how2itsec

It is unfortunate that the word "password" has the word "word" in it. That leads to people almost always use one word, a...

Due to growing data I had to add more storage. Therefore I bought a new Intel NUC (10th generation)  running VMware ESXi 7.0. Really helpful...

Microsofts Powershell is a very mighty tool, which can be used as LoLBin. To detect suspicious powershell commands or scripts, a SIEM use ca...

A possible solution to the following error in Windows 10 when trying to use the start menu: English Error: Critical Error – Your Start menu ...

When trying to use groups for regular expression searches with findall in python, python wont work as in re.search: Example with re.search ...

Microsoft Threat Protection Intelligence Team released in the past some great detailed articles (e.g. 2020-03 Ransomware , 2018-03 FinFishe...

When trying to open a picture, for example a JPEG, with Windows 10 picture the error message "Invalid Value for Registry" or ...

When trying to update your Nextcloud VM using the updater in the GUI the following error might be shown:  Check for write permission...

If you are using Anaconda3 on Windows for python development you may want to know, which version of pip is installed: Start Anaconda Shell (...

How to increase my companys IT security? Of course there are many, many, many topics, processes, systems, parameters, awareness and a lot mo...

The McAfee blog released an article about how a current spear phishing attack (T1566) looks like in detail: (Picture from McAfee Blog ) Mo...

When trying to delete files or folders, clean malware, or just modify something on your Windows system, windows won't let you, because t...

Most Fortinet FortiAnalyzer reports use the full domain including subdomains, e.g. www.google.com or maps.google.com. If you want to group s...

Paessler just released for PRTG a remover for the deprecated Enterprise Console: PRTG Enterprise Console Remover.exe: You can uninstall sta...

I just had to restore many broken CHK files of a SD card from a hidden FOUND.000 folder. The program "unchk.exe" helped me: ...

Most companys use an account lockout policy for their directory service like Microsoft Active Directory, LDAP-system, eDirectory or their ow...

You can deactivate the Windows 10 Core Isolation function by changing the following Registry Key and therefore do "Tampering with Windo...

Some places to start to monitor (e.g. for unexpected processes interacting with one of the following), collector forensics and try to protec...

An easy to find possible indicator of compromise (IoC) for your SIEM, AEP or EDR could be a outbound network connection from Windows own reg...

Many SIEM installations use sysinternals sysmon as one of many data sources. Mark Russinovich (Microsoft Azure CTO, co-creator of sysintern...

Performance problem - Distance and Latency More and more companys face the challenging requirement to provide available services, which su...

You can either use the GUI of the FortiGate to list all certificates, or use the CLI. Either using the commands: Using the "get...

Many VMWare ESXi installations make the same mistake: They overcommit vCPUs, don't monitor CPU metrics like %RDY, %CSTP and don't kn...

Most small/medium businesses don't do much configuration, monitoring, cfg-baselineing or follow best practises with their network device...

Recently I discovered something after updating a FortiGate cluster, which I intensively monitor, not only via working monitoring queries, bu...