sina@blog:~$ grep -r "Tag: SOC" /var/log/blog
8 events matched
In the realm of Windows security, special logon privileges play a crucial role in managing user permissions and maintaining system integrity. These privileges enable specific actions that can …
cat event-code-4672-explained-mastering-special-logon-privileges-in-windows-security.mdMITRE ATT&CK provides a framework for classifying attacker tactics, techniques, and procedures (TTPs). Each year, security researchers analyze real-world attacks to identify the most prevalent techniques and sub-techniques …
cat mitre-attck-top-techniques-sub-techniques-2023.mdIntroduction: In today’s digital landscape, mail spoofing poses a significant threat to individuals and organizations. It allows malicious actors to forge email headers, deceiving recipients into believing the …
cat defending-against-mail-spoofing-technical-solutions-for-enhanced-email-security-disabling-smtp-relaying.mdIntroduction: Webshells are malicious scripts or programs that attackers deploy on web servers to gain unauthorized access and control. Detecting these webshells is crucial for maintaining the security …
cat detecting-webshells-with-sysmon-a-technical-analysis.mdHow to Write a Comprehensive Incident Report The details to be reported at the time of a breach are : Download Sample report :
cat incident-report-sample-for-soc.mdUsing MITRE ATT&CK in a Security Operations Center (SOC) can greatly enhance threat detection and response capabilities. Here are the steps to effectively utilize MITRE ATT&CK framework in …
cat how-to-use-mitre-attck-in-soc.mdMimikatz is a crucial tool for conducting internal penetration tests and red team engagements due to its ability to extract passwords from memory in clear-text. Unfortunately, even adversaries …
cat mitigating-mimikatz-attacks.mdEvent ID 4624 is generated in the Windows Security Log when a successful logon occurs on a local computer. This event is generated on the computer that was accessed, …
cat rdp-event-logs-tracking-4624-4625.md