Enterprise Cyber Security Cheatsheet

• An authenticated user requests a Kerberos TGS ticket for an account with a Service Principal Name (SPN). The ticket is encrypted with the service account's password hash. The attacker extracts the ticket from memory and cracks the password offline.
• Mitigation: Use complex 25+ character passwords for service accounts, deploy Group Managed Service Accounts (gMSA), and monitor Event ID 4769 for RC4 ticket requests.

• The attacker extracts cached NTLM password hashes from a compromised machine's LSASS memory space (using Mimikatz) and presents the hash directly to authenticate to other domain hosts without needing the plaintext password.
• Mitigation: Deploy Windows LAPS to randomize local admin passwords, enable Credential Guard, and restrict lateral network movement.

• Malware gains execution, deletes Volume Shadow Copies (`vssadmin delete shadows`), encrypts local files and mapped network drives using strong symmetric keys, and exfiltrates data for double extortion.
• Mitigation: Isolate infected hosts via EDR, enforce immutable air-gapped backups (3-2-1-1-0 rule), deploy Endpoint DLP, and enforce least privilege.

• Attacker sets up a reverse proxy server (e.g. Evilginx) between the victim and legitimate login portal (M365). Intercepts user credentials and active OAuth session tokens post-MFA, allowing session hijacking.
• Mitigation: Enforce Phishing-Resistant MFA (FIDO2 Hardware Security Keys / Certificate-based EAP-TLS) and conditional access device compliance.

• Unsanitized input fields allow attackers to inject custom SQL commands (e.g., `' OR '1'='1`), bypassing web application authentication or extracting backend database tables.
• Mitigation: Use Prepared Statements / Parameterized Queries, input sanitization, and deploy a Web Application Firewall (WAF).

• Attacker sends spoofed ARP responses across the local network segment associating their MAC address with the Default Gateway IP, routing all subnet traffic through their machine.
• Mitigation: Enable Dynamic ARP Inspection (DAI) and DHCP Snooping on managed network switches.

• Logs successful account authentication.
• Key Fields: Logon Type (Type 2 = Interactive, Type 3 = Network, Type 10 = RDP), TargetUserName, WorkstationName, Source IP.

• Primary indicator for Brute Force or Password Spraying attacks.
• Sub-Status Codes: 0xC000006A (Wrong Password), 0xC0000234 (Account Locked), 0xC0000064 (Non-existent Username).

• Alerts on potential backdoor account creation by an attacker seeking persistence.
• Verify whether account creation was backed by an approved HR/IT onboarding ticket.

• Triggers when an account hits the bad password threshold limit.
• Use LockoutStatus.exe or PDC logs to trace the caller computer name sending old cached credentials.

• High Severity Alert: Attackers often clear Windows Security event logs (`wevtutil cl security`) to cover their anti-forensic footprints.

• Monitors new Windows background service installations.
• Frequently triggered by PsExec, Cobalt Strike beacons, or persistence rootkits (`ImagePath` attribute analysis).

SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID == 4625
| summarize FailedCount = count() by TargetUserName, IpAddress
| where FailedCount > 10
| sort by FailedCount desc

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where FileName in~ ("powershell.exe", "pwsh.exe")
| where ProcessCommandLine has_any ("-enc", "-encodedcommand", "bypass", "nop")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, ParentProcessFileName

DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where ProcessCommandLine has_any ("lsass", "procdump", "comsvcs.dll", "rundll32")
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName

1. Preparation: Hardening systems, defining playbooks, training IR team.
2. Detection & Analysis: Alert triage, parsing logs, verifying scope.
3. Containment: Isolating hosts (EDR isolation) and disabling compromised accounts.
4. Eradication: Removing malware binaries, wiping backdoors, patching root vulnerabilities.
5. Recovery: Safe restoration of systems to production from clean backups.
6. Post-Incident Activity: Documenting lessons learned and updating detection rules.

• Reconnaissance → Resource Development → Initial Access → Execution → Persistence → Privilege Escalation → Defense Evasion → Credential Access → Discovery → Lateral Movement → Collection → Command and Control (C2) → Exfiltration → Impact.