Home / Blog

The blog

Search results for event id 7045

All Alert Triage Detection Engineering Incident Response Threat Intelligence Threat Hunting SIEM and Tools Career and Certs Cheat Sheets Threat News

2 posts found

AdvancedIncident Response

How to Investigate Rogue Remote Access Tools in a Client Incident

Scope unauthorised AnyDesk, ScreenConnect and TeamViewer use across a client estate: find every install, read the session logs, build a timeline and contain it safely.

11 Nov 20269 min read

BeginnerAlert Triage

How to Triage an Encoded PowerShell Alert

A step by step way to decode an encoded PowerShell command, check its parent process and related activity, and decide whether to close or escalate.

1 Nov 20268 min read