Reading Windows logon types in event 4624
Logon types, the 4624 fields that change the reading, 4625 failure codes, following a Logon ID through a session, and queries for PowerShell, wevtutil and KQL.
Tagged “Event logs”
2 posts
-
-
Detailed Guide to Detecting and Analyzing a Kerberoasting Attack in Active Directory Using Splunk
Detecting and investigating a Kerberoasting attack on Active Directory in Splunk, from the attack steps to the event 4769 fields that give it away.