Read on Twitter
Use Sysmon to detect attempts to mess with your event log service and stay on top of red team tactics - #dfir, #EventLog 
... and #dfir can surface sysmon-based detections for such in-memory attacks in #AzureSecurityCenter - read how at azure.microsoft.com/en-us/blog/det…
Was asked whether such alerts can be surfaced in the OMS Security & Audit dashboard. 🔥Sure! 🔥Configure Sysmon collection via OMS settings as shown, and see the detection show up in OMS 🎉 !
• • •
Missing some Tweet in this thread? You can try to
force a refresh
