🔏
RootGuard
HomeSOC OperationsIncident ResponseWindows ForensicsLinux ForensicsKQL Investigations
  • Welcome
    • RootGuard
      • Who Am I?
        • Professional Profile
  • Resources Hub
    • Blogs
      • Articles
        • Safeguarding SMEs: The Strategic Importance of a Security Operations Center (SOC)
      • Posts
        • Roadmap to Becoming a Cybersecurity Specialist
        • Starting a Career in Cybersecurity
        • A Guide to Landing Your First Cybersecurity Analyst Role
        • Moving from Intermediate to Expert Incident Responder
  • SOC Operations
    • Introduction
      • Development Resources
        • SOC Analysts Roadmap
        • Becoming A SOC Analyst
        • SOC Analysts Prep Interview Questions
    • Essential Skills
      • Critical Windows EventIDs to Monitor
    • Junior Analyst Skills
      • Splunk Use Cases
      • KQL Use Cases
        • Reconnaissance (TA0043)
        • Initial Access (TA0001)
        • Execution (TA0002)
        • Persistence (TA0003)
        • Privilege Escalation (TA0004)
        • Defence Evasion (TA0005)
        • Credential Access (TA0006)
        • Discovery (TA0007)
        • Lateral Movement (TA0008)
        • Collection (TA0009)
        • Command and Control (TA0011)
        • Exfiltration (TA0010)
        • Impact (TA0040)
      • Investigating Common Attacks
        • Domain Dominance Attacks - Detection & Analysis
        • Investigating a Suspected AD FS Distributed Key Management (DKM) Attack
        • Authentication From Suspicious DeviceName
        • Identifying Interactive or RemoteInteractive Session From Service Account
        • Identifying Split or Part Archive File Transfers
        • Detect Potential Cleartext Credentials in Command Line
        • Detecting Command Line Interpreters Launched via Scheduled Tasks
        • Detecting Files Containing Potentially Sensitive Data
        • Detecting DeviceNetworkEvents From Windows Processes and Domains by TLD
        • Detecting Silent cmd.exe Execution With Redirected STDERR & STDOUT
        • Detecting Low Prevalence DLL Loaded From Process In User Downloads Directory
        • Detecting Virtual Drive Mounted From Archive
        • Identify Execution of Script From User's Downloads Folder
        • Identify Potential RDP Tunneled Sessions
        • Identify Instances of PowerShell Invoke-WebRequest, IWR or Net.WebClient
        • Identify Processes Launched by PowerShell Remoting (WSMProvHost.exe)
        • Detect DeviceNetworkEvents for LOLBAS with Download or Upload Functions
        • Detect Execution of PSEXESVC via Remote Systems
        • Identify Suspicious String in Service Creation ImagePath
        • Identify File with Double Extensions
        • Detect Potential Cleartext Credentials in Commandline
        • Detect When Large Number of Files Downloaded From OneDrive or SharePoint
        • Identify and Investigate Phishing Attacks with KQL
      • PowerShell for SecOps
        • Powershell Remoting
        • Reconnaissance Discovery
        • Initial Access Discovery
        • Execution Discovery
        • Persistence Discovery
        • Privilege Escalation Discovery
        • Defence Evasion Discovery
        • Credential Access Discovery
        • Discovery
        • Lateral Movement Discovery
        • Collection Discovery
        • Command & Control (C2) Discovery
        • Exfiltration Discovery
        • Impact Discovery
      • Packet Analysis (pcap)
        • Tcpdump
        • Tcpdump (Intermediate)
        • Tshark
        • Ngrep
      • Investigating Suspicious Emails Using KQL
    • Intermediate and Advanced Skills
      • Investigate Using MITRE ATT&CK Methodology
        • Reconnaissance (TA0043) Techniques
        • Resource Development (TA0042) Techniques
        • Initial Access (TA0001) Techniques
        • Command Execution (TA0002) Techniques
        • Persistence (TA0003) Techniques
        • Privilege Escalation (TA0004) Techniques
        • Defence Evasion (TA0005) Techniques
        • Credential Access (TA0006) Techniques
        • Discovery (TA0007) Techniques
        • Lateral Movement (TA0008) Techniques
        • Collection (TA0009) Techniques
        • Command and Control (C2) (TA0011) Techniques
        • Exfiltration (TA0010) Techniques
        • Impact (TA0040) Techniques
    • Vulnerability Management
    • Malware Analysis
  • DFIR
    • Incident Response
      • Incident Triage
        • Triage Types and Processes
