Sysmon

Splunk-ShadowRoast

April 14, 2026

Splunk SOC SIEM Log Analysis DFIR Windows Sysmon Active Directory AS-REP Roasting Rubeus Mimikatz Credential Dumping Process Injection Fileless Malware PowerShell RDP

A masqueraded AdobeUpdater.exe binary established persistence via a registry Run key, injected into cmd.exe, performed AS-REP Roasting with Rubeus against four AD accounts, laterally moved to FileServer using cracked tcooper credentials, enabled RDP, and staged share data for exfiltration.

ELK-REvil - GOLD SOUTHFIELD

April 7, 2026

ELK SOC SIEM Log Analysis Ransomware REvil Sysmon LOLbins WMI VirusTotal ANY.RUN Tor

An administrator executed facebook assistant.exe on a Windows Server 2019 host, which dropped REvil ransomware (Sodinokibi), spawned a PowerShell process that deleted Volume Shadow Copies, and dropped ransom notes across multiple user profile directories.

↑