Vaishnavi Kolape·9h agoReal attack or false alarm? How I learned to triage alerts in a Splunk labA beginner’s way of thinking about security alerts, from a home lab with Splunk, Windows logs and Wireshark.
lawswin·3d agoWindows Endpoint Security Monitoring & SOC Investigation with SplunkA hands-on Windows endpoint monitoring and SOC investigation project
Benita N.·Nov 3When Login Failures Start Telling a StoryInvestigating suspicious authentication activity across 1,000 Windows security logs.
Tarif Bin Belal·Oct 26TryHackMe — Handbook for the Recently Compromised | Windows Event Log InvestigationRoom: Handbook for the Recently Compromised Platform: TryHackMe Difficulty: Easy Category: Windows Forensics / Log Analysis
ColdByte·Oct 9Hack The Box: Remote_Access_Regret — SherlockFollow how I investigated a Windows attack through PowerShell event logs, uncovering AMSI bypass, anti-forensic techniques, and more.
ColdByte·Sep 30PicoCTF: Event-ViewingOn this page, you can read how I solved the “Event-Viewing” challenge by PicoCTF. The challenge is about understanding and analysing a…
Dhanika Bulathsinhala·Sep 26Enterprise SOC Analyst — Part 1: Phishing, SIEM Detection & Windows Event InvestigationFrom phishing email analysis and IOC validation to Microsoft Sentinel detection engineering and Windows endpoint hunting
Samwel Ondima·Sep 21Windows Event LogsIn this post I will cover everything I have learned about Windows event logs. I will start by covering event logs broadly then narrow down…
Mahim Avi·Sep 18Incident response and threat hunting using hayabusa toolHayabusa is an incident response and threat detection tool by Yamato security professionals in Japan. Its leverage sigma rules and its own…
Pushkar Zend·Sep 11Demystifying Windows Event Logs: The Ultimate SOC Analyst Guide to Data StreamsIf you’ve ever tried to figure out why a server crashed, who logged into an endpoint at 3:00 AM, or how a piece of fileless malware…
