Detecting Lateral Movement through Tracking Event Logs (Version 2) Logo

Detecting Lateral Movement through Tracking Event Logs (Version 2)

0
Free
Visit Website

This report is intended for incident investigation and explains what logs are recorded and what files are created upon execution of tools/commands that are often used in lateral movement. Updated Contents: This report is intended for incident investigation and explains what logs are recorded and what files are created upon execution of tools/commands that are often used in lateral movement. While the previous report mainly focused on investigation on event logs and registry entries, this updated report also covers other types of logs and files that are created during lateral movement. The report includes analysis results of various tools and commands that are likely used by attackers in lateral movement, and provides information on how to identify and analyze these tools and commands. The report is intended for incident responders, security analysts, and other professionals who are involved in incident response and incident investigation.

FEATURES

ALTERNATIVES

Detailed analysis of the event-stream incident and actions taken by npm Security.

AWS Community repository of custom Config rules with instructions for leveraging and developing AWS Config Rules.

Fast Intercept is a security automation platform that empowers users to maximize their existing security products and automate routine tasks.

A framework for accumulating, describing, and classifying actionable Incident Response techniques

Open source application to instantly remediate common security issues through the use of AWS Config.

CimSweep is a suite of CIM/WMI-based tools for incident response and hunting operations on Windows systems without the need to deploy an agent.

A data curation platform that automates security data collection, transformation and routing while reducing data volume and infrastructure costs.

A PHP based web application for managing postmortems with pluggable features.