A repository to aid windows threat hunters to look for some common artifacts during their day to day operations.
https://github.com/beahunt3r/Windows-Hunting
@Blueteamlibrary
https://github.com/beahunt3r/Windows-Hunting
@Blueteamlibrary
GitHub
GitHub - beahunt3r/Windows-Hunting
Contribute to beahunt3r/Windows-Hunting development by creating an account on GitHub.
Heuristic DNS detections in Azure Security Center
https://azure.microsoft.com/en-us/blog/heuristic-dns-detections-in-azure-security-center/
@Blueteamlibrary
https://azure.microsoft.com/en-us/blog/heuristic-dns-detections-in-azure-security-center/
@Blueteamlibrary
Microsoft Azure Blog
Heuristic DNS detections in Azure Security Center | Microsoft Azure Blog
We have heard from many customers about their challenges with detecting highly evasive threats. Today, we are discussing some of our more complex, heuristic techniques to detect malicious use of this vital protocol and how these detect key components of common…
Network Forensics with Windows DNS Analytical Logging
https://blogs.technet.microsoft.com/teamdhcp/2015/11/23/network-forensics-with-windows-dns-analytical-logging/
@Blueteamlibrary
https://blogs.technet.microsoft.com/teamdhcp/2015/11/23/network-forensics-with-windows-dns-analytical-logging/
@Blueteamlibrary
Basics of Tracking WMI Activity
https://www.darkoperator.com/blog/2017/10/14/basics-of-tracking-wmi-activity
@Blueteamlibrary
https://www.darkoperator.com/blog/2017/10/14/basics-of-tracking-wmi-activity
@Blueteamlibrary
Shell is Only the Beginning
Basics of Tracking WMI Activity
WMI (Windows Management Instrumentation) has been part of the Windows Operating System since since Windows 2000 when it was included in the OS. The technology has been of great value to system administrators by providing ways to pull all types of information…
Cyber Security Monitoring and Logging Guide
https://www.crest-approved.org/wp-content/uploads/2015/05/Cyber-Security-Monitoring-Guide.pdf
@Blueteamlibrary
https://www.crest-approved.org/wp-content/uploads/2015/05/Cyber-Security-Monitoring-Guide.pdf
@Blueteamlibrary
Trimarc Research: Detecting Password Spraying with Security Event Auditing
https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
@BlueTeamLibrary
https://www.trimarcsecurity.com/single-post/2018/05/06/Trimarc-Research-Detecting-Password-Spraying-with-Security-Event-Auditing
@BlueTeamLibrary
Trimarc Content Hub
Trimarc Research: Detecting Password Spraying with Security Event Auditing
A common method attackers leverage as well as many penetration testers and Red Teamers is called "password spraying". Password spraying is interesting because it’s automated password guessing. This automated password guessing against all users typically avoids…
Security baseline for Office 2016 and Office 365 ProPlus apps – FINAL
https://blogs.technet.microsoft.com/secguide/2018/02/13/security-baseline-for-office-2016-and-office-365-proplus-apps-final/
@BlueTeamLibrary
https://blogs.technet.microsoft.com/secguide/2018/02/13/security-baseline-for-office-2016-and-office-365-proplus-apps-final/
@BlueTeamLibrary
Securing Privileged Access Reference Material
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows-server/identity/securing-privileged-access/securing-privileged-access-reference-material
@BlueTeamLibrary
Docs
Securing privileged access Enterprise access model - Privileged access
Securing privileged access is part of an enterprise access model
Use PowerShell to Find the History of USB Flash Drive Usage
https://blogs.technet.microsoft.com/heyscriptingguy/2012/05/18/use-powershell-to-find-the-history-of-usb-flash-drive-usage/
@BlueTeamLibrary
https://blogs.technet.microsoft.com/heyscriptingguy/2012/05/18/use-powershell-to-find-the-history-of-usb-flash-drive-usage/
@BlueTeamLibrary
Forensic Artifacts: evidences of program execution on Windows systems
https://www.andreafortuna.org/dfir/forensic-artifacts-evidences-of-program-execution-on-windows-systems/
@BlueTeamLibrary
https://www.andreafortuna.org/dfir/forensic-artifacts-evidences-of-program-execution-on-windows-systems/
@BlueTeamLibrary
Tales of a Threat Hunter 2: Following the trace of WMI Backdoors & other nastiness
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
@BlueTeamLibrary
https://www.eideon.com/2018-03-02-THL03-WMIBackdoors/
@BlueTeamLibrary
Working as a Blue Teamer - Amanda Berlin - Hackers Helping Hackers Webinar #2
At 8pm GMT+10
https://www.youtube.com/watch?v=LhX3pkDGZlk
@BlueTeamLibrary
At 8pm GMT+10
https://www.youtube.com/watch?v=LhX3pkDGZlk
@BlueTeamLibrary
YouTube
Working as a Blue Teamer - Amanda Berlin - HHH Webinar #2
Description ------------ For the second webinar, we would like to introduce them to what it is like working in the blue team. Specifically: - The pathways to...
PowerShell Security: Enabling Transcription Logging by using Group Policy
https://sid-500.com/2017/11/07/powershell-enabling-transcription-logging-by-using-group-policy/
@BlueTeamLibrary
https://sid-500.com/2017/11/07/powershell-enabling-transcription-logging-by-using-group-policy/
@BlueTeamLibrary
SID-500.COM
PowerShell Security: Enabling Transcription Logging by using Group Policy
In one of my previous posts “PowerShell: Documenting your work with Start-Transcript” I’ve described how to manually configure PowerShell Transcripting by using the command Start-…
Deploy Windows Defender Application Control policy rules and file rules
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create
@BlueTeamLibrary
https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create
@BlueTeamLibrary
Docs
Understand Windows Defender Application Control (WDAC) policy rules and file rules (Windows) - Windows security
Learn how WDAC policy rules and file rules can control your Windows 10 and Windows 11 computers.
Top 25 Active Directory Security Best Practices
https://activedirectorypro.com/active-directory-security-best-practices
@BlueTeamLibrary
https://activedirectorypro.com/active-directory-security-best-practices
@BlueTeamLibrary
Active Directory Pro
Active Directory Security Best Practices (Checklist)
This is the most comprehensive list of Active Directory Security Best Practices online. In this guide, I’ll share my recommendations for Active Directory
Hunting for evil: detect macros being executed
https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
@BlueTeamLibrary
https://outflank.nl/blog/2018/01/16/hunting-for-evil-detect-macros-being-executed/
@BlueTeamLibrary
Practical PowerShell Security: Enable Auditing and Logging with DSC
https://blogs.technet.microsoft.com/ashleymcglone/2017/03/29/practical-powershell-security-enable-auditing-and-logging-with-dsc/
@BlueTeamLibrary
https://blogs.technet.microsoft.com/ashleymcglone/2017/03/29/practical-powershell-security-enable-auditing-and-logging-with-dsc/
@BlueTeamLibrary