Reading Logs, Verifying Hashes, and Detecting Data Attacks
4.4.ASkill
Reading Windows Security Event Logs
Windows logs authentication activity with standardized numeric Event IDs. Two are foundational enough to know on sight:
📋 Event ID Reader — click each entry
SUCCESS
A successful logon. On its own this is routine — but a 4624 from an unusual location, device, or time is worth flagging.
🔑A single 4625 means nothing on its own. Ten 4625 entries for the same account within one minute, followed by a 4624 — that's the signature of a successful brute-force or credential-stuffing attempt, and it's exactly the pattern you're trained to notice now.
5.6.A–CConcept
Detecting Attacks on Data
Devices track and log when data is accessed and by whom — a process called accounting. Reviewing those logs can surface malicious activity: files accessed outside someone's normal pattern, unusual login times or locations, or attempts to copy or delete sensitive files.
Tool
How it works
Cost
Honeypot
A fake file that looks valuable — any access at all is suspicious, since there's no legitimate reason to touch it
Low
DLP Service
Monitors data access, usage, and transmission org-wide
Higher
Hash Verification
Detects whether a file's contents changed
Low
⚠️Every one of these has a blind spot. A honeypot can't catch an adversary who never touches it. A hash can't catch data that was viewed or copied without being changed. Real detection strategies usually combine multiple tools precisely because no single one covers every case.
5.6.DSkill
Verifying Integrity with File Hashes
Cryptographic hash functions are repeatable — the same file always produces the same hash. That property is what makes hash verification work: hash a file, record the result, and hash it again later. If the two hashes match, the file is provably unchanged.
🔐 Hash Verification Workflow
Get-FileHash evidence.docx -Algorithm SHA256
Output: 8f3a...c92d
💡MD5 vs. SHA-256: MD5 is faster but cryptographically weaker — collisions (two different files producing the same hash) have been demonstrated. SHA-256 is slower but far more collision-resistant, which is why it's the standard choice when hash verification needs to hold up as forensic evidence.
4.4.CConcept
Evaluating a Detection Method
Choosing a detection method isn't just "pick the best one" — it's a real tradeoff across three factors:
Factor
The tradeoff
Speed / performance
Signature-based is faster; anomaly-based can degrade performance, especially on limited-power devices
Attack phase
Catching an attack earlier (at the device level) prevents more damage than catching it after data is already gone
False positives vs. bypass ease
Signature-based has fewer false alarms, but is easier for adversaries to evade than behavior-based detection
5.6.ESkill
Spotting SQL Injection in a Log
SQL injection attempts leave fingerprints in application and server logs — specific characters and patterns that shouldn't appear in normal input.
ExampleGuided Example — Scanning a Log for Injection Attempts
A web server log shows this input submitted to a login form's username field:
username=admin' OR 1=1 --
Step 1 — Spot the quote character
The single quote (') is trying to close the string the application expected — the first sign this isn't a real username.