Results for “logging”
8 skills
mukul975 hunting-for-anomalous-powershell-execution
Hunt for malicious PowerShell activity by analyzing Script Block Logging (Event 4104), Module Logging (Event 4103), and process creation events from Windows Event Log EVTX files to detect obfuscated commands, AMSI bypass attempts, encoded payloads, credential dumping keywords, and suspicious download cradles.
24.6k · bundle
mukul975 configuring-windows-event-logging-for-detection
Configures Windows Advanced Audit Policy, event log sizes, and Windows Event Forwarding to generate high-fidelity security events for threat detection and SIEM ingestion.
24.6k · bundle
mukul975 analyzing-powershell-script-block-logging
Parse Windows PowerShell Script Block Logs (Event ID 4104) from EVTX files to detect obfuscated commands, encoded payloads, and living-off-the-land techniques.
24.6k · bundle
More results
mukul975 analyzing-linux-audit-logs-for-intrusion
Detect intrusion attempts, unauthorized access, and privilege escalation on Linux hosts using the auditd framework with ausearch and aureport utilities.
24.6k · bundle
mukul975 analyzing-windows-event-logs-in-splunk
Detect authentication attacks, privilege escalation, persistence mechanisms, and lateral movement by analyzing Windows Security, System, and Sysmon event logs in Splunk using SPL queries mapped to MITRE ATT&CK techniques.
24.6k · bundle
mukul975 analyzing-powershell-empire-artifacts
Detect PowerShell Empire framework artifacts in Windows event logs by identifying Base64 encoded launcher patterns, default user agents, staging URL structures, stager IOCs, and known Empire module signatures in Script Block Logging events.
24.6k · bundle
mukul975 implementing-privileged-session-monitoring
Configure privileged session monitoring and recording using CyberArk PSM or open-source alternatives like Teleport, with keystroke logging, real-time alerts, and compliance audit trails.
24.6k · bundle
mukul975 configuring-suricata-for-network-monitoring
Deploys and configures Suricata IDS/IPS with Emerging Threats rulesets, EVE JSON logging, and custom rules for real-time network traffic inspection, threat detection, and integration with SIEM platforms.
24.6k · bundle