Knowing what’s in your Event Logs is a key to knowing what your servers are doing. Here’s how to make sense of them. Have you taken a look in the Event Viewer lately? Are you afraid to? Does it just ...

Event 4688 documents each program a computer executes, its identifying data, and the process that started it. Several event 4688s occur on your system when you log into a system. For example, Session ...

In Event Viewer, the errors logged are common, and you will come across different errors with different Event IDs. The events that are recorded in the security logs usually will be either of the ...

Have you ever needed to look for a certain event with the Event Viewer logs? If you did, you probably went through the normal method – opening the Event Log viewer, and performing a filter on the ...

An excellent PowerShell script is easy to troubleshoot when something goes wrong. When developing scripts, it's important to not just consider "working" a symbol of success but also that you have ...

DCSync is one of the more important identity abuse techniques to understand if you run Active Directory. It does not rely on malware on the domain controller itself, and it can be carried out using ...

Incident responders and blue teams have a new tool called Chainsaw that speeds up searching through Windows event log records to identify threats. The tool is designed to assist in the first-response ...

I have heard from both commercial and government customers, “You cannot manage what you cannot see,” and this rings true. Visibility is the core requirement of situational awareness. Do you need a ...

Coaches love to talk about “the basics” – the fundamental skills their athletes need to master before they can move on to more advanced techniques. The basics can seem simple and even dull, but ...