“sysmon”的搜索结果

Investigate service account misuse by examining unexpected interactive logons, privilege changes, and movement between systems. Correlate endpoint and security logs, distinguish suspicious activity from legitimate operations, and document evidence, risk, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Investigating unexpected interactive logons by service accounts
• Checking service account access outside its assigned scope
• Tracing suspicious movement between systems after hours

Turn threat intelligence and detection gaps into testable investigation hypotheses. Use endpoint monitoring and security log queries to examine evidence, validate findings, connect related activity, and document risks and recommended actions in a consistent hunt report.

中文简介正在准备中。当前显示英语简介。

• Planning a hunt based on threat intelligence
• Investigating gaps in ATT&CK coverage
• Testing hypotheses prompted by unusual activity

Hunts for malicious WMI permanent event subscription persistence by correlating __EventFilter, CommandLineEventConsumer/ActiveScriptEventConsumer, and FilterToConsumerBinding records from Sysmon Event IDs 19/20/21 or WMI repository exports. Activates for requests to hunt WMI persistence, detect event consumer backdoors, or analyze WMI subscription telemetry.

中文简介正在准备中。当前显示原文说明。

Hunts for credential dumping by detecting LSASS process access with suspicious access masks, known dumping tool signatures, and comsvcs.exe MiniDump abuse in Sysmon Event ID 10 and process-creation telemetry. Activates for requests to hunt credential dumping, detect LSASS access, or find Mimikatz/comsvcs MiniDump activity.

中文简介正在准备中。当前显示原文说明。

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

中文简介正在准备中。当前显示原文说明。

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

中文简介正在准备中。当前显示原文说明。

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

中文简介正在准备中。当前显示原文说明。

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

中文简介正在准备中。当前显示原文说明。

Detect WMI event subscription persistence by analyzing Sysmon Event IDs 19, 20, and 21 for malicious EventFilter, EventConsumer, and FilterToConsumerBinding creation.

中文简介正在准备中。当前显示原文说明。

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows Security logs, and SIEM correlation rules

中文简介正在准备中。当前显示原文说明。

Analyzes Windows Security, System, and Sysmon event logs in Splunk to detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement using SPL queries mapped to MITRE ATT&CK techniques. Use when SOC analysts need to investigate Windows-based threats, build detection queries, or perform forensic timeline analysis of Windows endpoints and domain controllers.

中文简介正在准备中。当前显示原文说明。

Investigate attempts to gain higher privileges on Windows and Linux using endpoint and security logs. Guide hypothesis testing, evidence analysis, false-positive checks, and reporting to help assess suspicious privilege changes and the scope of a compromise.

中文简介正在准备中。当前显示英语简介。

• Hunting for signs of privilege escalation
• Investigating alerts about suspicious privilege changes
• Assessing compromise scope during incident response

Investigate stolen Kerberos tickets, authentication credentials that can be reused without a password, by correlating Windows security events. Build Splunk or Elastic detection rules for cross-host reuse, weaker encryption, and unusual request volumes, and report risk-scored findings.

中文简介正在准备中。当前显示英语简介。

• Investigating suspected reuse of stolen Kerberos tickets
• Building Splunk or Elastic detection rules
• Finding unusual ticket request volumes

Investigate Pass-the-Hash attacks, where stolen password hashes are reused for authentication. Examine unusual NTLM logins alongside credential theft indicators, validate suspicious findings across security logs, and document evidence, affected hosts, confidence, and recommended responses.

中文简介正在准备中。当前显示英语简介。

• Hunting for movement using stolen password hashes
• Triaging suspicious NTLM login alerts
• Assessing the scope of a compromise

Investigate Kerberoasting, an attack that targets service account passwords, using Active Directory authentication logs. Examine unusual service ticket requests, correlate endpoint and network evidence, and organize findings with risk levels and recommended response actions.

中文简介正在准备中。当前显示英语简介。

• Hunting for unusual service ticket requests
• Investigating suspected service account password attacks
• Validating alerts and organizing response evidence

Investigate suspicious email forwarding and hidden inbox rules that may expose messages after an account compromise. The skill guides log analysis, validation, and reporting, helping analysts document evidence, assess risk, and recommend response actions.

中文简介正在准备中。当前显示英语简介。

• Investigating external forwarding after an account compromise
• Checking rules that delete security alerts
• Hunting for rules that forward executive emails

Hunt for lateral movement, where attackers move between networked systems, using Splunk searches. Connect Windows logins with process and network activity to identify unusual host relationships, trace movement paths, and document affected accounts and systems.

中文简介正在准备中。当前显示英语简介。

• Tracing activity after credential theft
• Investigating unusual logins between hosts
• Finding new or unexpected host connections

Investigate possible insider threats by correlating endpoint and security logs. Examine unusual data access, off-hours activity, bulk downloads, and privilege abuse, then document supporting evidence, risk, confidence, and recommended actions after checking the context for false positives.

中文简介正在准备中。当前显示英语简介。

• Investigating bulk downloads before an employee leaves
• Reviewing data access outside an employee's duties
• Examining unauthorized queries by service accounts

Analyze Zeek network logs to find lateral movement, when an intruder spreads between internal computers. Examine administrative file sharing, authentication across multiple hosts, and remote service operations to identify suspicious connections and reconstruct incident timelines.

中文简介正在准备中。当前显示英语简介。

• Tracing spread to other computers after an initial compromise
• Investigating unauthorized transfers to administrative shares
• Finding one account authenticating to many internal hosts

Configure Windows security logs for threat detection and incident investigation. Covers detailed audit policies, process command line recording, log storage sizing, and centralized forwarding so monitoring systems receive useful authentication and activity records.

中文简介正在准备中。当前显示英语简介。

• Record process launches with their command lines
• Monitor successful and failed sign-ins
• Forward Windows security events to a central monitoring system

Review Windows privilege escalation paths from a standard user session to Administrator or SYSTEM. Examine service permissions, token privileges, library loading, scheduled tasks, and stored credentials, with detection indicators for defensive validation.

中文简介正在准备中。当前显示英语简介。

• Investigating privilege escalation in authorized Windows assessments
• Reviewing service and scheduled task permissions
• Checking detection coverage with attack and defense teams

Use when hunting threats or engineering detections — ATT&CK Detection-Strategies, Sigma + correlation with Detection-as-Code CI, Windows endpoint hunting (Sysmon/ETW/LSASS/LOLBins), network C2 hunting (JA4+, beaconing, DNS tunneling), cloud-identity hunting, Atomic Red Team purple-team validation

中文简介正在准备中。当前显示原文说明。

Hunts for malicious scheduled task persistence by analyzing task registration events (4698) and schtasks process creation for suspicious actions, triggers, and hidden tasks. Activates for requests to hunt scheduled task abuse, detect malicious schtasks usage, or find persistence via the Task Scheduler.

中文简介正在准备中。当前显示原文说明。

Hunts for living-off-the-land binary (LOLBin) abuse in Windows process-creation telemetry by flagging trusted system binaries used with download, execution-proxy, or encoded-command arguments. Activates for requests to hunt LOLBins, detect signed-binary proxy execution, or find suspicious certutil/mshta/regsvr32 usage.

中文简介正在准备中。当前显示原文说明。