Threat Hunting

How to get started with Microsoft Sysinternals’ Sysmon Advanced Event Logging

Sysmon is a powerful tool to enhance the Windows Event Logs for threat hunting and security operations. This post covers what Sysmon is and how to write Sysmon rules for your environment.

Hunting for APT28/Hafnium NTDS.dit Domain Controller Credential Harvesting [MITRE ATT&CK T1003.003]

Threat Hunting

NTDS credential dumping [MITRE ATT&CK T1003.003] provides APT28, Hafnium, and several other attackers access to domain credentials for easy pivoting. This week’s #TechTalkTuesday explores ways to include NTDS detection techniques into your #threathunting efforts.