Advanced Log Analysis
Key Windows Event IDs for Cybersecurity MonitoringAnalyzing a Series of Failed Login Attempts from Multiple IP AddressesSteps to Investigate Suspicious Outbound Network TrafficIdentifying and Responding to Lateral Movement within a NetworkDistinguishing Between Legitimate and Malicious PowerShell ExecutionsDetecting and Analyzing a Potential Data Exfiltration Incident Using Log DataSteps to Analyze PowerShell Logging (Event ID 4104) for Malicious ActivityHow to Identify an Internal Pivot Attack Using Log DataIndicators in Logs Suggesting a Privilege Escalation AttackHow to Detect Command and Control (C2) Communication Using Log AnalysisHow to Analyze Logs to Detect a Brute-Force Attack on an RDP ServiceHow to Analyze Logs to Detect a Brute-Force Attack on an RDP ServiceHow to Detect the Use of Living-Off-the-Land Binaries (LOLBins) in LogsHow to Detect Malware Masquerading as a Legitimate Process Using Log AnalysisHow to Detect and Analyze Lateral Movement Using Windows Event LogsHow to Detect Potential Ransomware Attacks in Their Early Stages Using Log AnalysisHow to Detect and Analyze Privilege Escalation Using Windows Event LogsHow to Detect the Use of Mimikatz or Similar Tools in Log DataHow to Detect and Analyze DNS Tunneling Through Log AnalysisHow to Detect a Pass-the-Hash (PtH) Attack Using LogsHow to Detect and Analyze an Attacker’s Use of a Remote Access Trojan (RAT) Using Log DataHow to Detect Lateral Movement Using Windows Event LogsHow to Detect and Investigate Data Exfiltration Using LogsHow to Identify and Analyze an Internal Phishing Campaign Using Email and System LogsHow to Detect and Analyze Ransomware Activity Using LogsHow to Detect Malicious PowerShell Activity Using Log AnalysisHow to Detect and Respond to Brute-Force Attacks Using Log DataHow to Detect Privilege Escalation Attempts Using Windows Event LogsHow to Detect and Analyze Suspicious Domain Name Resolution Requests in DNS LogsHow to Detect and Respond to Unauthorized Access to Critical FilesHow to Detect and Analyze Suspicious PowerShell Command ExecutionHow to Detect and Investigate Account Takeover (ATO) Attempts UsingHow to Detect and Analyze the Use of Living Off the Land Binaries (LOLBins)How to Detect and Investigate Lateral MovementHow to Detect and Investigate Data ExfiltrationHow to Detect and Analyze Suspicious Activity Involving Service AccountsHow to Detect and Investigate Anomalous PowerShell Activity Related to Credential DumpingHow to Detect and Analyze the Execution of Unsigned or Malicious ExecutablesHow to Detect and Investigate Abnormal Spikes in Network Traffic
Last updated