Cyberveillecurated by Decio
Nuage de tags
Mur d'images
Quotidien
Flux RSS
  • Flux RSS
  • Daily Feed
  • Weekly Feed
  • Monthly Feed
Filtres

Liens par page

  • 20 links
  • 50 links
  • 100 links

Filtres

Untagged links
3 résultats taggé event  ✕
Event Log Talks a Lot: Identifying Human-operated Ransomware through Windows Event Logs - JPCERT/CC Eyes https://blogs.jpcert.or.jp/en/2024/09/windows.html
02/10/2024 08:10:33
QRCode
archive.org
thumbnail

The difficult part of the initial response to a human-operated ransomware attack is identifying the attack vector. You may already know from recent security incident trends that the vulnerabilities of VPN devices are likely to be exploited, but it often...

jpcert EN 2024 event analysis windows-events Log human-operated Ransomware
The "EventLogCrasher" 0day For Remotely Disabling Windows Event Log, And a Free Micropatch For It https://blog.0patch.com/2024/01/the-eventlogcrasher-0day-for-remotely.html
31/01/2024 17:51:48
QRCode
archive.org
thumbnail

If you ever troubleshooted anything on Windows or investigated a suspicious event, you know that Windows store various types of events in Windows Event Log. An application crashed and you want to know more about it? Launch the Event Viewer and check the Application log. A service behaving strangely? See the System log. A user account got unexpectedly blocked? The Security log may reveal who or what blocked it.

All these events are getting stored to various logs through the Windows Event Log service. Unsurprisingly, this service's description says: "Stopping this service may compromise security and reliability of the system."

The Windows Event Log service performs many tasks. Not only is it responsible for writing events coming from various source to persistent file-based logs (residing in %SystemRoot%\System32\Winevt\Logs), it also provides structured access to these stored events through applications like Event Viewer. Furthermore, this service also performs "event forwarding" if you want your events sent to a central log repository like Splunk or Sumo Logic, an intrusion detection system or a SIEM server.

Therefore, Windows Event Log service plays an important role in many organizations' intrusion detection and forensic capabilities. And by extension, their compliance check boxes.

0patch EN 2024 EventLogCrasher Windows Event Log
Deconstructing a Cybersecurity Event https://www.dragos.com/blog/deconstructing-a-cybersecurity-event/
10/05/2023 20:55:43
QRCode
archive.org
thumbnail

Learn more about a failed extortion scheme against Dragos in May 2023. No Dragos systems were breached, including anything related to the Dragos Platform.

dragos EN 2023 lesson-learned incident event extortion
4380 links
Shaarli - The personal, minimalist, super-fast, database free, bookmarking service par la communauté Shaarli - Theme by kalvn - Curated by Decio