Blue Team

FalconHound, attack path management for blue teams

FalconFriday — Detecting ADCS web services abuse — 0xFF20

FalconFriday — Detecting UnPACing and shadowed credentials— 0xFF1E

EzETW — Got To Catch Them All

This post will present the EzETW tool and go over basic Windows events…

FalconFriday — Code execution through Microsoft SQL Server and Oracle Database — 0xFF19

FalconFriday — Stealing and detecting Azure PRT cookies — 0xFF18

FalconFriday — Detecting important data destruction by ransomware — 0xFF15

FalconFriday — AzureAD Edition— 0xFF11

After a few missed editions of FalconFriday, we are back! Today, we will cover some…