↓ Skip to main content
bubka hacks stuff

Qradar

CDEF-Qradar101

SOC SIEM Qradar Log Analysis Active Directory
A user opened a malicious Word document that dropped FSETPBEUsIek.exe, which spawned a VBS script, injected into notepad.exe, established persistence via registry Run key, exfiltrated sami.xlsx to an attacker-controlled server, and triggered a Metasploit reverse shell detected by Suricata.