PowerShell Security
Detecting malicious PowerShell with script block logging
Turn PowerShell logs into detections: rebuild 4104 script blocks, use AMSI and engine events, spot obfuscation and unmanaged PowerShell, tune out admin noise.
Intermediate
Guides tagged
#event-logs
Audit & Logging
Deploying and tuning Sysmon at scale
Choose a Sysmon configuration, cut noise without creating blind spots, roll out updates safely across thousands of hosts and monitor Sysmon itself.
Intermediate
Audit & Logging
Windows Event Forwarding at scale
Windows Event Forwarding that holds up: collectors, source-initiated subscriptions, XPath queries, delivery tuning, Security log access and health checks.
Intermediate
Audit & Logging
Windows security event IDs that matter
A practical reference to the Windows event IDs worth collecting and alerting on: logons, failure codes, Kerberos, account changes, persistence and tampering.
Foundation
Audit & Logging
Windows audit policy and Sysmon: a logging baseline
Configure advanced audit policy subcategories, command-line capture, log sizes, Sysmon and Windows Event Forwarding so Windows logs can answer who, what, where and when.
Foundation