🦑105 Windows Event IDs For SIEM Monitoring

1.Failed Login Attempts - Event ID: 4625
2.Account Lockouts - Event ID: 4740
3.Successful Login Outside Business Hours - Event ID: 4624
4.New User Creation - Event ID: 4720
5.Privileged Account Usage - Event ID: 4672
6.User Account Changes - Event IDs: 4722, 4723, 4724, 4725, 4726
7.Logon from Unusual Locations - Event ID: 4624 (with geolocation analysis)
8.Password Changes - Event ID: 4723 (change attempt), 4724 (successful reset)
9.Group Membership Changes - Event IDs: 4727, 4731, 4735, 4737
10.Suspicious Logon Patterns - Event ID: 4624 (anomalous logons)
11.Excessive Logon Failures - Event ID: 4625
12.Disabled Account Activity - Event ID: 4725
13.Dormant Account Usage - Event ID: 4624 (rarely used accounts)
14.Service Account Activity - Event IDs: 4624, 4672
15.RDP Access Monitoring - Event ID: 4624 (with RDP-specific filtering)
16.Lateral Movement Detection - Event ID: 4648 (network logons)
17.File and Folder Access - Event ID: 4663
18.Unauthorised File Sharing - Event IDs: 5140, 5145
19.Registry Changes - Event IDs: 4657
20.Application Installation and Removal - Event IDs: 11707, 1033
21.USB Device Usage - Event IDs: 20001, 20003 (from Device Management logs)
22.Windows Firewall Changes - Event IDs: 4946, 4947, 4950, 4951
23.Scheduled Task Creation - Event ID: 4698
24.Process Execution Monitoring - Event ID: 4688
25.System Restart or Shutdown - Event IDs: 6005, 6006, 1074
26.Event Log Clearing - Event ID: 1102
27.Malware Execution or Indicators - Event IDs: 4688, 1116 (from Windows Defender)
28.Active Directory Changes - Event IDs: 5136, 5141
29.Shadow Copy Deletion - Event ID: 524 (with VSSAdmin logs)
30.Network Configuration Changes - Event IDs: 4254, 4255, 10400
31.Execution of Suspicious Scripts - Event ID: 4688 (process creation with script interpreter)
32.Service Installation or Modification - Event ID: 4697
33.Clearing of Audit Logs - Event ID: 1102
34.Software Restriction Policy Violation - Event ID: 865
35.Excessive Account Enumeration - Event IDs: 4625, 4776
36.Attempt to Access Sensitive Files - Event ID: 4663
37.Unusual Process Injection - Event ID: 4688 (with EDR or Sysmon data)
38.Driver Installation - Event IDs: 7045 (Service Control Manager)
39.Modification of Scheduled Tasks - Event ID: 4699
40.Unauthorised GPO Changes - Event ID: 5136
41.Suspicious PowerShell Activity - Event ID: 4104 (from PowerShell logs)
42.Unusual Network Connections - Event ID: 5156 (network filtering platform)
43.Unauthorised Access to Shared Files - Event ID: 5145
44.DNS Query for Malicious Domains - Event ID: 5158 (DNS logs required)
45.LDAP Search Abuse - Event ID: 4662
46.Process Termination Monitoring - Event ID: 4689
47.Failed Attempts to Start a Service - Event ID: 7041
48.Audit Policy Changes - Event IDs: 4719, 1102
49.Time Change Monitoring - Event IDs: 4616, 520
50.BitLocker Encryption Key Changes - Event ID: 5379

Ref: Izzmier Izzuddin ZulkepliIzzmier Izzuddin Zulkepli
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑🤺 Threat modeling GenAI Workloads: Don't Skip This ⚡️

Threat modeling is one of the oldest aspects of cybersecurity, as early as 1977 some form of threat models were leveraged to understand the risks against systems.

🤔 However, threat modeling is not commonly practiced because it is manual and time-intensive. But is it worth the time, effort & resources? Hell YES. The value of threat modeling continually increases as our systems become more complex.

Yes, your GenAI workloads aren't exempted ! 🙌

🎊 GOOD NEWS -> There are abundant resources that help streamline threat modeling by automating several steps.

The Threat Composer tool from Amazon Web Services (AWS) is one of such tools.

