Windows

Enhancing Event Log Analysis with EvtxEcmd using KAPE

How much time are you spending manually parsing and sorting event logs? With EvtxECmd, digital forensics professionals can optimize Windows event log analysis through its unique mapping feature. Created by Eric Zimmerman, EvtxECmd can be called via the EZParser module in KAPE (another tool created by Eric Zimmerman) to process thousands of events in seconds and create structured CSV files that are much easier to read and manipulate.
upguard

The Windows Server Hardening Checklist

Whether you’re deploying hundreds of Windows servers into the cloud through code, or handbuilding physical servers for a small business, having a proper method to ensure a secure, reliable environment is crucial to success. Everyone knows that an out-of-the-box Windows server may not have all the necessary security measures in place to go right into production, although Microsoft has been improving the default configuration in every server version.

upguard

What is Netwalker ransomware? Attack methods & important defense tactics

Since ransomware was founded in 1996, many ransomware gangs have attempted and failed to quake the cybersecurity landscape. But some have broken through and even rearranged it with their obfuscatory cyberattack methods. Netwalker ransomware is an example of such a success. Within its first six months of operation, the ransomware gang received more than $25 million in ransom payments. What is Netwalker ransomware and why is it so lethal? To learn more, read on.

Netwrix Auditor for Windows File Servers - Overview

Netwrix Auditor for Windows File Servers maximizes visibility into what's going on across Windows file servers by classifying sensitive data and providing actionable audit data about all changes made to files, folders, shares and permissions; and reporting on both successful and failed access attempts. Today, it’s hard to imagine an enterprise that doesn’t rely on file servers to store its data — including valuable and sensitive data. This makes file servers a key target for all sorts of attackers, including both anonymous hackers and disgruntled employees.
alienvault

Windows Server 2019 OS hardening

Windows Server 2019 ships and installs with an existing level of hardening that is significantly more secure compared to previous Windows Server operating systems. Gone are the bloat of Xbox integration and services and the need for third-party security solutions to fill security gaps. Operating System (OS) hardening provides additional layers of security and preventative measures against both unauthorized changes and access.

nnt

Research Finds Almost 20% of Orgs Still Running Windows 7

Support for Microsoft's 10-year-old operating system, Windows 7, will officially end in six months, yet research shows 18% of larger enterprises still have not migrated to Windows 10. At the beginning of the year, researchers found that 43% of organizations were still running Windows 7, 17% of which had no clue when the official end of life date was for the operating system.

alienvault

Hunting for Linux library injection with Osquery

When analyzing malware and adversary activity in Windows environments, DLL injection techniques are commonly used, and there are plenty of resources on how to detect these activities. When it comes to Linux, this is less commonly seen in the wild. I recently came across a great blog from TrustedSec that describes a few techniques and tools that can be used to do library injection in Linux.