PowerShell for Defenders: 15 Commands Every Windows Admin Should Know
Attackers love PowerShell because it is already on every Windows machine. Here are the 15 commands defenders use to see what they see: accounts, connections, persistence and logs, plus a 2-minute audit script.
Continue reading → 7 min read
Windows Event Logs: 10 Event IDs That Reveal an Intruder
Windows writes down almost everything an attacker does. Most people never read it. These are the ten Security-log event IDs that matter, what each one means, and the PowerShell to pull them in seconds.
Continue reading → 6 min read