Forwarded from Exploiting Crew (Pr1vAt3)
This media is not supported in your browser
VIEW IN TELEGRAM
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ๐ฐ Cost Savings: SSE vs. SASE Simplified!
๐ Organizations leveraging Palo Alto Networks experience significant ROI through unified management and simplified operationsโall within a single pane of glass.
Streamline your security strategy while accelerating growth!
Whatโs the Difference?
๐ SSE (Security Service Edge):
Focuses on securing access to apps and data for remote and on-premises users.
Core features: SWG, CASB, and ZTNA for seamless, secure connectivity.
๐ SASE (Secure Access Service Edge):
Combines networking (SD-WAN) and security services in a single cloud-delivered solution.
Perfect for securing distributed users and sites with optimal performance.
Why Choose Palo Alto Networks?
โ๏ธ Unified platform for better visibility and control.
โ๏ธ Simplified operations with scalable solutions for all use cases.
โ๏ธ Future-ready security with proven innovation.
Letโs make security smarter, faster, and simplerโtogether!
Ref: Dhari A.Dhari A.
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ Organizations leveraging Palo Alto Networks experience significant ROI through unified management and simplified operationsโall within a single pane of glass.
Streamline your security strategy while accelerating growth!
Whatโs the Difference?
๐ SSE (Security Service Edge):
Focuses on securing access to apps and data for remote and on-premises users.
Core features: SWG, CASB, and ZTNA for seamless, secure connectivity.
๐ SASE (Secure Access Service Edge):
Combines networking (SD-WAN) and security services in a single cloud-delivered solution.
Perfect for securing distributed users and sites with optimal performance.
Why Choose Palo Alto Networks?
โ๏ธ Unified platform for better visibility and control.
โ๏ธ Simplified operations with scalable solutions for all use cases.
โ๏ธ Future-ready security with proven innovation.
Letโs make security smarter, faster, and simplerโtogether!
Ref: Dhari A.Dhari A.
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ Honeypot Integration with Elastic Stack - A Practical Guide ๐ก
In this project , i have integrated Honeypot (trap for hackers) with the ELK Stack to monitor the real-time alerts and advanced threat hunting. ๐ต๏ธโโ๏ธ
๐ง Key Steps:
1๏ธโฃ Honeypot Setup: Deployed multiple honeypot services to capture malicious activity. (Requires a public IP ๐)
2๏ธโฃ ELK Stack Installation: The Elastic Stack plays a pivotal role in collecting, storing, and visualizing the data from the T-Pot honeypot. ๐
3๏ธโฃ Data Filtration & Visualization: Filtered and visualized attack data in Kibana for actionable insights. ๐๐
Note : This project can be extended to capture the IOCโs like users can add their own threat intelligence databases and can use python scripts to train the machine learning models for future use .๐For instance , a MISP instance can be setup to store the IOC's from this honeypot.
Ref: HAMZA JAMEEL
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
In this project , i have integrated Honeypot (trap for hackers) with the ELK Stack to monitor the real-time alerts and advanced threat hunting. ๐ต๏ธโโ๏ธ
๐ง Key Steps:
1๏ธโฃ Honeypot Setup: Deployed multiple honeypot services to capture malicious activity. (Requires a public IP ๐)
2๏ธโฃ ELK Stack Installation: The Elastic Stack plays a pivotal role in collecting, storing, and visualizing the data from the T-Pot honeypot. ๐
3๏ธโฃ Data Filtration & Visualization: Filtered and visualized attack data in Kibana for actionable insights. ๐๐
Note : This project can be extended to capture the IOCโs like users can add their own threat intelligence databases and can use python scripts to train the machine learning models for future use .๐For instance , a MISP instance can be setup to store the IOC's from this honeypot.
Ref: HAMZA JAMEEL
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆ ShellSweep: Detecting Web Shells Made Easy for Defenders ๐
๐ What is ShellSweep?
ShellSweep is a suite of open-source tools designed to detect web shells using entropy analysis, static code checks, and heuristic methods. From incident response to threat hunting, ShellSweep helps defenders identify suspicious files quickly and efficiently.
