The top 10 windows logs event’s used to catch hackers

Very interesting presentation by Michael Gough from SecureWorks. It goes through some malware attack examples and the importance of the windows event id’s for their detection. Another must read. The top 10 windows logs event id's used v1.0 from Michael Gough

Intrusion Detection with Windows Event ID’s

This paper is the best I have ever read on how to build IOC’s with Windows Event ID’s. I highly recommend you to read it, it contains very useful information and some very interesting behavioural examples of attacker activity. If you are looking to enhance your detection in your core network this is the document!

Malware forensics field guide for Windows Systems

All good books deserve a reference and this one is one of them. Malware forensics field guide for Windows systems.   The book is very easy to read and mainly practical. It goes from describing the general IR process to advance subjects such as memory forensics, live and dead analysis of windows systems and malware…