all 3 mindmaps (5145, 4624, 4625, 4648) can be found here https://github.com/sbousseaden/Slides/tree/master/Hunting%20MindMaps …, all created usinghttps://www.mindmup.com/
Prikaži ovu nit
Hunting for suspicious 4625/4624 is not an easy task (requires several layers of baselining), as promised here is a starting point summarized in one mindmap #threathunting #dfirpic.twitter.com/FyorRwVHhE
-
-
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Why not use machine statistical baselining over time based on past behavior and behavior of the members of the population? I have found that highly effective using the elastic stack capabilities with minimal effort.
-
What if env is already compromised (past behavior data is not clean) ?
Kraj razgovora
Novi razgovor -
-
-
What is the goal? This looks a little like something I am working on. Also, mind mapping is great for DFIR work. Thanks for the link.
-
what are you working on? goal is clear (sharing is caring)
- Još 1 odgovor
Novi razgovor -
-
-
This is a very nicely laid out map. Love the work you share
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
More like vaselining
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
-
-
Small doubt, I guess the attacker can log in as System user as well right?
Hvala. Twitter će to iskoristiti za poboljšanje vaše vremenske crte. PoništiPoništi
-
Čini se da učitavanje traje već neko vrijeme.
Twitter je možda preopterećen ili ima kratkotrajnih poteškoća u radu. Pokušajte ponovno ili potražite dodatne informacije u odjeljku Status Twittera.