๐ Why Defenders Need ShellSweep
โ Test Your Coverage: Validate analytic detection for file mods, process executions, and suspicious behavior from web shells.
โ Tuning & Training: Scan web servers, analyze entropy baselines, and tune detection to YOUR environment.
โ Lightweight & Customizable: Works locally, supports PowerShell, Python, and Lua. Full control with zero dependency on external services.
๐ ShellSweep: The foundation.
- Detects web shells using entropy-based analysis.
- Scans key extensions (.asp, .aspx, .php, .jsp) for high-entropy anomalies.
- Outputs file paths, entropy values, and hashes.
๐๐ ShellSweepPlus: Enhanced detection.
- Dynamic entropy thresholds.
- Multi-layered detection: Entropy, StdDev, Mixed Mode, and Heuristics.
- Static code analysis to spot malicious patterns.
- JSON outputs for structured results & further analysis.
๐๐๐ ShellSweepX: Next-level, centralized detection.
- Combines entropy analysis, machine learning, and YARA rule matching.
- Cross-platform (PowerShell, Python, Bash).
- API integration for automated scans and result management.
- Web interface for visualizing and managing detections.
โจ Perfect for Incident Responders & Threat Hunters
๐ก Deploy ShellSweep tools in test or production environments.
๐ Load up your preferred web shells, simulate uploads, and refine detection rules.
๐ Detect new or obfuscated threats. Identify gaps. Tune your defenses.
๐งฐ ShellSweep: ShellSweeping the Evil!
Ref: Michael H.Michael H.
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ What is ShellSweep?
ShellSweep is a suite of open-source tools designed to detect web shells using entropy analysis, static code checks, and heuristic methods. From incident response to threat hunting, ShellSweep helps defenders identify suspicious files quickly and efficiently.
๐ Why Defenders Need ShellSweep
โ Test Your Coverage: Validate analytic detection for file mods, process executions, and suspicious behavior from web shells.
โ Tuning & Training: Scan web servers, analyze entropy baselines, and tune detection to YOUR environment.
โ Lightweight & Customizable: Works locally, supports PowerShell, Python, and Lua. Full control with zero dependency on external services.
๐ ShellSweep: The foundation.
- Detects web shells using entropy-based analysis.
- Scans key extensions (.asp, .aspx, .php, .jsp) for high-entropy anomalies.
- Outputs file paths, entropy values, and hashes.
๐๐ ShellSweepPlus: Enhanced detection.
- Dynamic entropy thresholds.
- Multi-layered detection: Entropy, StdDev, Mixed Mode, and Heuristics.
- Static code analysis to spot malicious patterns.
- JSON outputs for structured results & further analysis.
๐๐๐ ShellSweepX: Next-level, centralized detection.
- Combines entropy analysis, machine learning, and YARA rule matching.
- Cross-platform (PowerShell, Python, Bash).
- API integration for automated scans and result management.
- Web interface for visualizing and managing detections.
โจ Perfect for Incident Responders & Threat Hunters
๐ก Deploy ShellSweep tools in test or production environments.
๐ Load up your preferred web shells, simulate uploads, and refine detection rules.
๐ Detect new or obfuscated threats. Identify gaps. Tune your defenses.
๐งฐ ShellSweep: ShellSweeping the Evil!
Ref: Michael H.Michael H.
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
GitHub
GitHub - splunk/ShellSweep: ShellSweeping the evil.
ShellSweeping the evil. Contribute to splunk/ShellSweep development by creating an account on GitHub.
Forwarded from Exploiting Crew (Pr1vAt3)
๐ฆEncryption vs Hashing - What's the difference?
Imagine you have a secret recipe for a cake, and you want to share it with a friend.
๐คตEncryption:
You lock the recipe in a box with a key and give the box to your friend.
Your friend can unlock the box (with the key you gave them) and read the recipe.
If someone else finds the box without the key, they can't read it.
Key Point: It can be reversed if you have the key (decrypt it).
๐งHashing:
You put the recipe in a blender and blend it into a unique smoothie.
Now itโs impossible to get the original recipe back from the smoothie.
But if someone else blends the exact same recipe, theyโll get the exact same smoothie.
