Do you do Windows event log analysis? A round up of tips follows: #DFIR
If you manage Internet facing Windows boxes, here are 7 pages of post-compromise actions by RDP brute forcers: #DFIR
Use your infrastructure as a sensor. How to use Windows Event Forwarding:
Some #Windows10 events useful for threat hunting:
Spot @enigma0x3's UAC bypass:
Spot threats using DNS events: blogs.technet.microsoft.com/teamdhcp/2015/…
Share this Scrolly Tale with your friends.
A Scrolly Tale is a new way to read Twitter threads with a more visually immersive experience.
Discover more beautiful Scrolly Tales like this.