Detecting Unauthorized Behavior From Legitimate Accounts

Incident Responders face an almost insurmountable amount of log events, and the move to the Cloud has only intensified this dependency on log data for intrusion analysis.Attackers are shifting techniques to utilize compromised accounts to hide their activity among the volume of legitimate business...

By

Rodney Caudle

June 22, 2022

All papers are copyrighted. No re-posting of papers is permitted

Related Content

Top 5 Reasons to Attend SANS Blue Team Summit 2023

The SANS Blue Team Summit & Training 2023, June 12-13 brings together world-class experts from the industry to share their insights & best practices.

Finding_Evil_WMI_Event_Consumers_with_Disk_Forensics_-Blog_(1).png

Digital Forensics and Incident Response

Finding Evil WMI Event Consumers with Disk Forensics

This blog covers disk-based artifacts and tools available for use during deeper forensic investigations.

A Visual Summary of SANS Small Business Cyber Summit 2023

Check out these graphic recordings created in real-time throughout the event for SANS Small Business Cyber Summit 2023