EventCode 4672 – Understanding Special Logon Privileges in Windows Security

Sina SOC

In the realm of Windows security, special logon privileges play a crucial role in managing user permissions and maintaining system integrity. These privileges enable specific actions that can significantly impact the security posture of a system. In this blog post, we will explore various special logon privileges, their descriptions, and practical examples to illustrate their…

Read more

MITRE ATT&CK Top techniques & sub-techniques 2023

Sina SOC

MITRE ATT&CK provides a framework for classifying attacker tactics, techniques, and procedures (TTPs). Each year, security researchers analyze real-world attacks to identify the most prevalent techniques and sub-techniques used by adversaries. By understanding these top techniques and sub-techniques, security professionals can prioritize their defenses and focus on the areas most likely to be targeted by…

Read more

Detecting Webshells with Sysmon: A Technical Analysis

Sina SOC

Introduction: Webshells are malicious scripts or programs that attackers deploy on web servers to gain unauthorized access and control. Detecting these webshells is crucial for maintaining the security of web applications and protecting sensitive data. In this article, we will explore how Sysmon, a powerful Windows system monitoring tool, can be utilized to detect and…

Read more

How to Use MITRE ATT&CK in SOC

Sina SOC

Using MITRE ATT&CK in a Security Operations Center (SOC) can greatly enhance threat detection and response capabilities. Here are the steps to effectively utilize MITRE ATT&CK framework in a SOC How to use MITRE ATT&CK in action Step 1 : Find what you looking for 🔎 Step 2 : Learn about it 📖 Step 3…

Read more