A thing I see a lot is that AppLocker is used to “protect” servers and prevent admins from doing certain things. In this post I want to go over what sort of security this gives so that …

First published on CloudBlogs on Jul, 26 2018 Howdy folks, Today, we’re turning on the public preview of Azure AD Activity Logs in Azure Monitor (Azure’s platform-wide monitoring service) — offering you long-term retention as well as seamless integration.…

As a defender I am continuously testing, tuning and re-testing a plethora of detection ideas across many complementary detection frameworks. However, a skilled DFIR practitioner values the confidence gained from cross-validating one tool's results with those…

In our first post of this series, we explored the Honeyhash, and how it can be used to create a honeypot to catch attackers performing credential theft and pass-the-hash attacks.  Now that our trap is set, we need to make sure we can catch any attacker in…

Look up the causes and solutions for Windows Defender Antivirus event IDs and errors

Learn about how you can use logging data to gain deep insights about your application.

INTRODUCTION The great people at ClearSky  reached out to me a couple of days ago regarding a sample that they suspected could be related...

Userland API Monitoring and Code Injection Detection About This Paper The following document is a result of self-research of malicious software (malware) and its interaction with the Windows Application Programming Interface (WinAPI). It details the fundamental…

There are several ways that change tracking mechanisms can differ Scope for tracking changes An application can track changes to a single attribute of a single object, to all objects in a domain, and so on.

Search engine crawlers, botnets, and mass scanners are constantly probing the entire IPv4 space of the internet Determining which incoming traffic is friendly is an ongoing task for network administrators and information security professionals

Memory forensics is a powerful tool. All executed code and data passes through RAM which makes it perfect for hunting malware. Most discussion on memory forensics is focused (rightly) on malware analysis, and the benefits of memory forensics for non-malware…

A blog post showing how to extract packets from a large set of PCAP files (or one big file), which is often required to be able to look at the details in Wireshark.

Managing permissions with PowerShell is only a bit easier than in VBS or the command line as there are no cmdlets for most day-to-day tasks like getting a permission report or adding permission to ...

Tools like Sysmon and Osquery are useful in detecting anomalous behavior on endpoints. These tools give us good visibility of what’s happening on endpoints by logging multiple types of events, which we can forward to a SIEM or other correlation system for…

Incident Response Methodologies 2022. Contribute to certsocietegenerale/IRM development by creating an account on GitHub.

An approach for managing the automated creation of Microsoft AppLocker policies using PowerShell.

SANS Penetration Testing blog pertaining to Opening a Can of Active Defense and Cyber Deception to Confuse and Frustrate Attackers

A cohesive and comprehensive walk-through of the most common and empirically useful RDP-related Windows Event Log Sources and ID's, grouped by stage of occurrence (Connection, Authentication, Logon, Disconnect/Reconnect, Logoff).

Red Canary's CSO recaps the findings of a recent SANS endpoint survey and evaluates strategies that organizations can use to drive better security outcomes.