Leave Only Footprints: When Prevention Fails
Here are links and EVTX files from my SANS Blue Team Summit keynote Leave Only Footprints: When Pre 2023-6-12 05:38:0 Author: www.ericconrad.com(查看原文) 阅读量:11 收藏

Here are links and EVTX files from my SANS Blue Team Summit keynote Leave Only Footprints: When Prevention Fails.

Here are a few Powershell commands to parse the logs (also check out DeepBlueCLI):

  • Any command referencing ADMIN$:
    • Get-WinEvent @{Path="metasploit-sysmon.evtx";id=1} | Where {$_.Message -like "*ADMIN$*"} | fl
  • Any command referencing both cmd.exe and wmiprvse.exe:
    • Get-WinEvent @{Path="metasploit-sysmon.evtx";id=1} | Where {$_.Message -like "*cmd.exe*" –and $_.Message -like "*wmiprvse*"} | fl
  • Create Remote Thread (Hashdump and process migration): 
    • Get-WinEvent @{Path="metasploit-sysmon.evtx";id=8} | fl

文章来源: https://www.ericconrad.com/2023/06/leave-only-footprints-when-prevention.html
如有侵权请联系:admin#unsafe.sh