Kerberoasting ( MITRE ATT&CK T1558.003 ) is one of the few credential-access techniques that produces a clean, on-prem audit sig...
Detecting Kerberoasting with Windows Event ID 4769
PowerShell Script Block Logging with Event ID 4104
Sysmon Configuration for Windows Security Monitoring
Native Windows auditing covers a surprising amount of ground, but it has known gaps: no file hashes on process creation, no outbound...
Windows Event Forwarding Setup for Centralised Logs
Knowing which event IDs to watch is half the job; getting them off every endpoint before the local Security log wraps is the other h...
Useful Advanced Hunting KQL Queries in Microsoft Defender
Microsoft Defender's Advanced Hunting is genuinely useful — possibly the most useful thing in the portal that does not have a f...
Automating Phishing Simulations for New Employees in M365 — Sort Of
A few weeks ago we tried to improve our phishing simulation game for new employees in Microsoft 365 . The goal was simple: new hire...
Subscribe to:
Posts (Atom)