🌩 A recent AWS blog post, provides a recommended approach for threat modeling GenAI workloads using Threat Composer. Adam Shostack's four question framework is used as a guide.

👉 Check out the blog post here - https://lnkd.in/g6i4zSpN

Here is a quick summary:

1️⃣ What are we working on?
Aims to get a detailed understanding of your business context & application architecture. Example outcomes are Data Flow Diagrams, assumptions, and key design decisions.

2️⃣ What can go wrong?
Identify possible threats to your application using the context & information gathered from the previous question. Leverage info sources e.g. OWASP Top 10 For Large Language Model Applications & Generative AI, MITRE ATLAS

3️⃣ What are we going to do about it?
Consider which controls would be appropriate to mitigate the risks associated with the threats identified in the previous question. Some info sources (per previous question) have sections for mitigations which could be super useful.

4️⃣ Did we do a good enough job?
Contrary to popular opinions, threat modeling exercises do not end after the actual activity ! Its important to verify the effectiveness of the implemented mitigations to determine if the identified risks have been addressed. Use penetration testing, adversary emulation etc to proactively evaluate the effectiveness of implemented mitigations.

Ref: Kennedy T
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Understanding HTML Injection 💉

HTML injection is a type of attack where malicious HTML code is inserted into a website. This can lead to a variety of issues, from minor website defacement to serious data breaches. Unlike other web vulnerabilities, HTML injection targets the markup language that forms the backbone of most websites.
This attack differs from other web vulnerabilities that exploit server or database weaknesses because it focuses on manipulating the structure and content of a webpage

Ref: Mehedi Hasan Babu
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑IAM vs. PAM: Understanding the Key Differences 🔒

In today’s rapidly evolving cybersecurity landscape, managing access and securing sensitive data is more critical than ever. Two foundational tools in this effort are Identity and Access Management (IAM) and Privileged Access Management (PAM). While both are essential, they serve distinct purposes:

🔑 Identity and Access Management (IAM)

🔻 Focus: Managing identities and access rights for all users.
🔻 Scope: Broader, covering employees, contractors, partners, and even devices.
🔻 Key Functions: Authentication, Single Sign-On (SSO), user provisioning/de-provisioning, governance, and compliance reporting.
🔻 Goal: Streamlining access across the IT ecosystem while improving operational efficiency and ensuring compliance.

🔒 Privileged Access Management (PAM)

🔻 Focus: Securing and controlling access to privileged accounts with elevated permissions.
🔻 Scope: Narrower, targeting administrators, IT staff, service accounts, and third-party vendors.
🔻 Key Functions: Credential vaulting, session monitoring, least privilege enforcement, and just-in-time access.
🔻 Goal: Protecting critical systems and sensitive data from breaches or abuse of high-risk accounts.

Implementing both IAM and PAM creates a layered security approach. IAM ensures proper access for all users, while PAM locks down high-risk areas, minimizing vulnerabilities and adhering to the Zero Trust framework.

📊 This visual summary (attached) simplifies the key differences and highlights how these tools work together to strengthen cybersecurity.

Ref: Fadi Kazdar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Understanding Modern Cybersecurity Tools: EDR, XDR, SOAR, SIEM, and Integrated Solutions 🚨

Navigating the world of cybersecurity solutions can be complex. Each tool serves a unique purpose, but understanding their differences is crucial for building an effective security strategy. Here's a quick comparison:

✅ EDR (Endpoint Detection and Response): Focuses on endpoint security by detecting/responding to threats on devices like laptops and servers. Great for organizations with endpoint-centric threats.

✅ XDR (Extended Detection and Response): Expands visibility across endpoints, networks, and cloud environments, providing unified threat detection across domains.

✅ SOAR (Security Orchestration, Automation, and Response): Automates and streamlines incident response processes, saving time and improving efficiency.

✅ SIEM (Security Information and Event Management): Offers centralized log management and real-time monitoring for identifying and correlating security events.

✅ Integrated Solution (EDR + XDR + SOAR + SIEM): Combines the strengths of all these tools for holistic threat detection, response, and seamless integration.

