Follow the evidence.

Event ID 4625 — Failed Logon

Event ID 4625 is logged every time a Windows account fails to authenticate. A single failure is normal, but large volumes — especially against privileged accounts or from a single source IP …

Event ID 4794 — DSRM Account Password Change

Event ID 4794 is logged when the Directory Services Restore Mode (DSRM) administrator password on a domain controller is changed. DSRM is an offline recovery mode — its password is rarely ch…

Event ID 1102 — Security Audit Log Cleared

Event ID 1102 is logged when the Windows Security event log is cleared. While administrators sometimes clear logs for maintenance, this event is a strong indicator of an active attacker atte…

Event ID 4698 — Scheduled Task Created

Event ID 4698 is logged when a new scheduled task is created on a Windows system. Scheduled tasks are a common persistence mechanism used by attackers to ensure their malicious code runs aut…

Event ID 7045 — New Service Installed

Event ID 7045 is logged when a new Windows service is installed on a system. While legitimate software installs services, this event is also a reliable indicator of malware persistence — ser…

Event ID 4104 — PowerShell Script Block Logging

Event ID 4104 captures the full content of PowerShell scripts as they execute, including de-obfuscated code. When script block logging is enabled, this event is invaluable for detecting Powe…

Event ID 4740 — Account Lockout

Event ID 4740 is logged when a Windows user account is locked out after exceeding the failed logon threshold. Account lockouts confirm that a credential attack has crossed the volume thresho…

Privilege Escalation

Event ID 4672 — Special Privileges Assigned to New Logon

Event ID 4672 is logged whenever an account logs on with sensitive or special privileges such as SeDebugPrivilege, SeImpersonatePrivilege, or SeTakeOwnershipPrivilege. It fires for every pri…

Event ID 4720 — User Account Created

Event ID 4720 is logged when a new user account is created in Active Directory or on a local Windows system. While routine in normal operations, unauthorized account creation is a common att…

Event ID 4728 / 4732 — User Added to Privileged Group

Event ID 4728 is logged when a user is added to a global security group (such as Domain Admins). Event ID 4732 covers local security groups (such as the local Administrators group). Unauthor…

PowerShell Abuse — Living Off the Land

PowerShell is one of the most abused tools in modern attacks. Because it is built into every Windows system and trusted by security controls, attackers use it to download payloads, dump cred…

PowerShell Encoded Command & Obfuscation Detection — AMSI Bypass, Downgrade Attacks

Attackers obfuscate PowerShell to evade signature-based detection — encoding commands in Base64, splitting strings to break keyword matching, patching AMSI to silence antivirus, and downgrad…

PowerShell Security — Attack Detection, Logging & Investigation Hub

PowerShell is the most abused execution tool in modern Windows attacks — used for payload delivery, credential dumping, lateral movement, persistence installation, and defense evasion, all w…

Failed Logon Spike — Brute Force and Password Spray

A failed logon spike is a large volume of authentication failures in a short window — the fingerprint of a brute-force or password spray attack. Windows logs Event ID 4625 for every failed N…

Windows Authentication Attacks — Credential, Kerberos & NTLM Detection Hub

Authentication attacks are the most common initial access and lateral movement vector in Windows environments. This hub covers all credential and authentication attack techniques — from brut…

Windows Defender Disabled or Tampered

Attackers routinely disable or tamper with Windows Defender before executing their main payload — disabling real-time protection, stopping the service, or modifying registry keys that contro…

Microsoft Defender Alerts — Investigation & Response Guide

Windows Defender logs every detection, remediation action, and configuration change as Windows events. This hub covers how to investigate Defender alerts end-to-end — from the initial detect…

Lateral Movement — Spreading Across the Network

Lateral movement is how attackers spread from their initial foothold to other systems on the network — reaching domain controllers, file servers, and high-value targets. Windows logs this ac…

Impact

Ransomware Indicators — Pre-Encryption Activity

Ransomware attacks follow a predictable pattern in Windows event logs — disabling defenses, establishing persistence, spreading laterally, and then clearing logs before encrypting. Recognizi…

Privilege Escalation

Privilege Escalation — Gaining Admin and Domain Access

Privilege escalation is the step between gaining an initial foothold and gaining full control. Attackers add accounts to privileged groups (4728/4732), create new admin accounts (4720), or e…

Privilege Escalation / Persistence

WMI Persistence — Event Subscription Backdoors

Windows Management Instrumentation (WMI) event subscriptions allow code to execute automatically in response to system events — and attackers abuse this to create nearly invisible persistenc…

Credential Dumping

Credential dumping is the extraction of account credentials — password hashes, plaintext passwords, or Kerberos tickets — from a compromised system. Attackers use these credentials to move l…

LSASS Memory Credential Dumping — Detection Beyond Mimikatz

LSASS (Local Security Authority Subsystem Service) stores credential material for every active session — NTLM hashes, Kerberos tickets, and on legacy configurations plaintext passwords. Dump…

DCSync Attack Detection — Mimikatz Replication & AD Credential Dumping

A DCSync attack abuses Active Directory replication rights to impersonate a domain controller and pull password hashes for any account — including Domain Admins and krbtgt — directly over th…

DCShadow Attack Detection — Rogue Domain Controller & AD Replication Abuse

DCShadow registers a rogue Domain Controller from a compromised domain-joined machine, forces malicious changes into Active Directory via the legitimate replication protocol, then deregister…

