ELK Threat Hunting: Timestomping, Meterpreter, WMI & Credential Harvesting
Threat hunting exercise using ELK/Kibana to detect timestomping (T1099), Meterpreter process migration (T1055), WMI abuse (T1021), xp_cmdshell execution, browser credential harvesting (T1081), and RottenPotato privilege escalation (T1134).
Threat HuntingELK
6 min read