In today’s edition, we’ll cover two techniques: Remote service creation over RPC and SharpRDP.

In today’s edition, we’ll cover two techniques: suspicious parent-child process relationships and impersonation with the RunAs command.

In today’s edition, we’ll cover two techniques: privilege escalation through DLL hijacking and masquerading files as unsigned processes.

This FalconFriday is focused on lateral movement. Especially lateral movement through DCOM, a technique used by many red teams.

We realized that the previous versions of FalconFriday were “too blue”.

Introduction I was working on building some new hunts in Microsoft Defender ATP (MDATP).