Windows Security Monitoring

1. Overview

Here, we walk through the different stages of the Cyber Kill Chain and show how to investigate each stage using indicators

For details in windows logs ID, see Bo Cyber Logbook - Windows Logs IDs
For different windows event log types, see Bo Cyber Logbook - Windows Event Log Types

Analyzing Windows Log can be daunting. Aside from SIEM, there are some handy tools for this job. We explored those tools in TryHackMe Tempest Room - https://tryhackme.com/room/tempestincident

2.1 Indicators - Initial Access

Instant Attacks: Research shows that an exposed RDP port is usually discovered by automated botnets and hit with brute-force attempts within one minute of going online.

Indicators - Remote Logon

2.2 Indicators - Phishing and USB

usually involves open files

2.3 Indicators - Discovery

The first task to detect a potential Discovery is to find a Discovery command, or better, a sequence of commands run during a short period of time. You will see them as process creation events tracked by Sysmon event ID 1 or as new rows in the PowerShell history file. ID 4663 File Access

2.4 Indicators - Collection

In Collection, threat actors don’t just check a system configuration but rather look for specific files and folders such as password, secrect, .pdf, .csv, .temp basically any folder that can store valuable data.

2.5 Indicators - Persistence

Once inside, the attack will want to maintain persistence. Ways including C2, creating new users

New Users

Extended Readings

Last Modified: 2025-12-28