User Account Management User account management events track changes to user accounts in Active Directory (AD) or local systems, such as creation, modification, enabling/disabling, password change...
Microsoft Event Log Analysis: Key Auditing Categories 1. Object Access Auditing Object Access events track when a user or process attempts to access securable objects on the system, such as files...
Key Event IDs for Logon and Logoff Analysis Event IDs are the primary way to identify logon success, failure, or logoff. Here’s a summary table of the most relevant ones: ...
Email Flow Mail User Agent (MUA): computer application that allows you to send and retrieve email (Outlook, FireFox). Mail Submission Agent (MSA): the server that receive the message from the...
Phishing attacks are a common form of cyber threat where attackers impersonate trusted entities to trick victims into revealing sensitive information, such as login credentials, financial details, ...
When investigating a suspicious domain or IP address to determine if it’s malicious—particularly in the context of a potential C2 server—proxy logs are a primary source of evidence. C2 servers are ...
analyzing PCAP file using wireshark.