security Monitoring. Show all posts
Showing posts with label Security Monitoring. Show all posts
PowerShell Script Block Logging with Event ID 4104
Most PowerShell-based attacks rely on the same trick: pass a Base64-encoded command, a string concatenation, or a script downloaded ...
Detecting Kerberoasting with Windows Event ID 4769
Kerberoasting ( MITRE ATT&CK T1558.003 ) is one of the few credential-access techniques that produces a clean, on-prem audit sig...
Sysmon Configuration for Windows Security Monitoring
Native Windows auditing covers a surprising amount of ground, but it has known gaps: no file hashes on process creation, no outbound...
Windows Event Forwarding Setup for Centralised Logs
Knowing which event IDs to watch is half the job; getting them off every endpoint before the local Security log wraps is the other h...
Subscribe to:
Posts (Atom)