7MS #499: Desperately Seeking a Super SIEM for SMBs - Part 6

Today we have some cool updates on this SIEM-focused series we've been doing for a while. Specifically, I want to share that one of these solutions can now detect three early (and important!) warning signs that bad things are happening in your environment: ASREPRoasting WDigest flag getting flipped (reg add HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential /t REG_DWORD /d 1) Restricted admin mode getting enabled (reg add HKLM\System\CurrentControlSet\Control\Lsa /t REG_DWORD /v DisableRestrictedAdmin /d 0x0 /f) - see n00py's blog for more info

Episode metadata supplied by the publisher feed · Published Dec 16, 2021

Embed this episode

Attribution link and audio player

NOW PLAYING

7MS #499: Desperately Seeking a Super SIEM for SMBs - Part 6

0:00 21:35

1×

No transcript for this episode yet

We transcribe on demand. Request one and we'll notify you when it's ready — usually under 10 minutes.

Share this episode

Similar Episodes

No similar episodes found.

Similar Podcasts

No similar podcasts found.

Frequently Asked Questions

How long is this episode of 7 Minute Security?

This episode is 21 minutes long.

When was this 7 Minute Security episode published?

This episode was published on December 16, 2021.

Can I download this 7 Minute Security episode?

Yes. Use the download control on the episode player to save the publisher-provided media file.

URL copied to clipboard!