Windows

Part 1. System Security

• Windows Event Logs and Signs of Compromise - InfoSec Engineer 1.11

  Learn the roles of Windows event logs and how to investigate compromise using key event IDs such as 4624 and 4625, including detecting brute-force attacks.

• Windows Authentication (LSA) and NTFS File System — InfoSec Engineer 1.5

  Explore Windows authentication through LSA, SAM, and SRM, NTFS features, and how attackers abuse ADS to hide data.