Windows event logs provide a fundamental source for host-based threat hunting. In this edition of #TechTalkTuesday, we explore one of the most powerful event IDs for finding popular nation-state and other hacking groups' initial access and lateral movement techniques. We also talk about how to scale hunting through event logs with Elasticsearch and Kibana.
Please like and subscribe to support our channel!
Follow us on Twitter: [ Ссылка ]
Follow us on LinkedIn: [ Ссылка ]
Hire us for your next threat hunt: [ Ссылка ]
Chapters:
00:00 - Intro
00:14 - MITRE ATT&CK T1021.001 Remote Desktop Protocol Initial Access & Lateral Movement
02:17 - Introducing Windows Security Log Event ID 4624 Successful Authentication
04:11 - Digging Into The Login Type Field
06:22 - Using Elasticsearch and Kibana to Hunt Through Windows Event Logs
08:35 - Using Python to Load Windows Event Log Data into Elasticsearch with evtxtoelk
09:32 - Brainstorming Potential Threat Hunting Starting Points with Successful Login Security Events
11:47 - Wrapping Up