Detect Mimikatz — LSASS Dumping, DCSync & Credential Theft Indicators

Mimikatz is the most widely used credential theft tool in post-exploitation. It can extract plaintext passwords and NTLM hashes from LSASS memory, dump the SAM and NTDS databases, perform DC…

Detect Pass-the-Hash — NTLM Lateral Movement & Suspicious Network Logons

Pass-the-Hash (PtH) is a lateral movement technique where an attacker uses a stolen NTLM password hash to authenticate as a user without knowing their plaintext password. Because NTLM authen…

Overpass-the-Hash — NTLM Hash to Kerberos TGT Conversion

Overpass-the-Hash (OPtH) — also called Pass-the-Key — converts a stolen NTLM password hash into a legitimate Kerberos Ticket Granting Ticket (TGT) by using the hash as the pre-authentication…

Living-Off-the-Land Binary Abuse (LOLBins)

Living-off-the-land (LOLBin) attacks abuse legitimate Windows binaries — certutil, bitsadmin, regsvr32, mshta, and others — to download payloads, execute code, and evade detection. Because t…

Rundll32 Abuse — LOLBin Code Execution, LSASS Dump & DLL Proxy Detection

Rundll32.exe is a signed, trusted Windows binary that executes exported functions from DLL files. Attackers abuse it to load malicious DLLs, execute JavaScript and VBScript payloads, dump LS…

Kerberos Attacks (Kerberoasting, AS-REP Roasting)

Kerberos attacks exploit the Windows authentication protocol to extract and crack service account credentials offline, or to forge authentication tickets that grant unauthorized access. The …

Detect Golden Ticket Attacks — Forged Kerberos TGT & krbtgt Hash Abuse

A Golden Ticket is a forged Kerberos Ticket Granting Ticket (TGT) created using the krbtgt account's NTLM hash. Because the krbtgt key signs all Kerberos authentication in a domain, an attac…

Detect Silver Ticket Attacks — Forged Kerberos Service Tickets

A Silver Ticket is a forged Kerberos service ticket (TGS) created using a service account's NTLM hash. Unlike a Golden Ticket (which forges a TGT and touches the KDC), a Silver Ticket is use…

Pass-the-Ticket — Stolen Kerberos Ticket Lateral Movement

Pass-the-Ticket (PtT) steals a valid Kerberos ticket from a user's LSASS memory and injects it into a different session, allowing an attacker to authenticate as that user without knowing the…

AS-REP Roasting — Kerberos Pre-Authentication Disabled Account Attack

AS-REP Roasting exploits accounts with Kerberos pre-authentication disabled. Without pre-authentication, the Domain Controller returns an AS-REP containing a portion encrypted with the accou…

Skeleton Key Attack — In-Memory LSASS Patch for Universal DC Authentication

A Skeleton Key attack patches LSASS on a domain controller in memory, inserting a secondary 'skeleton' password that works for any Active Directory account alongside the account's real passw…

Suspicious Process Creation — Abnormal Parent-Child Relationships

Event ID 4688 logs every process creation on Windows when process auditing is enabled. Attackers abuse this by launching malicious binaries from unexpected parent processes, unusual paths, o…

Privilege Escalation

UAC Bypass Detection — Privilege Escalation Without a Prompt

UAC bypass techniques allow attackers to silently elevate a process from a standard or medium-integrity context to high integrity (administrator) without triggering the User Account Control …

PsExec & Remote Execution — Lateral Movement via Admin Shares

PsExec is a Sysinternals tool that executes commands on remote systems over SMB using admin shares (ADMIN$, C$). It is widely abused by attackers for lateral movement because it requires no …

Scheduled Task Abuse — Persistence and Lateral Execution

Windows Scheduled Tasks are a primary persistence mechanism abused by malware, ransomware, and post-exploitation frameworks. Attackers create tasks that survive reboots, run under SYSTEM con…

Account Persistence — Backdoor Accounts and Unauthorized Group Changes

Attackers who gain domain admin privileges frequently create backdoor accounts or add existing accounts to privileged groups as a persistence mechanism. Even if their primary access is revok…

Malicious Service Installation — Persistence via Windows Services

Windows services run continuously in the background, start automatically at boot, and often execute under SYSTEM or LocalService context. Attackers install malicious services for persistent …

Registry Run Key Persistence — Autostart via HKCU/HKLM Run Keys

Registry Run keys are one of the oldest and most common Windows persistence mechanisms. Entries written to HKCU\Software\Microsoft\Windows\CurrentVersion\Run or the HKLM equivalent execute a…

Detecting Cobalt Strike with Sysmon

Cobalt Strike is the most widely abused commercial red-team framework in real-world attacks. It operates via a 'beacon' payload that performs process injection, C2 communication, and lateral…

Detecting Mimikatz with Sysmon

Mimikatz is the most widely used credential extraction tool in Windows environments. It reads NTLM hashes, Kerberos tickets, and WDigest plaintext passwords directly from LSASS memory. Sysmo…

Impact

Detecting Ransomware with Sysmon

Ransomware leaves a distinctive Sysmon trail across three event types: Sysmon 11 (File Create) captures the mass file encryption wave, Sysmon 1 (Process Create) shows the ransomware binary a…

Detecting Lateral Movement with Sysmon

Lateral movement is how attackers expand from one compromised host to others in the environment. Sysmon exposes lateral movement at three layers: the network connection to the target (Sysmon…