PowerShell for Defenders: 15 Commands Every Windows Admin Should Know
Attackers love PowerShell because it is already on every Windows machine. Here are the 15 commands defenders use to see what they see: accounts, connections, persistence and logs, plus a 2-minute audit script.
Continue reading → 7 min read
Windows Event Logs: 10 Event IDs That Reveal an Intruder
Windows writes down almost everything an attacker does. Most people never read it. These are the ten Security-log event IDs that matter, what each one means, and the PowerShell to pull them in seconds.
Continue reading → 6 min read
How to Check If Your Password Has Leaked Online (and What to Do in the Next 10 Minutes)
Billions of passwords are sitting in breach dumps right now. Here is how to check yours safely in under five minutes, including a PowerShell one-liner, and the exact steps to take if you find a match.
Continue reading → 5 min read