How do I disable the AppLogs agent?
Incident Response: Windows Account Management Event (Part 1) - Hacking Articles
Active Directory Domain Enumeration Part-1 With Powerview - NoRed0x
Solved Event Properties - Event 4798, Microsoft Windows | Chegg.com
Windows admin 101 – Adding a local administrator account from the command line – PwnDefend
Detecting LDAP enumeration and Bloodhound's Sharphound collector using AD Decoys | by Madhukar Raina | Securonix Tech Blog | Medium
What is NetBIOS Enumeration? - GeeksforGeeks
Samir on Twitter: "the cool thing about those 2 newly introducted MS security eventid 4799, 4798 is that they will capture any local group/user discovery attempts even if done via winapis, below
Get Local Group Members Revisited • The Lonely Administrator
4798(S) A user's local group membership was enumerated. | Microsoft Learn
What Is & How to Track a Windows Audit Failure in 2023 | Newsletter software, Software deals, Content curation
How to Check Computer Login History on Windows 10/11?
PowerView: Active Directory Enumeration - Red Team Notes
Active Directory Enumeration detected by Microsoft Security solutions | by Derk van der Woude | Medium
1104(S) The security log is now full. | Microsoft Learn
Windows Event Log Analysis - Incident Response Guide
Get Local Group Members with PowerShell • The Lonely Administrator
Get Local Group Members Revisited • The Lonely Administrator
First Steps After Compromise: Enumerating Active Directory - risk3sixty
PowerView: Active Directory Enumeration - Red Team Notes
Threat Advisory: Telegram Crypto Botnet STRT-TA01 | Splunk
Secure workstations by monitoring and alerting on membership changes in the local Administrators group, Part 2 - ManageEngine Blog
Active Directory Group Management Best Practices
BloodHound Inner Workings & Limitations – Part 1: User Rights Enumeration Through SAMR & GPOLocalGroup – Compass Security Blog
I-SECURE CO., LTD. - 🔥 สูตรวิเคราะห์ Windows Event Log สำหรับ Threat Hunter และ Incident Responder 🔥 | Facebook
Using Windows Event Log IDs for Threat Hunting - FourCore
