Operating System and Endpoint Security
Windows telemetry worth memorizing
- 4624 successful logon, with logon type 2 interactive, 3 network, 10 remote interactive; 4625 failed logon; 4672 special privileges assigned; 4688 process creation; 7045 new service installed.
- Sysmon events: 1 process create, 3 network connect, 7 image load, 11 file create, 13 registry set.
- LSASS holds credential material. Credential Guard, RunAsPPL, and disabling WDigest raise the cost of dumping; NTLM hashes and Kerberos tickets are both targets.
- UAC is an integrity-level boundary (medium to high), not a security boundary Microsoft supports against admin-to-admin attacks.
Linux and endpoint hardening
/etc/shadow permissions, PAM stack, sudoers, file capabilities, SELinux contexts, auditd rules, systemd unit persistence, cron, LD_PRELOAD, and ~/.ssh/authorized_keys are the persistence and privilege points an examiner will ask about. Living-off-the-land binaries (certutil, bitsadmin, mshta, rundll32, regsvr32) are the execution techniques defenders most often miss.
Worked example
A 4688 event shows WINWORD.EXE as the parent of powershell.exe with a Base64-encoded command line, and Sysmon event 3 shows an outbound connection two seconds later. Reasoning: Office applications do not legitimately spawn PowerShell. Decode the Base64, inspect for download-and-execute strings, pivot to the Sysmon 3 destination, and map to ATT&CK T1566 (phishing) leading to T1059.001 (PowerShell). The detection should key on the parent-child relationship, not on a file hash.
Traps that cost marks
Reading logon type 3 as a user sitting at the console; confusing 4624 with 4625; ignoring integrity level when evaluating privilege escalation; assuming antivirus coverage equals endpoint control.