Detecting Webshells with Sysmon: A Technical Analysis

Introduction: Webshells are malicious scripts or programs that attackers deploy on web servers to gain unauthorized access and control. Detecting these webshells is crucial for maintaining the security of web applications and protecting sensitive data. In this article, we will explore how Sysmon, a powerful Windows system monitoring tool, can be utilized to detect and…

Read more

RDP Event logs tracking 4624 / 4625

Event ID 4624 is generated in the Windows Security Log when a successful logon occurs on a local computer. This event is generated on the computer that was accessed, meaning that it is the computer where the logon session was created. A related event, Event ID 4625, is generated when a logon attempt fails. The following information…

Read more