Tracking instances of Windows Event ID 7045 (a new service was installed) is critical for capturing new service creation, which may indicate that malicious commands or payloads are being run on the system.
QOMPLX Knowledge: Detecting ASREP Roasting Attacks
QOMPLX Knowledge is an on-going series that provides vital information and insights about critical cyber security concepts that inform our work and that information security professionals need to master.
In this post, we take a look at how QOMPLX’s technology helps customers spot patterns of behavior that may indicate malicious use of Regsvr32.
A range of administrative utilities are commonly deployed by malicious actors including whoami, ipconfig and more. In this post, we’re taking a look at how QOMPLX’s technology helps customers to spot patterns of behavior that may indicate malicious use of built-in Windows utilities.
Golden SAML attacks on ADFS figured in the SolarWinds incident. This blog post talks about how to identify and stop them.
Subscribe today to stay informed and get regular updates from QOMPLX.
