New answers tagged

0

Every SIEM solution produces noise when newly deployed. You need to finetune the rules that you have written to reduce false positives. @Michel de Crevoisier has shared you list of rule names to detect malicious activity. you may start working on fine tunening these rules Your SIEM rule must consider the logs with event id 4625, and for example a ...


0

Dealing with Windows failed events can be a very hard task. Firstly, you have consider 2 types of failed events in Windows: Kerberos logins (not in your scope): ID 4768, 4769, 4771 Windows logins: ID 4625, ID 4776 Considering now your event, the most meaning full events are the following: Logon Type: 3 > network event Workstation Name: Win10-Wrk > ...


Top 50 recent answers are included