A Logo

Feel free to include my content in your page via my
RSS feed

Help Irongeek.com pay for
bandwidth and research equipment:

Subscribestar or Patreon

Search Irongeek.com:

Affiliates:
Irongeek Button
Social-engineer-training Button

Help Irongeek.com pay for bandwidth and research equipment:

paypalpixle


Windows Event Logs - Zero to Hero - Nate Guagenti & Adam Swan Bloomcon 2017 (Hacking Illustrated Series InfoSec Tutorial Videos)

Windows Event Logs - Zero to Hero
Nate Guagenti & Adam Swan

Bloomcon 2017

This talk will demonstrate how a security analyst(s) can leverage existing Microsoft Windows features to monitor Windows Event Logs across their domain. Several examples will be provided to show how an analyst can leverage Windows Event logs to detect persistence mechanisms (scheduled tasks), Windows AD modifications and backdoors, malicious PowerShell, and more. This talk is separate from the many Sysinternals Sysmon presentations because it focuses on auditing capabilities available without installing extra clients. Additionally, the existing auditing capabilities can be used to detect security events that Sysmon can not. For instance, "SeEnableDelegationPrivilege" AD privilege shown by @harmj0y post https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/

Adam and Nate work within the Department of Defense as contractors. They have experience in many different areas such as reverse engineering, network forensics, incident response, and network security engineering for 40Gbps+ networks.

Back to Bloomcon 2017 video list

Printable version of this article

15 most recent posts on Irongeek.com:


If you would like to republish one of the articles from this site on your webpage or print journal please contact IronGeek.

Copyright 2020, IronGeek
Louisville / Kentuckiana Information Security Enthusiast