How To Use Window's Advanced Network Connection Audit Logging to Detect and Hunt for Cyber Attackers

In this edition of #TechTalkTuesday we explore Window's advanced audit logging for network connections and talk about how you can leverage Window's built-in features to discover attackers. We explore success and error event IDs to examine connections, packets, and ports associated with applications and lower-level protocols.

Please like and subscribe to support our channel!

Chapters:
00:00 - Intro
00:25 - Overview of the Windows Filtering Platform
04:09 - Using Windows Event Logs to Detect Malicious Network Activity
06:22 - Enabling Advanced Network Activity Monitoring
07:29 - Auditing Connection and Packet Blocking With Windows Event ID 5150 and 5157
10:03 - Auditing Successful Network Connections With Windows Event ID 5165
10:59 - Auditing Successful or Failed Port Binding With Windows Event ID 5158 and 5159
13:01 - Auditing Successful or Failed Application and Service Port Binding With Windows Event ID 5154 and 5155
14:39 - Auditing Failed Incoming Application Connections With Windows Event ID 5031
15:06 - Wrapping Up