Results for “windows-events”

5 skills

Implementing Siem Correlation Rules For Apt

Detect APT lateral movement by chaining Windows authentication events, process execution telemetry, and network connection logs across hosts using Splunk SPL and Sigma rule format.

24.6k · bundle

More results

Extracting Windows Event Logs Artifacts

Extract, parse, and analyze Windows Event Logs (EVTX) using Chainsaw, Hayabusa, and EvtxECmd to detect lateral movement, persistence, and privilege escalation.

24.6k · bundle

Data Manager API Event Ingestion

Upload offline conversions, enhanced conversions for leads, click conversions, and Google Analytics events using the Data Manager API /v1/events/ingest endpoint.

Hunting For Unusual Service Installations

Detect suspicious Windows service installations (MITRE ATT&CK T1543.003) by parsing System event logs for Event ID 7045, analyzing service binary paths, and identifying indicators of persistence mechanisms.

24.6k · bundle

Kiro Usage Day Report

Generates one-day Kiro credit usage reports from LanceDB usage events, with China-time windows, global totals, and account subset breakdowns.