ELK

3 posts

• 2026-04-01

  ELK Threat Hunting: Timestomping, Meterpreter, WMI & Credential Harvesting

  Threat hunting exercise using ELK/Kibana to detect timestomping (T1099), Meterpreter process migration (T1055), WMI abuse (T1021), xp_cmdshell execution, browser credential harvesting (T1081), and RottenPotato privilege escalation (T1134).

  Threat HuntingELK 6 min read
  →
• 2026-03-29

  ELK Lab 1 - PowerShell Threat Hunting

  ELK-based threat hunting lab covering detection of PowerShell offensive frameworks, suspicious parent processes, renamed executables, base64-encoded commands, GZIP compression, XOR obfuscation, and download techniques.

  Threat HuntingELK 3 min read
  →
• 2026-03-29

  ELK Lab 2 - LOLBAS, UAC Bypass, DCSync

  ELK hunting lab covering rundll32 abuse, UAC bypass via cliconfg.exe and sdclt.exe, RDP tampering detection, DCSync, remote WMI usage, LOLBAS openurl techniques, and scheduled task persistence.

  Threat HuntingELK 2 min read
  →