Falconfriday

FalconFriday — Detecting MMC abuse using “GrimResource” with MDE — 0xFF24

FalconFriday — Using public intelligence feeds to improve detections — 0xFF22

FalconFriday — Detecting Active Directory Data Collection — 0xFF21

Active Directory data collection

FalconFriday — Detecting ADCS web services abuse — 0xFF20

FalconFriday — Detecting LSASS dumping with debug privileges — 0xFF1F

Credential dumping from Local…

FalconFriday — Detecting UnPACing and shadowed credentials— 0xFF1E

FalconFriday — Detecting malicious modifications to Active Directory — 0xFF1D

FalconFriday — Detecting realistic AWS cloud-attacks using Azure Sentinel — 0xFF1C

FalconFriday — Suspicious named pipe events — 0xFF1B

FalconFriday —Monitoring for public shares — 0xFF1A