Key Point: One-way process. You canโt go back to the recipe, but you can check if two smoothies match.
In short:
Encryption is like locking something upโcan be unlocked.
Hashing is like turning it into mushโyou canโt un-mush it!
As both methods involve turning data into a scrambled form, one might consider these two the same. However, there is a distinction you must know about:
Data is encrypted twice while itโs only hashed once.
One can encrypt/decrypt a piece of data, meaning that the original text can be retrieved back. However, retrieval of plain text isnโt possible if data is hashed once.
Ref: Santosh Nandakumar
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Imagine you have a secret recipe for a cake, and you want to share it with a friend.
๐คตEncryption:
You lock the recipe in a box with a key and give the box to your friend.
Your friend can unlock the box (with the key you gave them) and read the recipe.
If someone else finds the box without the key, they can't read it.
Key Point: It can be reversed if you have the key (decrypt it).
๐งHashing:
You put the recipe in a blender and blend it into a unique smoothie.
Now itโs impossible to get the original recipe back from the smoothie.
But if someone else blends the exact same recipe, theyโll get the exact same smoothie.
Key Point: One-way process. You canโt go back to the recipe, but you can check if two smoothies match.
In short:
Encryption is like locking something upโcan be unlocked.
Hashing is like turning it into mushโyou canโt un-mush it!
As both methods involve turning data into a scrambled form, one might consider these two the same. However, there is a distinction you must know about:
Data is encrypted twice while itโs only hashed once.
One can encrypt/decrypt a piece of data, meaning that the original text can be retrieved back. However, retrieval of plain text isnโt possible if data is hashed once.
Ref: Santosh Nandakumar
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆCloud Pentesting Cheatsheet๐ก
Cloud penetration testing is a crucial skill to identify vulnerabilities in cloud environments like AWS, Azure, and Google Cloud Platform (GCP). This cheatsheet simplifies complex concepts and helps you take your cloud security game to the next level!
๐Whatโs Inside?
1๏ธโฃ Key Testing Steps:
โข Reconnaissance: Identify misconfigured assets, open ports, and exposed services in the cloud.
โข Enumeration: Gather details about cloud accounts, storage buckets, APIs, and permissions.
โข Exploitation: Simulate attacks by exploiting misconfigurations, weak access controls, or privilege escalation opportunities.
โข Post-Exploitation: Assess the impact by reviewing data leakage and persistence mechanisms.
2๏ธโฃ Cloud-specific Vulnerabilities:
โข Misconfigured IAM roles and policies leading to unauthorized access.
โข Publicly accessible storage buckets exposing sensitive data.
โข Weak or absent encryption protocols for data in transit or at rest.
โข Exploitable serverless functions (e.g., AWS Lambda) due to insecure coding practices.
โข Over-permissive security groups allowing unrestricted traffic.
3๏ธโฃ Essential Tools for Cloud Pentesting:
โข ScoutSuite: Multi-cloud security auditing.
โข Pacu: AWS exploitation framework for testing security.
โข Cloudsploit: Scan configurations for security issues.
โข Burp Suite: Analyze APIs in cloud applications.
โข Nmap: Detect open ports and vulnerable services in the cloud.
โข AWS CLI and GCP CLI: Enumerate configurations directly from the command line.
4๏ธโฃ Best Practices:
โข Use least privilege policies for all IAM roles and accounts.
โข Enable logging and monitoring through services like AWS CloudTrail or Azure Monitor.
โข Apply encryption standards (TLS, AES-256) to protect sensitive data.
โข Regularly perform compliance checks using CIS Benchmarks and OWASP Cloud Top 10.
โจ Key Areas to Focus On:
๐ Authentication and Authorization Flaws:
โข Check for mismanaged credentials (e.g., leaked keys or weak passwords).
โข Review SSO configurations for potential bypass scenarios.
๐ Storage Misconfigurations:
โข Detect open storage buckets or public file access.
โข Ensure data is encrypted and access is controlled through proper permissions.
๐ก Network Security Risks:
โข Audit firewall rules and security groups to detect overly permissive settings.
โข Identify exposed management ports (SSH, RDP, etc.).
