Cheat Sheet Sammlung

 https://www.malwarearchaeology.com/cheat-sheets


The Windows Logging Cheat Sheet

The Windows Advanced Logging Cheat Sheet

The Windows HUMIO Logging Cheat Sheet

The Windows Splunk Logging Cheat Sheet

The Windows File Auditing Logging Cheat Sheet

The Windows Registry Auditing Logging Cheat Sheet

The Windows PowerShell Logging Cheat Sheet

The Windows Sysmon Logging Cheat Sheet


MITRE ATT&CK Cheat Sheets

The Windows ATT&CK Logging Cheat Sheet

The Windows LOG-MD ATT&CK Cheat Sheet

Beliebte Posts aus diesem Blog

Shutdown / Lastlogon Analyse

Wer hat das System heruntergefahren: Get-EventLog - LogName system - Source user32 - Newest 1 | fl * Logons der letzten 7 Tage: $filter = @ {     LogName       = 'System'     ProviderName = 'Microsoft-Windows-Winlogon'     StartTime     = ( Get-Date ). AddDays ( -7 ) } $logs = Get-WinEvent - FilterHashtable $filter $res = @ () ForEach ( $log in $logs ) {     if ( $log . Id -eq 7001 ) { $type = "Logon" }     elseif ( $log . Id -eq 7002 ) { $type = "Logoff" }     else { Continue }     # Check if Properties[1] exists before accessing     if ( $log . Properties . Count -gt 1 ) {         try {             $user = ( New-Object System.Security.Principal.SecurityIdentifier $log . Properties [ 1 ]. Value ). Translate ([ System.Security.Principal.NTAccount ])         } catch { ...
Mehr anzeigen