PowerShell for Defenders: 15 Commands Every Windows Admin Should Know
Attackers love PowerShell because it is already on every Windows machine. Here are the 15 commands defenders use to see what they see: accounts, connections, persistence and logs, plus a 2-minute audit script.
Continue reading → 7 min read
Windows Event Logs: 10 Event IDs That Reveal an Intruder
Windows writes down almost everything an attacker does. Most people never read it. These are the ten Security-log event IDs that matter, what each one means, and the PowerShell to pull them in seconds.
Continue reading → 6 min read
Nmap for Network Admins: Audit Your Own Network in 10 Commands
Nmap is the tool attackers use to map a network before they strike. Run it on your own network first and you will find the forgotten printer with an open admin page before they do. Ten commands, from a basic sweep to a full inventory.
Continue reading → 5 min read