Detecting Unauthorized Behavior From Legitimate Accounts

Incident Responders face an almost insurmountable amount of log events, and the move to the Cloud has only intensified this dependency on log data for intrusion analysis.Attackers are shifting techniques to utilize compromised accounts to hide their activity among the volume of legitimate business...

By

Rodney Caudle

June 22, 2022

All papers are copyrighted. No re-posting of papers is permitted

Related Content

Digital Forensics, Incident Response & Threat Hunting

November 26, 2023

Linux Incident Response - A Guide to syslog-ng

Syslog-ng stands as a sophisticated evolution of the syslog protocol, designed to offer advanced logging capabilities within Linux systems.

Tarot (Taz) Wake

Digital Forensics, Incident Response & Threat Hunting

November 22, 2023

Linux Incident Response - Using ss for Network Analysis

Understanding the ss command is crucial for analyzing network connections & traffic, to identify and investigate potentially malicious activities.

Tarot (Taz) Wake

Digital Forensics, Incident Response & Threat Hunting

November 1, 2023

The Truth About USB Device Serial Numbers – (and the lies your tools tell)

Evidence surrounding the use of USB devices is an often sought-after forensic treasure trove. Here's an attempt to make sense of this data.