incident-response
2 posts tagged incident-response.
-
Beneath the Dashboard: What Your SIEM Actually Sees in the Windows Security Log
Advanced Audit Policy, SACLs, Windows Event Forwarding, and log anti-forensics: the native foundation every Windows SIEM assumes but few configure well.
-
Forged from 2016: How Storm-0558 Turned One Stolen Signing Key into U.S. Government Email Access
A 2016 consumer Microsoft signing key, never rotated, forged tokens that read U.S. government email for six weeks before a paying customer noticed. A technical reconstruction.