How AS-REP roasting works 🔐 #ThreatHunting #DFIR

Short interesting reading on exploiting Empire C2 framework. Credits ACE Responder aceresponder.com/blog/exploitin… #empire

How DNS Command and Control (C2) works #ThreatHunting #DFIR

How attackers escalate privileges by stealing legacy GPP passwords. #ThreatHunting #DFIR

Windows audit policies, the events they enable and the relative volume of events they generate #ThreatHunting #DFIR

How PsExec lateral movement works. #ThreatHunting #DFIR

📢A new challenge is now available on ACEResponder.com! Take on a hybrid #Entra #Azure AD compromise #ThreatHunting #DFIR aceresponder.com/challenge/intu…

Don't sleep on ACE Responder labs and courses, they are very well done and educational.

How Kerberos authentication works across domain trusts. #ThreatHunting #DFIR

How Windows access tokens work. #ThreatHunting #DFIR #Windows

How character classes work in regular expressions.

DLL hijacking techniques #ThreatHunting #DFIR

How the fork & run works. #ThreatHunting #DFIR

📢A new challenge is now available on ACEResponder.com! Investigate an incident that spans a Windows and Linux server environment. #ThreatHunting #DFIR aceresponder.com/challenge/blin…

How process hollowing works. #ThreatHunting #DFIR

How Windows security descriptors work. #ThreatHunting #DFIR #Windows #ActiveDirectory

How Component Object Model (COM) works. #ThreatHunting #DFIR #Windows #Microsoft

Periodic Table of Windows Events #ThreatHunting #DFIR #Windows