๐ Serverless Security Issues:
โข Look for weak input validation and insecure API integrations in serverless applications.
โข Check timeout and resource limits to mitigate DoS risks.
Ref: Santosh Nandakumar
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Cloud penetration testing is a crucial skill to identify vulnerabilities in cloud environments like AWS, Azure, and Google Cloud Platform (GCP). This cheatsheet simplifies complex concepts and helps you take your cloud security game to the next level!
๐Whatโs Inside?
1๏ธโฃ Key Testing Steps:
โข Reconnaissance: Identify misconfigured assets, open ports, and exposed services in the cloud.
โข Enumeration: Gather details about cloud accounts, storage buckets, APIs, and permissions.
โข Exploitation: Simulate attacks by exploiting misconfigurations, weak access controls, or privilege escalation opportunities.
โข Post-Exploitation: Assess the impact by reviewing data leakage and persistence mechanisms.
2๏ธโฃ Cloud-specific Vulnerabilities:
โข Misconfigured IAM roles and policies leading to unauthorized access.
โข Publicly accessible storage buckets exposing sensitive data.
โข Weak or absent encryption protocols for data in transit or at rest.
โข Exploitable serverless functions (e.g., AWS Lambda) due to insecure coding practices.
โข Over-permissive security groups allowing unrestricted traffic.
3๏ธโฃ Essential Tools for Cloud Pentesting:
โข ScoutSuite: Multi-cloud security auditing.
โข Pacu: AWS exploitation framework for testing security.
โข Cloudsploit: Scan configurations for security issues.
โข Burp Suite: Analyze APIs in cloud applications.
โข Nmap: Detect open ports and vulnerable services in the cloud.
โข AWS CLI and GCP CLI: Enumerate configurations directly from the command line.
4๏ธโฃ Best Practices:
โข Use least privilege policies for all IAM roles and accounts.
โข Enable logging and monitoring through services like AWS CloudTrail or Azure Monitor.
โข Apply encryption standards (TLS, AES-256) to protect sensitive data.
โข Regularly perform compliance checks using CIS Benchmarks and OWASP Cloud Top 10.
โจ Key Areas to Focus On:
๐ Authentication and Authorization Flaws:
โข Check for mismanaged credentials (e.g., leaked keys or weak passwords).
โข Review SSO configurations for potential bypass scenarios.
๐ Storage Misconfigurations:
โข Detect open storage buckets or public file access.
โข Ensure data is encrypted and access is controlled through proper permissions.
๐ก Network Security Risks:
โข Audit firewall rules and security groups to detect overly permissive settings.
โข Identify exposed management ports (SSH, RDP, etc.).
๐ Serverless Security Issues:
โข Look for weak input validation and insecure API integrations in serverless applications.
โข Check timeout and resource limits to mitigate DoS risks.
Ref: Santosh Nandakumar
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ 100 Free Security Tools โ Protect Your Digital World for Free! ๐
Looking to enhance your cybersecurity skills or secure your systems without breaking the bank? Explore this comprehensive list of 100 FREE Security Tools that cover every aspect of cybersecurity, from penetration testing to network security and data protection! ๐
๐ Whatโs Included?
โ Network Security Tools
Wireshark: Analyze network packets in real-time.
Nmap: Scan networks for vulnerabilities.
โ Web Security Tools
Burp Suite Community Edition: Test web application security.
ZAP (OWASP): Identify vulnerabilities in web applications.
โ Endpoint Protection
Malwarebytes Free: Detect and remove malware effectively.
ClamAV: Open-source antivirus for Linux systems.
โ Penetration Testing Tools
Metasploit Framework: Comprehensive pen-testing platform.
SQLmap: Automate SQL injection testing.
โ Password Security
KeePass: Securely manage your passwords.
Hashcat: Advanced password recovery tool.
โ Cloud Security Tools
ScoutSuite: Assess the security of your cloud infrastructure.
CloudSploit: Detect misconfigurations in cloud environments.
โ Forensic Tools
Autopsy: Analyze digital media for forensic purposes.
FTK Imager: Quickly collect and analyze forensic data.
... and 85 more tools to strengthen your cybersecurity skills!
