Threat Detection Engineering – Page 3

Windows Security Log Quick Reference

This entry is part 20 of 28 in the series Threat Detection Engineering

Views: 17🛡️ For Cybersecurity Defensive Operations and IR/Threat Hunting 🔐 Authentication Events 🗝️ Account Management Events 📂 Object Access Events ✅ Note: Requires enabling object auditing via GPO and SACLs. 🧰 Privilege Use and Logon Types PRO Tip: Use Logon Type + Event 4624/4625 to spot RDP logins, scheduled tasks, or lateral movement attempts. ⚙️ … Read more

OpenCTI – Open Source Threat Intelligence Platform: PART I

by Bharath Narayanasamy

This entry is part 21 of 28 in the series Threat Detection Engineering

Views: 97OpenCTI (Open Cyber Threat Intelligence Platform) is a powerful open-source solution designed to help security teams collect, store, organize, and visualize threat intelligence in a structured way. Whether you’re a SOC analyst, threat hunter, or security researcher, OpenCTI provides a unified environment to centralize CTI data, correlate intelligence from multiple sources, and share it … Read more