Investigate compromised machine started from GPO immediate task which was inspired by MeteorExpress wiping incident.

When a security incident strikes, the ability to thoroughly investigate and understand “how it happened” is paramount. While Windows’…

Sysmon (System Monitor) is a powerful Windows system service and device driver that logs system activity into the Windows event log…

By default, the Wazuh Agent collects Windows and system logs. While this provides a basic level of monitoring, it does not deliver enough…

Here’s how I set up an isolated VirtualBox lab (Kali + Windows) to practice threat hunting. With Sysmon for endpoint data and Splunk for…

Sysmon, short for System Monitor, is a powerful Windows system service and driver developed by Microsoft that provides detailed monitoring…

Hi, today I will try to help you set up your own (mini) home lab, if you want to call it that. If you’re wondering who would be stupid to…

HackTheBox Sherlock: Unit42 Walkthrough

We’ve got Wazuh up and running. Enter Sysmon — a highly granular and metadata-rich Windows system tool that provides the forensic detail…

Let’s be honest — integrating Sysmon with Splunk sounds easy until you try it. Then suddenly you’re knee-deep in XML logs, forwarder…

Learn how to utilize Sysmon to monitor and log your endpoints and environments.

Lab Link: https://cyberdefenders.org/blueteam-ctf-challenges/goldenspray/

Sysmon capabilities are now natively integrated into Windows 11 and Server 2025, providing built-in security telemetry for process and network monitoring via Windows Update.

TryHackMe Sysmon Task 10: Practical Investigations Explained (With PowerShell)

Microsoft integrates native Sysmon into Windows 11 Build 26300.7733 (KB5074178). Track process creation and network links with this built-in forensic "dashcam."

Microsoft has modernized several quintessential utilities within the Sysinternals Suite, a collection frequently utilized by system administrators, support

In the previous article, we explored how Windows Event Logs provide valuable information for monitoring and investigating security events…

1. Giriş ve Laboratuvar Mimarisi

Here’s the deal: when adversaries compromise your environment, they
don’t float around in abstract network flows. They execute on actual
systems. They touch files, spawn processes, and mess with registries.

From a malicious Word document to a fully owned machine, using Sysmon logs, Timeline Explorer, Wireshark and Brim.