Sina Mohebi

EVT-0221 MEDIUM

[2024-08-29T07:24Z] · SOC · 4 MIN READ

EventCode 4672 – Understanding Special Logon Privileges in Windows Security

In the realm of Windows security, special logon privileges play a crucial role in managing user permissions and maintaining system integrity. These privileges enable specific actions that can …

cat event-code-4672-explained-mastering-special-logon-privileges-in-windows-security.md

EVT-0207 MEDIUM

[2024-04-24T07:05Z] · SOC · 4 MIN READ

MITRE ATT&CK Top techniques & sub-techniques 2023

MITRE ATT&CK provides a framework for classifying attacker tactics, techniques, and procedures (TTPs). Each year, security researchers analyze real-world attacks to identify the most prevalent techniques and sub-techniques …

cat mitre-attck-top-techniques-sub-techniques-2023.md

EVT-0203 MEDIUM

[2023-11-09T11:44Z] · SOC · 3 MIN READ

Defending Against Mail Spoofing: Technical Solutions for Enhanced Email Security & Disabling SMTP Relaying

Introduction: In today’s digital landscape, mail spoofing poses a significant threat to individuals and organizations. It allows malicious actors to forge email headers, deceiving recipients into believing the …

cat defending-against-mail-spoofing-technical-solutions-for-enhanced-email-security-disabling-smtp-relaying.md

EVT-0200 MEDIUM

[2023-11-05T15:17Z] · SOC · 4 MIN READ

Detecting Webshells with Sysmon: A Technical Analysis

Introduction: Webshells are malicious scripts or programs that attackers deploy on web servers to gain unauthorized access and control. Detecting these webshells is crucial for maintaining the security …

cat detecting-webshells-with-sysmon-a-technical-analysis.md

EVT-0171 MEDIUM

[2023-09-02T22:23Z] · SOC · 1 MIN READ

Incident report Sample for SOC

How to Write a Comprehensive Incident Report The details to be reported at the time of a breach are : Download Sample report :

cat incident-report-sample-for-soc.md

EVT-0154 MEDIUM

[2023-08-15T16:41Z] · SOC · 3 MIN READ

How to Use MITRE ATT&CK in SOC

Using MITRE ATT&CK in a Security Operations Center (SOC) can greatly enhance threat detection and response capabilities. Here are the steps to effectively utilize MITRE ATT&CK framework in …

cat how-to-use-mitre-attck-in-soc.md

EVT-0072 MEDIUM

[2023-05-25T10:19Z] · SOC · 2 MIN READ

Mitigating Mimikatz Attacks

Mimikatz is a crucial tool for conducting internal penetration tests and red team engagements due to its ability to extract passwords from memory in clear-text. Unfortunately, even adversaries …

cat mitigating-mimikatz-attacks.md

EVT-0063 MEDIUM

[2023-05-21T16:20Z] · SOC · 4 MIN READ

RDP Event logs tracking 4624 / 4625

Event ID 4624 is generated in the Windows Security Log when a successful logon occurs on a local computer. This event is generated on the computer that was accessed, …

cat rdp-event-logs-tracking-4624-4625.md

> Sina Mohebi