Debugging

Detect unauthorized modifications to running containers by monitoring for binary execution drift, file system

Detect LSASS credential dumping, SAM database extraction, and NTDS.dit theft using Sysmon Event ID 10, Windows

'This skill teaches security teams how to detect and respond to unauthorized cryptocurrency mining operations

Detect DCSync attacks where adversaries abuse Active Directory replication privileges to extract password hashes

'Detect anomalies in DNP3 (Distributed Network Protocol 3) communications used in SCADA systems by monitoring

Detect compromised O365 and Google Workspace email accounts by analyzing inbox rule creation, suspicious sign-in

'Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping,

'Detects and analyzes fileless malware that operates entirely in memory using PowerShell, WMI, .NET reflection,

Detect Golden Ticket attacks in Active Directory by analyzing Kerberos TGT anomalies including mismatched encryption

Detect Kerberos Golden Ticket forgery by analyzing Windows Event ID 4769 for RC4 encryption downgrades (0x17),

Implement User and Entity Behavior Analytics using Elasticsearch/OpenSearch to build behavioral baselines, calculate

'Identifies lateral movement techniques in enterprise networks by analyzing authentication logs, network flows,

Detect adversary lateral movement across networks using Splunk SPL queries against Windows authentication logs,

Detect Living Off the Land Binaries (LOLBins/LOLBAS) abuse including certutil, regsvr32, mshta, and rundll32

'Detect malicious scheduled task creation and modification using Sysmon Event IDs 1 (Process Create for schtasks.exe),

'Detect command injection attacks against Modbus TCP/RTU protocol in ICS environments by monitoring for unauthorized

Detect Kerberos Pass-the-Ticket (PtT) attacks by analyzing Windows Event IDs 4768, 4769, and 4771 for anomalous

Detect process hollowing (T1055.012) by analyzing memory-mapped sections, hollowed process indicators, and parent-child

'Detects and analyzes process injection techniques used by malware including classic DLL injection, process hollowing,

Detect RDP brute force attacks by analyzing Windows Security Event Logs for failed authentication patterns (Event

'Detects rootkit presence on compromised systems by identifying hidden processes, hooked system calls, modified

Detect unauthorized SaaS and cloud service usage (shadow IT) by analyzing proxy logs, DNS query logs, and netflow

'This skill covers detecting sophisticated cyber-physical attacks that follow the Stuxnet attack pattern of modifying

Detect risky OAuth application consent grants in Azure AD / Microsoft Entra ID using Microsoft Graph API, audit