Part 2: Investigating Windows Threats by Using Event Logs

In the rapidly evolving landscape of cybersecurity, Windows systems are frequently targeted by increasingly sophisticated threats, posing a challenge for SOC analysts in their detection and response efforts. However, Windows event logs offer a critical source of information that can be leveraged to identify security threats and conduct thorough investigations. This part of the book provides a comprehensive overview of the various types of Windows event logs, delving into the techniques employed by threat actors to compromise these systems, and equipping you with the necessary knowledge to investigate these threats using event logs effectively.

This part has the following chapters:

• Chapter 3, Introduction to Windows Event Logs
• Chapter 4, Tracking Accounts Login and Management
• Chapter 5, Investigating Suspicious Process Execution Using Windows Event Logs
• Chapter 6, Investigating PowerShell Event Logs
...