Ref: Fadi Kazdar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑𝐃𝐎𝐌 𝐗𝐒𝐒 Testing Method

While "DOM Invader" is not a new feature of Burp, I feel that alot of people don't use it enough (or are not aware of it)

It works by submiting a random string generated by Burp (named "canary") in existing input fields or URL parameters

Then "DOM Invader" will check how your input is processed, providing you with necessary context and sanitization details.

1. Start Burp Browser
2. Turn on the DOM Invader
3. Copy and Paste the canary in the target input field or URL parameter
4. Check the DOM Invader tab for "Interesting sinks"
5. Craft the payload or use the "Exploit" option to automate

Ref: Andrei Agape
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Malwares Detection bypass:

𝑴𝒊𝒔𝒖𝒔𝒊𝒏𝒈 𝑺𝒕𝒓𝒖𝒄𝒕𝒖𝒓𝒆𝒅 𝑬𝒙𝒄𝒆𝒑𝒕𝒊𝒐𝒏 𝑯𝒂𝒏𝒅𝒍𝒆𝒓𝒔 💡

In malware analysis, one common anti-disassembly technique is 𝐒𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞𝐝 𝐄𝐱𝐜𝐞𝐩𝐭𝐢𝐨𝐧 𝐇𝐚𝐧𝐝𝐥𝐢𝐧𝐠 (𝐒𝐄𝐇) manipulation.

SEH is a mechanism in Windows for managing exceptions, but it can also be exploited to confuse disassemblers and debuggers. By injecting fake exception records into the SEH chain, attackers can redirect program flow, making it difficult for static analysis tools to follow the actual execution path. This redirection not only complicates reverse engineering but also disrupts debugging processes, forcing tools to misinterpret or skip over key code sections.

Ref: Ait Ichou Mustapha
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑2025 𝐅𝐑𝐄𝐄 𝐁𝐋𝐔𝐄 𝐓𝐄𝐀𝐌 𝐂𝐘𝐁𝐄𝐑 𝐒𝐄𝐂𝐔𝐑𝐈𝐓𝐘 𝐓𝐑𝐀𝐈𝐍𝐈𝐍𝐆 (New Urls):

🔗 HackerSploit Training Course -Part 1- (YouTube):
https://lnkd.in/eH3UYgp5

🔗 HackerSploit Training Course -Part 2- (Linode Live):
https://lnkd.in/ebEGVdGY

🔗 Network Defense/Digital Forensics (EC-Council):
https://lnkd.in/ewiVUkYt

🔗 Introduction to Cyber Security -with Case Study: WhatsApp Attack- (Great Learning):
https://lnkd.in/eUdRn8Km

🔗 Digital Forensics (Infosec Train):
https://lnkd.in/eR58kTPJ

🔗 Introduction Courses (Security Blue Team):
https://lnkd.in/efuAKp4h

🔗 Introduction to Cyber Security/Cloud Security/CISSP (Simplilearn):
https://lnkd.in/ey5TPBdr

🔗 Network Security NSE1/NSE2/NSE3 (Fortinet NETWORK SECURITY):
https://lnkd.in/ehV9aUm7

🔗 SOC Analyst (Splunk):
https://lnkd.in/esq4zFTg

🔗 Proactive Security Operations Center (Picus Security Academy):
https://lnkd.in/eYA26eN5

🔗 Certified in Cybersecurity℠ - CC (ISC2):
https://lnkd.in/eq2E2ci8

🔗 Cyber Aces (SANS Institute):
https://lnkd.in/eNCPrtdd

🔗 Introduction to IT and Cybersecurity (Cybrary):
https://lnkd.in/emAES4i7

🔗 SOC Analyst Pathway: LetsDefend https://letsdefend.io/

🔗 Computer Systems Security (Massachusetts Institute of Technology):
https://lnkd.in/eUDQeT3v

Ref: Adnan AlamAdnan Alam
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑AI Agents: The Security Approach 🔐

AI agents are changing the game, helping us solve problems and innovate faster than ever. But with all this power comes many questions, some of them: How do we keep them safe? What should be the security considerations for each layer of this future AI framework?

*️⃣ Input Layer

> Security Risk: Data poisoning and adversarial attacks could corrupt input data or manipulate real-time feedback loops.

> Tip: Implement data validation pipelines to sanitize incoming data.
Use secure APIs for real-time inputs and Continuously monitor for anomalies in user feedback patterns.

