Главная
Study mode:
on
1
Windows Event Logs? Really?
2
#1 Most Important Prereq
3
Windows Event Forwarding
4
Description of our Cuckoo Malware Lab
5
Alerting vs. Exploring
6
Continued... (Deep Panda Sample)
7
Task Scheduling (4698 OR 106)
8
Bad Logins (4776)
9
Event Tracing for Windows
10
PowerShell
11
Wireless Attacks & Misuse
12
Few More Hunting Possibilities
13
Monitor Your Monitoring
14
One-offs, Gotchas, and Recommendations
15
Recommended GPOS
16
Questions?
Description:
Explore Windows Event Logs in-depth through this 48-minute conference talk from BSides Detroit 2017. Learn about Windows Event Forwarding, setting up a Cuckoo Malware Lab, and the differences between alerting and exploring. Dive into practical examples including Deep Panda analysis, task scheduling, bad login detection, and PowerShell monitoring. Discover techniques for wireless attack detection, event tracing, and effective log monitoring strategies. Gain insights on recommended Group Policy Objects (GPOs) and valuable tips for handling one-offs and gotchas in Windows event logging.

Windows Event Logs - Zero to Hero

Add to list
0:00 / 0:00