ruthran-sec·Oct 26Reconstructing a Full Attack Chain: TryHackMe Tempest Walkthrough (Workstation Attack Analysis)From a malicious Word document to a fully owned machine, using Sysmon logs, Timeline Explorer, Wireshark and Brim.
Chandan·Oct 1How to Install Sysmon for Advanced Windows Security LoggingHere are the step-by-step instructions from “How to Install Sysmon for Advanced Windows Security Logging” by Chandan Kumar :
Abdelkerim Abderahim·Oct 1From Brute Force to Data Exfiltration: A Full Walkthrough of a Windows Domain CompromiseA phishing investigation does not end when you identify a malicious email. That is where the real investigation begins.
Endpoint Files·Sep 30What does EDR actually record on an endpoint? The EDR / Endpoint Security answerAn EDR / Endpoint Security sensor writes six families of records: process, file, registry, network, module load and logon. Each row carries…
Hasan Bircan·Sep 28Sysmon Tabanlı Tehdit Algılama: Event ID’lere Göre Saldırı Senaryoları ve Tespit YöntemleriSiber güvenlik operasyonlarında saldırgan davranışlarını tespit etmek için yalnızca antivirüs veya EDR alarmlarına güvenmek çoğu zaman…
Walter Gomez·Sep 24Construí un Purple Team Lab con Wazuh + Sysmon: Esto es lo que detectóUn experimento real para medir si un SIEM open source puede detectar técnicas de adversarios en un endpoint Windows. Los resultados son más…
Samwel Ondima·Sep 21Windows Event LogsIn this post I will cover everything I have learned about Windows event logs. I will start by covering event logs broadly then narrow down…
Olaf Hartong·Sep 18Sysmon Modular, a new toolkit for building and tuning your configurationMany updates, new tooling explained