*️⃣ Agent Orchestration Layer

> Security Risk: Inter-agent communication could be exploited for unauthorized data sharing or infiltration.

> Tip: Use end-to-end encryption for inter-agent communication. Employ RBAC to ensure agents only perform tasks for which they’re authorized and Monitor orchestration processes for unexpected task allocation behaviors.

*️⃣ AI Agents Layer

> Security Risk: Malicious actors could exploit self-learning loops to insert harmful behaviors or compromise models.

> Tip: Regularly test models with adversarial simulation frameworks to identify vulnerabilities. Log and review planning, reflection, and tool usage steps to detect anomalies and secure model updates to prevent injection attacks during retraining.

*️⃣ Retrieval Layer

> Security Risk: Vector stores and knowledge graphs are high-value targets for attackers seeking to steal or manipulate critical information.

> Tip: Encrypt data at rest and in transit using robust protocols like AES-256. Apply zero-trust principles to storage access—verify every request. Maintain immutable logs to track data access and modifications.

*️⃣ Output Layer

> Security Risk: Unauthorized enrichment or synthetic data generation could leak sensitive information or introduce malicious payloads.

> Tip: Use watermarking and audit trails for enriched outputs. Apply strict controls to ensure customizable outputs don’t expose sensitive data and
Integrate DLP policies into output workflows.

*️⃣ Service Layer

> Security Risk: Automated insight generation and multi-channel delivery could introduce phishing or unauthorized data dissemination risks.

> Tip: Implement AI-generated output verification to prevent spoofing or misinformation. Regularly audit multi-channel delivery systems for misconfigured endpoints. Enforce secure delivery protocols to safeguard automated insights.

💡 Foundational Security Principles

> Ethics & Responsible AI: Regularly assess models for biases that attackers could exploit.
> Compliance: Align with frameworks like GDPR, CCPA, and AI-specific laws.
> Human-AI Collaboration: Build explainability into every decision to reduce the "black box" effect.

Ref: Elli Shlomo (IR)Elli Shlomo (IR)
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 The Data Privacy Checklist: 7 Must-Have Practices for Every Organization

Protecting data is no longer optional, it's a necessity. Whether you're a startup or a global enterprise, safeguarding sensitive information must be at the core of your operations. Here are 7 essential data privacy practices that every organization should implement:

🔒 Data Encryption: Encrypt sensitive data at rest and in transit to shield it from unauthorized access.

🔄 Regular Software Updates: Keep systems up to date to eliminate vulnerabilities.

🔑 Strong Authentication: Implement multi-factor authentication (MFA) for robust security.

👩‍🏫 Employee Training: Educate your team on phishing, social engineering, and data protection protocols.

💾 Backup and Recovery: Regularly back up data and establish a recovery plan for emergencies.

🤝 Third-Party Risk Management: Vet vendors to ensure their practices align with your standards.

⚡️ Incident Response Plan: Be ready to manage and mitigate breaches swiftly.

🌟 By integrating these practices into your cybersecurity strategy, you can reduce risks and ensure compliance with data protection standards.

Ref: Fadi Kazdar
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑 How to Hunt LFI Using Google Dorks - PoC 🚨

Welcome to another exciting episode on HackWithRohit! 🚀
In this video, we’ll dive deep into:
🔍 Local File Inclusion (LFI) vulnerabilities and how they can expose sensitive files on web servers.
💡 Leveraging Google Dorks as a powerful tool to uncover vulnerable endpoints.
🛠 A step-by-step demonstration of identifying and exploiting LFI in real-world scenarios.
🛡 Disclaimer:
This video is strictly for educational purposes only. Always ensure you have permission to test and follow ethical hacking guidelines. Unauthorized testing or exploitation is illegal and against the principles of ethical hacking.
💬 Discussion Time:
Have you encountered LFI during your bug hunting journey?
Share your tips and tricks in the comments!
📌 Don’t forget to like, comment, and subscribe to stay updated on the latest bug bounty techniques and tools.

Ref: ROHITH SROHITH S
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Mastering Active Directory Enumeration with BloodHound 🔍💻

Just explored the "BloodHound Active Directory Enumeration Tool"—an essential resource for both offensive and defensive security professionals. This guide simplifies the process of visualizing and understanding Active Directory attack paths and security gaps, helping organizations stay secure.

