PowerShell Security
Detecting malicious PowerShell with script block logging
Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
Intermediate
Guides tagged
#detection
Windows Firewall
Windows Firewall logging and monitoring that works
Turn Windows Firewall into a detection source: configure pfirewall.log, WFP audit events 5156/5157, rule-change events 4946-4950 and forward them centrally.
Foundation
Audit & Logging
Deploying and tuning Sysmon at scale
Choose a Sysmon configuration, cut noise without creating blind spots, roll out updates safely across thousands of hosts and monitor Sysmon itself.
Intermediate
Audit & Logging
Windows security event IDs that matter
A practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.
Foundation
Audit & Logging
Windows audit policy and Sysmon: a logging baseline
Configure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
Foundation