builtin

security

Dec 19, 2024 ·
Share on:

Read More
firewall_as

Dec 1, 2024 ·
Share on:

Read More
bits_client

Oct 25, 2024 ·
Share on:

Read More
code_integrity

Oct 8, 2024 ·
Share on:

Read More
iis-configuration

Oct 6, 2024 ·
Share on:

Read More
system

Oct 1, 2024 ·
Share on:

Read More
windefend

Sep 22, 2024 ·
Share on:

Read More
smbclient

Sep 13, 2024 ·
Share on:

Read More
application

Sep 2, 2024 ·
Share on:

Read More
appxdeployment_server

Aug 29, 2024 ·
Share on:

Read More
ldap

Aug 27, 2024 ·
Share on:

Read More
dns_client

Aug 23, 2024 ·
Share on:

Read More
applocker

Aug 12, 2024 ·
Share on:

Read More
appmodel_runtime

Aug 12, 2024 ·
Share on:

Read More
appxpackaging_om

Aug 12, 2024 ·
Share on:

Read More
capi2

Aug 12, 2024 ·
Share on:

Read More
certificate_services_client_lifecycle_system

Aug 12, 2024 ·
Share on:

Read More
diagnosis

Aug 12, 2024 ·
Share on:

Read More
dns_server

Aug 12, 2024 ·
Share on:

Read More
driverframeworks

Aug 12, 2024 ·
Share on:

Read More
lsa_server

Aug 12, 2024 ·
Share on:

Read More
Mimikatz Use

Aug 12, 2024 · attack.s0002 attack.lateral-movement attack.credential-access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More
msexchange

Aug 12, 2024 ·
Share on:

Read More
ntlm

Aug 12, 2024 ·
Share on:

Read More
openssh

Aug 12, 2024 ·
Share on:

Read More
security_mitigations

Aug 12, 2024 ·
Share on:

Read More
servicebus

Aug 12, 2024 ·
Share on:

Read More
shell_core

Aug 12, 2024 ·
Share on:

Read More
taskscheduler

Aug 12, 2024 ·
Share on:

Read More
terminalservices

Aug 12, 2024 ·
Share on:

Read More
wmi

Aug 12, 2024 ·
Share on:

Read More