Ref: In pdf
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Looking to enhance your cybersecurity skills or secure your systems without breaking the bank? Explore this comprehensive list of 100 FREE Security Tools that cover every aspect of cybersecurity, from penetration testing to network security and data protection! ๐
๐ Whatโs Included?
โ Network Security Tools
Wireshark: Analyze network packets in real-time.
Nmap: Scan networks for vulnerabilities.
โ Web Security Tools
Burp Suite Community Edition: Test web application security.
ZAP (OWASP): Identify vulnerabilities in web applications.
โ Endpoint Protection
Malwarebytes Free: Detect and remove malware effectively.
ClamAV: Open-source antivirus for Linux systems.
โ Penetration Testing Tools
Metasploit Framework: Comprehensive pen-testing platform.
SQLmap: Automate SQL injection testing.
โ Password Security
KeePass: Securely manage your passwords.
Hashcat: Advanced password recovery tool.
โ Cloud Security Tools
ScoutSuite: Assess the security of your cloud infrastructure.
CloudSploit: Detect misconfigurations in cloud environments.
โ Forensic Tools
Autopsy: Analyze digital media for forensic purposes.
FTK Imager: Quickly collect and analyze forensic data.
... and 85 more tools to strengthen your cybersecurity skills!
Ref: In pdf
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ๐ก๐๐๐ฅ๐ฐ๐๐ซ๐ ๐๐ง๐๐ฅ๐ฒ๐ฌ๐ข๐ฌ ๐๐ข๐ฉ: ๐๐ฉ๐จ๐ญ๐ญ๐ข๐ง๐ ๐๐ง๐ญ๐ข-๐๐ข๐ฌ๐๐ฌ๐ฌ๐๐ฆ๐๐ฅ๐ฒ ๐๐ซ๐ข๐๐ค๐ฌ ๐ก
While analyzing malware, a common anti-disassembly technique to watch for is the use of a ๐๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง๐๐ฅ ๐ฃ๐ฎ๐ฆ๐ฉ ๐ฐ๐ข๐ญ๐ก ๐ ๐๐จ๐ง๐ฌ๐ญ๐๐ง๐ญ ๐๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง.
Take the snippet below as an example:
The code starts with ๐๐๐ ๐๐๐, ๐๐๐, which clears the ๐ฌ๐จ๐ฟ register and, as a result, sets the zero flag (๐๐ญ).
Immediately after, a conditional jump (๐๐) checks the state of the zero flag.
Since ๐๐๐ ๐๐๐, ๐๐๐ guarantees ZF will ๐๐๐๐๐๐ be set, the jump is effectively unconditional. However, to automated tools or disassemblers, it may appear as conditional, complicating static analysis.
๐ ๐พ๐๐ ๐ ๐๐๐ ๐๐๐๐ ๐๐๐๐๐๐?
Malware authors use this technique to:
โ Obfuscate control flow.
โ Confuse disassembly tools.
โ Make reverse engineering more time-consuming.
Ref: AIT ICHOU Mustapha
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
While analyzing malware, a common anti-disassembly technique to watch for is the use of a ๐๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง๐๐ฅ ๐ฃ๐ฎ๐ฆ๐ฉ ๐ฐ๐ข๐ญ๐ก ๐ ๐๐จ๐ง๐ฌ๐ญ๐๐ง๐ญ ๐๐จ๐ง๐๐ข๐ญ๐ข๐จ๐ง.
Take the snippet below as an example:
The code starts with ๐๐๐ ๐๐๐, ๐๐๐, which clears the ๐ฌ๐จ๐ฟ register and, as a result, sets the zero flag (๐๐ญ).
Immediately after, a conditional jump (๐๐) checks the state of the zero flag.
Since ๐๐๐ ๐๐๐, ๐๐๐ guarantees ZF will ๐๐๐๐๐๐ be set, the jump is effectively unconditional. However, to automated tools or disassemblers, it may appear as conditional, complicating static analysis.
๐ ๐พ๐๐ ๐ ๐๐๐ ๐๐๐๐ ๐๐๐๐๐๐?
Malware authors use this technique to:
โ Obfuscate control flow.