Highlights from the guide:
✔️ Step-by-step installation for Linux and Windows
✔️ Techniques to extract and analyze domain data
✔️ Pre-built queries to identify vulnerabilities like AS-REP roasting, Kerberoasting, and DC Sync attacks
✔️ Utilizing SharpHound and PowerShell for efficient data collection
✔️ Practical advice for Red and Blue Teams alike

Whether you're on the offensive or working to harden your network's defenses, BloodHound is a game-changer for Active Directory enumeration and analysis.

Ref: in pdf
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Recommended courses:

Google Data Analytics
👉 https://lnkd.in/gv4whkFn

Advanced Google Analytics
👉 https://lnkd.in/gnswTs7t

Google Project Management
👉 https://lnkd.in/geUMD3K9

Foundations of Project Management
👉 https://lnkd.in/gJCjD6us

1. IBM Project Manager
🔗https://lnkd.in/gTaaHHPQ

3. IBM Data Analyst
🔗https://lnkd.in/gMingmB2

4. IBM Data Analytics with Excel and R
🔗https://lnkd.in/gejqD9ry

5. IBM Data Science
🔗https://lnkd.in/guyY26Ye

6. IBM Data Engineering
🔗https://lnkd.in/geFjWDCj

7. IBM AI Engineering
🔗https://lnkd.in/gQpHeu7e

3-Learn SQL Basics for Data Science:
🌀https://lnkd.in/gKcT3SdP

4-Excel for Business :
🌀https://lnkd.in/geHAfHAK

5-Python for Everybody :
🌀https://lnkd.in/gUga4caw

6-Data Analysis Visualization Foundations :
🌀https://lnkd.in/geWz5T-v

7-Machine Learning Specialization:
🌀https://lnkd.in/gCZqk6-J

8-Introduction to Data Science:
🌀https://lnkd.in/gK_C8XKy

1. Microsoft Azure Data Scientist Associate
👉 https://lnkd.in/gaX-nhS3

2. Microsoft Cybersecurity Analyst Professional
👉 https://lnkd.in/g_WYd7iw

3. Microsoft Power BI Data Analyst Professional
👉 https://lnkd.in/gi2FQkf7

4. Microsoft Azure Data Engineering Associate (DP-203) Professional
👉 https://lnkd.in/ggUAK2zx

5. Microsoft Azure Developer Associate (AZ-204) Professional
👉 https://lnkd.in/gF99Jh_s

6. Microsoft Azure Security Engineer Associate (AZ-500) Professional
👉 https://lnkd.in/gqgBVvUc

Ref: Vikas Singh
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑ChatGPT Prompts That Will Change Your Life Before 2025

1. Use the 80/20 principle to learn faster
Prompt: "I want to learn about [insert topic]. Identify and share the most important 20% of learnings from this topic that will help me understand 80% of it."

2. Learn and develop any new skill
Prompt: "I want to learn / get better at [insert desired skill]. I am a complete beginner. Create a 30-day learning plan that will help a beginner like me learn and improve this skill."

3. Summarize long documents and articles
Prompt: "Summarize the text below and give me a list of bullet points with key insights and the most important facts." [Insert text]

4. Train ChatGPT to generate prompts for you
Prompt: "You are an AI designed to help [insert profession]. Generate a list of the 10 best prompts for yourself. The prompts should be about [insert topic]."

5. Master any new skill
Prompt: "I have 3 free days a week and 2 months. Design a crash study plan to master [insert desired skill]."

6. Simplify complex information
Prompt: "Break down [insert topic] into smaller, easier-to-understand parts. Use analogies and real-life examples to simplify the concept and make it more relatable."

Save this now to unlock the power of ChatGPT before 2025

👉 Courses From Google

📕 7000+ Course Free Access: https://lnkd.in/dzCcMS7n

Google Data Analytics
👉 https://lnkd.in/gv4whkFn

Advanced Google Analytics
👉 https://lnkd.in/gnswTs7t

Google AI Essentials j
👉 https://lnkd.in/gKyDHMhe

Ref: Khushboo
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