description: The following analytic detects the creation of new accounts elevated to local administrators. It uses Windows event logs, specifically EventCode 4720 (user account creation) and EventCode ...

description: The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field ...

I am a salaryman whose main job is business process improvement. On note, under the theme of "Enjoying contemplation and organizing thoughts," I will share information in a relaxed way, while digging ...