โ Confuse disassembly tools.
โ Make reverse engineering more time-consuming.
Ref: AIT ICHOU Mustapha
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ The Complete Shodan Guide โ A Treasure Trove for Cybersecurity Professionals! ๐๐
Thrilled to share The Complete Shodan Guide, an essential resource for anyone interested in exploring the depths of the internet using Shodan, the search engine for connected devices.
This guide is packed with:
โ Step-by-step instructions for using Shodan effectively.
โ Techniques to uncover exposed devices and vulnerabilities.
โ Practical use cases for penetration testing and threat analysis.
Ref: Dhikonda GopiDhikonda Gopi
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
Thrilled to share The Complete Shodan Guide, an essential resource for anyone interested in exploring the depths of the internet using Shodan, the search engine for connected devices.
This guide is packed with:
โ Step-by-step instructions for using Shodan effectively.
โ Techniques to uncover exposed devices and vulnerabilities.
โ Practical use cases for penetration testing and threat analysis.
Ref: Dhikonda GopiDhikonda Gopi
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
๐ฆ105 Windows Event IDs For SIEM Monitoring
1.Failed Login Attempts - Event ID: 4625
2.Account Lockouts - Event ID: 4740
3.Successful Login Outside Business Hours - Event ID: 4624
4.New User Creation - Event ID: 4720
5.Privileged Account Usage - Event ID: 4672
6.User Account Changes - Event IDs: 4722, 4723, 4724, 4725, 4726
7.Logon from Unusual Locations - Event ID: 4624 (with geolocation analysis)
8.Password Changes - Event ID: 4723 (change attempt), 4724 (successful reset)
9.Group Membership Changes - Event IDs: 4727, 4731, 4735, 4737
10.Suspicious Logon Patterns - Event ID: 4624 (anomalous logons)
11.Excessive Logon Failures - Event ID: 4625
12.Disabled Account Activity - Event ID: 4725
13.Dormant Account Usage - Event ID: 4624 (rarely used accounts)
14.Service Account Activity - Event IDs: 4624, 4672
15.RDP Access Monitoring - Event ID: 4624 (with RDP-specific filtering)
16.Lateral Movement Detection - Event ID: 4648 (network logons)
17.File and Folder Access - Event ID: 4663
18.Unauthorised File Sharing - Event IDs: 5140, 5145
19.Registry Changes - Event IDs: 4657
20.Application Installation and Removal - Event IDs: 11707, 1033
21.USB Device Usage - Event IDs: 20001, 20003 (from Device Management logs)
22.Windows Firewall Changes - Event IDs: 4946, 4947, 4950, 4951
23.Scheduled Task Creation - Event ID: 4698
24.Process Execution Monitoring - Event ID: 4688
25.System Restart or Shutdown - Event IDs: 6005, 6006, 1074
26.Event Log Clearing - Event ID: 1102
27.Malware Execution or Indicators - Event IDs: 4688, 1116 (from Windows Defender)
28.Active Directory Changes - Event IDs: 5136, 5141
29.Shadow Copy Deletion - Event ID: 524 (with VSSAdmin logs)
30.Network Configuration Changes - Event IDs: 4254, 4255, 10400
31.Execution of Suspicious Scripts - Event ID: 4688 (process creation with script interpreter)
32.Service Installation or Modification - Event ID: 4697
33.Clearing of Audit Logs - Event ID: 1102
34.Software Restriction Policy Violation - Event ID: 865
35.Excessive Account Enumeration - Event IDs: 4625, 4776
36.Attempt to Access Sensitive Files - Event ID: 4663
37.Unusual Process Injection - Event ID: 4688 (with EDR or Sysmon data)
38.Driver Installation - Event IDs: 7045 (Service Control Manager)
39.Modification of Scheduled Tasks - Event ID: 4699
40.Unauthorised GPO Changes - Event ID: 5136
41.Suspicious PowerShell Activity - Event ID: 4104 (from PowerShell logs)
