Thread by @dipanshukp

Track #Malicious #Windows Logon Attempts with Logon Tracer 🧐 It will help to see in which account login attempt occurs and which host is used.

🧵This thread explains you how it works 👇👇

#TheSecureEdge #BugBounty #infosec #cyberattacks

LogonTracer is a tool to investigate malicious logon by visualizing and analyzing Windows Active Directory event logs. This tool associates a hostname (or an IP address) and account name found in logon-related events and displays it as a graph 🤯

Windows Logon EventID is as follows 👇

• 4624: Successful logon
• 4625: Logon failure
• 4768: Kerberos Authentication (TGT Request)
• 4769: Kerberos Service Ticket (ST Request)
• 4776: NTLM Authentication
• 4672: Assign special privileges

Here you can find the link. If you found this thread valuable, follow @dipanshukp , sharing #infosec related news/info every day✨

github.com/JPCERTCC/Logon…