2) Set traps and decoys to catch the curious intruder:https://twitter.com/thisisfinedfir/status/1508794461895200772 …
Summary of #ThreatHunting #DFIR tips for week 7:
1) Hunt for MFA bombing and suspicious MFA prompt generation:https://twitter.com/thisisfinedfir/status/1508527551303589900 …
![](https://webcf.waybackmachine.org/web/20220403090143im_/https://pbs.twimg.com/media/FO9dz9GXwAoQJUa.jpg)
-
-
Show this thread
-
3) Hunt for inductors of endpoint EDR or AV agents being killed:https://twitter.com/thisisfinedfir/status/1509172061025050635 …
Show this thread -
4) Hunt through your RDP logs using windows event logs and firewall logs:https://twitter.com/thisisfinedfir/status/1509823994668761110 …
Show this thread -
That’s it for week 7. Follow
@thisisfinedfir for more tips.Show this thread
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.