topic
Detection
3 posts
-
T1068 - gdrv.sys Load Attempt - EDR Detection Queries
EDR detection queries for identifying BYOVD exploitation attempts using the vulnerable gdrv.sys Gigabyte driver.
-
T1218.005 - msxsl + typeperf Execution - EDR Detection (PowerQuery)
PowerQuery-based EDR detection for LOLBin abuse via msxsl.exe and typeperf.exe process creation from non-standard paths.
-
Splunk Lab 1 - Brute Force Detection
Splunk threat hunting lab covering password brute-force detection, attack frequency visualization, IP geolocation, and process execution analysis using BOTSv1 data.