From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will

T1Covered by 1 source · first reported by Huntress at 24 Jun, 07:00 UTC

ldapnomnom claims it leaves no Windows audit logs. This post shows why Event 1644 misses LDAP Ping and where defenders can still catch it.

security

Sources

• T1From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never WillHuntress24 Jun, 07:00