42.Unusual Network Connections - Event ID: 5156 (network filtering platform)
43.Unauthorised Access to Shared Files - Event ID: 5145
44.DNS Query for Malicious Domains - Event ID: 5158 (DNS logs required)
45.LDAP Search Abuse - Event ID: 4662
46.Process Termination Monitoring - Event ID: 4689
47.Failed Attempts to Start a Service - Event ID: 7041
48.Audit Policy Changes - Event IDs: 4719, 1102
49.Time Change Monitoring - Event IDs: 4616, 520
50.BitLocker Encryption Key Changes - Event ID: 5379
Ref: Izzmier Izzuddin ZulkepliIzzmier Izzuddin Zulkepli
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ
1.Failed Login Attempts - Event ID: 4625
2.Account Lockouts - Event ID: 4740
3.Successful Login Outside Business Hours - Event ID: 4624
4.New User Creation - Event ID: 4720
5.Privileged Account Usage - Event ID: 4672
6.User Account Changes - Event IDs: 4722, 4723, 4724, 4725, 4726
7.Logon from Unusual Locations - Event ID: 4624 (with geolocation analysis)
8.Password Changes - Event ID: 4723 (change attempt), 4724 (successful reset)
9.Group Membership Changes - Event IDs: 4727, 4731, 4735, 4737
10.Suspicious Logon Patterns - Event ID: 4624 (anomalous logons)
11.Excessive Logon Failures - Event ID: 4625
12.Disabled Account Activity - Event ID: 4725
13.Dormant Account Usage - Event ID: 4624 (rarely used accounts)
14.Service Account Activity - Event IDs: 4624, 4672
15.RDP Access Monitoring - Event ID: 4624 (with RDP-specific filtering)
16.Lateral Movement Detection - Event ID: 4648 (network logons)
17.File and Folder Access - Event ID: 4663
18.Unauthorised File Sharing - Event IDs: 5140, 5145
19.Registry Changes - Event IDs: 4657
20.Application Installation and Removal - Event IDs: 11707, 1033
21.USB Device Usage - Event IDs: 20001, 20003 (from Device Management logs)
22.Windows Firewall Changes - Event IDs: 4946, 4947, 4950, 4951
23.Scheduled Task Creation - Event ID: 4698
24.Process Execution Monitoring - Event ID: 4688
25.System Restart or Shutdown - Event IDs: 6005, 6006, 1074
26.Event Log Clearing - Event ID: 1102
27.Malware Execution or Indicators - Event IDs: 4688, 1116 (from Windows Defender)
28.Active Directory Changes - Event IDs: 5136, 5141
29.Shadow Copy Deletion - Event ID: 524 (with VSSAdmin logs)
30.Network Configuration Changes - Event IDs: 4254, 4255, 10400
31.Execution of Suspicious Scripts - Event ID: 4688 (process creation with script interpreter)
32.Service Installation or Modification - Event ID: 4697
33.Clearing of Audit Logs - Event ID: 1102
34.Software Restriction Policy Violation - Event ID: 865
35.Excessive Account Enumeration - Event IDs: 4625, 4776
36.Attempt to Access Sensitive Files - Event ID: 4663
37.Unusual Process Injection - Event ID: 4688 (with EDR or Sysmon data)
38.Driver Installation - Event IDs: 7045 (Service Control Manager)
39.Modification of Scheduled Tasks - Event ID: 4699
40.Unauthorised GPO Changes - Event ID: 5136
41.Suspicious PowerShell Activity - Event ID: 4104 (from PowerShell logs)
42.Unusual Network Connections - Event ID: 5156 (network filtering platform)
43.Unauthorised Access to Shared Files - Event ID: 5145
44.DNS Query for Malicious Domains - Event ID: 5158 (DNS logs required)
45.LDAP Search Abuse - Event ID: 4662
46.Process Termination Monitoring - Event ID: 4689
47.Failed Attempts to Start a Service - Event ID: 7041
48.Audit Policy Changes - Event IDs: 4719, 1102
49.Time Change Monitoring - Event IDs: 4616, 520
50.BitLocker Encryption Key Changes - Event ID: 5379
Ref: Izzmier Izzuddin ZulkepliIzzmier Izzuddin Zulkepli
@UndercodeCommunity
โ โ โ U๐๐ปโบ๐ซฤ๐ฌ๐โ โ โ โ