builtin

security

Sep 29, 2023 ·
Share on:

Read More
firewall_as

Sep 10, 2023 ·
Share on:

Read More
appxdeployment_server

Aug 17, 2023 ·
Share on:

Read More
bits_client

Aug 17, 2023 ·
Share on:

Read More
system

Aug 10, 2023 ·
Share on:

Read More
code_integrity

Jul 26, 2023 ·
Share on:

Read More
application

Jul 5, 2023 ·
Share on:

Read More
windefend

Jun 21, 2023 ·
Share on:

Read More
dns_server

May 30, 2023 ·
Share on:

Read More
capi2

May 18, 2023 ·
Share on:

Read More
certificate_services_client_lifecycle_system

May 18, 2023 ·
Share on:

Read More
taskscheduler

May 17, 2023 ·
Share on:

Read More
lsa_server

May 5, 2023 ·
Share on:

Read More
msexchange

Apr 30, 2023 ·
Share on:

Read More
smbclient

Apr 11, 2023 ·
Share on:

Read More
appmodel_runtime

Feb 6, 2023 ·
Share on:

Read More
appxpackaging_om

Feb 1, 2023 ·
Share on:

Read More
diagnosis

Feb 1, 2023 ·
Share on:

Read More
dns_client

Feb 1, 2023 ·
Share on:

Read More
driverframeworks

Feb 1, 2023 ·
Share on:

Read More
Mimikatz Use

Feb 1, 2023 · attack.s0002 attack.lateral_movement attack.credential_access car.2013-07-001 car.2019-04-004 attack.t1003.002 attack.t1003.004 attack.t1003.001 attack.t1003.006 ·
Share on:

This method detects mimikatz keywords in different Eventlogs (some of them only appear in older Mimikatz version that are however still used by different threat groups)

Read More
ntlm

Feb 1, 2023 ·
Share on:

Read More
security_mitigations

Feb 1, 2023 ·
Share on:

Read More
shell_core

Feb 1, 2023 ·
Share on:

Read More
terminalservices

Feb 1, 2023 ·
Share on:

Read More
wmi

Feb 1, 2023 ·
Share on:

Read More
ldap

Jan 30, 2023 ·
Share on:

Read More
dns_server_analytic

Jan 2, 2023 ·
Share on:

Read More
openssh

Oct 25, 2022 ·
Share on:

Read More
applocker

Oct 25, 2022 ·
Share on:

Read More
servicebus

Oct 9, 2022 ·
Share on:

Read More