Task 4 - sophialevasseur/SEC-335 GitHub Wiki

Main Doc😱

🌲Part A: Detection🌲

🌹Sysmon Setup🌹

  1. Download Sysmon from Microsoft Website and Sysmon XML configuration file from SwiftOnSecurity on github
  2. Move the xml file to the unzipped sysmon folder.
  3. Run the following command to set up the config file
    • .\sysmon.exe -i sysmonconfig-export.xml

🌻whoami🌻

🌻ipconfig🌻

🌻tasklist🌻

🌻net user🌻

🌻certutill🌻

🌲Part B: Threat Report🌲

  1. Executive Summary - What LOLBins are, why they matter, and which threat actors use them
  2. LOLBIN Documentation - Your table from Task 1
  3. Execution Evidence - Screenshots and command documentation from Tasks 2 and 3
  4. Detection Recommendations - Event IDs, log sources, detection rules
  5. Mitigation Recommendations - Application allowlisting, logging configuration, group policy settings