Years of log analysis taught me one thing: context beats volume. I don't hunt EventIDs anymore. I hunt attack sequences.

Full analysis: open.substack.com/pub/manishra...

#Cybersecurity #Cyberattack #Substack #ThreatHunting #DetectionEngineering #SOC #BlueTeam

My First False Positive |

I spent an hour investigating a lsass process in the APT29 dataset this week.
1,605 events. 14 EventIDs. Every search I ran came back clean.

Full Post is on LinkedIn: www.linkedin.com/posts/manish...

#Cybersecurity #Analysis #Splunk #Research #APT #SecurityAnalyst #SOC

remember this small #api about currencies exchange? lets take a break from the maritime project =) 🪙

I implemented custom logging into a text file for when the api is launched NOT in docker (⁠ ⁠ꈍ⁠ᴗ⁠ꈍ⁠) file path is specified in appsettings.json btw

#dotnet #devlog #buildinpublic #devops #aspnet

What are EventIDs?! I have just the thread for you:

twitter.com/user/status/...

Was asked about EventIDs for detecting malicious TTPs in an AD environment and remembered this gem from JP-CERT: https://www.jpcert.or.jp/english/pub/sr/20170612ac-ir_research_en.pdf

@liorbela.bsky.social
📌Intune Client-Side Troubleshooting for Windows: Event IDs IME Logs and Diagnostic Insights - www.anoopcnair.com/intune-clien...
#Intune #WindowsTroubleshooting #EventIDs #IMELogs #Diagnostics #MicrosoftIntune #HTMDCommunity

New in 0.4.0:

* Entities how have a full causal history (coming soon: cross-event causality, bloom-filtered skip-links, remediation of complex concurrencies)

* EventIds are now content-based hashes

* Each "system" now has a well defined causal root event, and metadata across restarts

SharePoint 2010's Visio Graphics Services: EventIDs 8061 & 8046 unmasked http://goo.gl/fb/QlMFr #SharePoint