Effective Threat Investigation for SOC Analysts

4

Tracking Accounts Login and Management

Almost everything and every action in a Windows environment is tied to an account. So, during the incident investigation process, the first effective way to track and investigate an attacker’s activities is to track the compromised accounts’ login and suspicious account management activities. As a SOC analyst, you must be aware of and able to analyze the account login and management event logs provided by Microsoft on the Windows OSs that help you investigate and detect suspicious accounts activities.

The objective of this chapter is to make you aware of the different Windows account types, understand and be able to analyze the event logs of Windows account login activities, such as successful authentications, ...