Threat Detection and Incident Response – Page 2

Threat Hunting Threat Detection and Incident Response Understanding Log Sources

Useful Windows Event IDs

Windows System Logs Event ID 1074 (System Shutdown/Restart): This event log indicates when and why the system was shut down or restarted. By monitoring these events, you can determine if there are unexpected shutdowns or restarts, potentially…

Bharath Narayanasamy threat_detection, event-ids

Threat Detection and Incident Response Intrusion Detection and Response

Code Obfuscation and Deobfuscation

Code Obfuscation is a technique used to make a script more difficult to read by humans but allows it to function the same from a technical point of view, though performance may be slower. This is…

Bharath Narayanasamy Code, dfir

Threat Detection and Incident Response Intrusion Detection and Response DFIR

Incident Response

Incident response, also known as incident handling, is a cyber security function that uses various methodologies, tools and techniques to detect and manage adversarial attacks while minimizing impact, recovery time and total operating costs. Addressing attacks…

Bharath Narayanasamy dfir, IR, Incident

SOC Analyst Threat Detection and Incident Response

MISP (Malware Information Sharing Platform)

MISP

Bharath Narayanasamy MISP

Threat Detection and Incident Response

Incident Report Template

Elements of an incident report Source: Hack The Box Incident Report Template

Bharath Narayanasamy IR, Incident_Response

SOC Analyst Threat Detection and Incident Response DETECT

Windows Event Logs

Understanding Windows Event Logs Each entry in the Windows Event Log is an "Event" and contains the following primary components: Log Name: The name of the event log (e.g., Application, System, Security, etc.). Source: The software…

Bharath Narayanasamy eventlogs, eventid

Threat Detection and Incident Response DETECT Traffic Analysis

Wireshark 101 | Packet Operations

Wireshark: Packet Operations Statistics | Summary This menu provides multiple statistics options ready to investigate to help users see the big picture in terms of the scope of the traffic, available protocols, endpoints and conversations, and…

Bharath Narayanasamy wireshark

SOC Analyst Threat Detection and Incident Response DETECT

ELASTIC SIEM: Kibana Query Language (KQL)

Different Syntax Languages Kibana supports two types of syntax languages for querying in Kibana: KQL (Kibana Query Language) and Lucene Query Syntax. Kibana Query Language (KQL) is a user-friendly query language developed by Elastic specifically for Kibana. It provides autocomplete suggestions…

Bharath Narayanasamy wazuh, kibana, KQL

Threat Hunting Threat Detection and Incident Response

Threat Detection: Detecting a Webserver Attack

LAB Setup Let's use the DIWA ( Deliberately Insecure Web Application) vulnerable created by Tim Steufmehl , to setup the victim machine. Prepare a Linux machiine with Docker installed. Follow the these instructions to install Docker on…

Bharath Narayanasamy SIEM, Elastic

SOC Analyst Threat Detection and Incident Response Intrusion Detection and Response

DFIR: Linux File System Analysis

Bharath Narayanasamy linux, incident response, detection, dfir