        • PowerShell for Detection and Analysis
          • Malware or Compromise Investigation
          • Lateral Movement Discovery
        • Registry Analysis
        • Sysinternals Intrusion Analysis
        • PowerShell Intrusion Analysis
        • Velociraptor Intrusion Analysis
        • Zimmerman Tools Intrusion Analysis
      • KAPE Artifacts Analysis
      • Velociraptor Artifacts Analysis
      • Using The Unified Kill Chain Model to Analyse Individual Cyber Attacks
        • Phase 1 - Gaining an Initial Foothold
          • Gaining Access to the Network
          • Establishing a Foothold
          • Network Discovery
      • Response Strategies
        • Privilege Escalation Assessment
        • Command and Control Assessment
        • Command Execution Assessment
        • Defence Evasion Assessment
        • Detection Assessment
        • Discovery Assessment
        • Exfiltration Assessment
        • Initial Access Assessment
        • Initial Impact Assessment Techniques
        • Lateral Movement Assessment
        • Persistence Assessment
    • Windows Forensics
      • Evidence of Execution
      • Window Artifact Analysis
        • Account Usage
        • User Activity Tracking (Event Logs)
        • Program Execution
        • File and Folder Opening
        • File Download
        • Browser Usage
        • Deleted File or File Knowledge
        • External Device & USB Usage
    • Linux Forensics
      • Linux Commandline Basics
      • Host Compromise Assessment
    • KQL for Defender & Sentinel
      • MDO (Office)
      • MDI (Identity)
      • MDE (Endpoint)
    • Memory Forensics
      • Memory Forensics (Volatility 3)
    • Playbooks
      • First Responder DFIR Playbook
        • Device Isolation
        • Evidence Collection
          • Acquire Triage Image Using KAPE
          • Acquire Triage Data Using Velociraptor
          • Acquire Triage Data Using Powershell
          • Acquire Triage Memory Image
          • Acquire Image Using FTK
          • AXIOM Cyber Data Collection
        • Windows Forensic Artefacts
          • Application Execution
          • File & Folder Knowledge
          • External Device Usage
          • Network Activity
          • Windows Event Logs
        • Initial Analysis
          • Memory Analysis (Vol 3)
          • Axiom Cyber Examiner
  • Detection Engineering
    • AD Attack Detections & Mitigations
      • Kerberoasting
      • Authentication Server Response (AS-REP) Roasting
      • Password Spraying
      • MachineAccountQuota Compromise
      • Unconstrained Delegation
      • Password in Group Policy Preferences (GPP) Compromise
      • Active Directory Certificate Services (AD CS) Compromise
      • Golden Certificate
      • DCSync
      • Dumping ntds.dit
      • Golden Ticket
      • Silver Ticket
      • Golden Security Assertion Markup Language (SAML)
      • Microsoft Entra Connect Compromise
      • One-way Domain Trust Bypass
      • Security Identifier (SID) History Compromise
      • Skeleton Key
      • Active Directory Security Controls
      • Active Directory Events for Detecting Compromise
    • Attack Triage Playbooks (KQL Triage)
      • Windows Malware Detection Playbook
      • Linux Host Intrusion Detection Playbook (CLI)
      • Linux Intrusion Detection Playbook
      • Large-Scale Compromise Detection Playbook
      • Ransomware Detection Playbook
      • Phishing Email Compromise Detection Playbook
      • Scam Detection Playbook
      • Customer Phishing Detection Playbook
      • Insider Abuse Detection Playbook
      • Information Leakage Detection Playbook
      • Social Engineering Detection Playbook
      • Malicious Network Behaviour Detection Playbook
      • Windows Intrusion Detection Playbook
      • Vulnerability Detection Playbook
      • Business Email Compromise Detection Playbook
    • Process Execution (KQL Triage)
    • Threat Hunting
      • Hunting Ransomware Indicators
      • Hunting With KQL
        • Detecting Malware Infection (MITRE ATT&CK: T1566, T1059)
        • Discovery Activities (MITRE ATT&CK: T1016, T1083, T1046)
        • Credential Theft (MITRE ATT&CK: T1003, T1078)
        • Lateral Movement (MITRE ATT&CK: T1076, T1021)
        • Data Theft (MITRE ATT&CK: T1041, T1071)
        • Detecting CommandLine Executions (MITRE ATT&CK: T1059)
        • Windows Security Logs (Identity and Logon Activities)
      • Hunting With Splunk
Powered by GitBook