easy5 pts · first answer countsidentity-securitywindows-event-logsactive-directory
Event for a new user account
During an incident you want to know whether the attacker created any new domain accounts. Which Windows Security event ID should you search for on the domain controllers?
Discussion 0
Join free to post in the discussion.
Related questions
- Which login is really two-factor?Cybersecurity Analyst
- Why passwords are saltedCybersecurity Analyst
- What is Windows Event ID 4624?Cybersecurity Analyst
- What is Sysmon Event ID 1?Cybersecurity Analyst
- Brute force or password spraying?Cybersecurity Analyst
- Windows event for an account lockoutCybersecurity Analyst
- Windows event for a new serviceCybersecurity Analyst
- Missing command lines in 4688Cybersecurity Analyst