https://www.logsec.cloud/tags/detection/ Recent content in detection on logsec Hugo -- gohugo.io Tue, 28 Dec 2021 00:00:00 +0000 https://www.logsec.cloud/posts/upload-csv-to-elastic/ Tue, 28 Dec 2021 00:00:00 +0000 https://www.logsec.cloud/posts/upload-csv-to-elastic/ Load a CSV of Log4j IOCs into Elasticsearch using a custom index, an ingest pipeline and a short bash loop, to detect outbound traffic to them. https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Tue, 20 Apr 2021 00:00:00 +0000 https://www.logsec.cloud/posts/investigating-cloudtrail-logs-with-elk/ Seven Kibana (KQL) queries for spotting suspicious AWS CloudTrail activity, from disabled logging to backdoor access keys, mapped to MITRE ATT&CK. https://www.logsec.cloud/posts/splunk-range-setup/ Fri, 02 Oct 2020 00:00:00 +0000 https://www.logsec.cloud/posts/splunk-range-setup/ Notes and fixes for building Splunk Attack Range on AWS, then simulating Zerologon (CVE-2020-1472) against the lab domain controller. https://www.logsec.cloud/posts/dnscat2-demo-on-aws/ Sat, 15 Aug 2020 00:00:00 +0000 https://www.logsec.cloud/posts/dnscat2-demo-on-aws/ Set up dnscat2 across two AWS accounts to see how attackers tunnel command-and-control over DNS, and how to defend against it. https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Sat, 20 Jun 2020 00:00:00 +0000 https://www.logsec.cloud/posts/detect-public-s3-bucket-using-splunk/ Splunk searches over CloudTrail logs that catch S3 buckets made public through the console, canned ACLs or grant flags, plus how to respond and prevent it.