Security Spotlight

Prevention & Cure: Countermeasures Against Healthcare Cyberattacks

A recent successful cyberattack on a large technology provider for hospitals and pharmacies in the US has left patients unable to obtain their medication. This attack is a reminder that healthcare cyberattacks are not stopping, and a successful attack will…

Read More

Detecting Volt Typhoon TTPs – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. Last week, the Cybersecurity and Infrastructure Security Agency (CISA) released a…

Read More

Detecting OS Credential Dumping done via WDigest – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about OS Credential Dumping…

Read More

Monitoring USB Usage with Windows Logs – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about how you can…

Read More

Disable Windows Event Logging – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about a technique attackers…

Read More

Detecting Token Impersonation – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about a common method…

Read More

Detecting Domain Name Abuse – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about a cool open-source…

Read More
How LOLBAS Is Used in MS Process Abuse – Security Spotlight

How LOLBAS Is Used in MS Process Abuse – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about LOLBAS and highlighting…

Read More
Security Spotlight - Enhanced Reporting with Grafana

Enhance Your Reporting with Grafana – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about enhancing your reporting…

Read More
Enable RDP Locally - Security Spotlight

Remote Desktop Protocol Misuse – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about Remote Desktop Protocol…

Read More

Detecting AWS Unauthenticated Cross-Account Attacks – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. Amazon Web Services (AWS) has a shared responsibility model that brings…

Read More

Account Discovery: Windows – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about how adversaries may…

Read More

Monitoring BITSAdmin Misuse – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks.  In this Security Spotlight, we’ll be talking about BITS, and…

Read More

SCR File Execution Using Rundll32 – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks.  In this Security Spotlight, we’ll be talking about the execution…

Read More

Detecting Raspberry Pi on the Network – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks.  In this Security Spotlight, we’ll be talking about the Raspberry…

Read More

Monitoring Virtual Network Computing – Security Spotlight

The “Security Spotlight” blog series provides insight into emerging cyberthreats and shares tips for how you can leverage LogRhythm’s security tools, services, and out-of-the-box content to defend against attacks. In this Security Spotlight, we’ll be talking about monitoring Virtual Network…

Read More

Credential Dumping LSASS via comsvsc.dll – Security Spotlight

The ‘Security Spotlight’ series of blogs is written in accompaniment with the YouTube series of the same name, which is aimed at providing quick visibility and understanding into how you can leverage the LogRhythm platform against a variety of threats.…

Read More

Tips to Monitor Disabled and Deleted User Accounts – Security Spotlight

The ‘Security Spotlight’ series of blogs is written in accompaniment with the YouTube series of the same name, which is aimed at providing quick visibility and understanding into how you can leverage the LogRhythm platform against a variety of threats.…

Read More