security | RobWillis.info

Analyzing & Detecting IIS Backdoors

robwillisinfo — Sat, 05 Nov 2022 08:00:12 +0000

IIS Extensions As Backdoors Microsoft recently published an interesting blog explaining how they’ve noticed a new trend where attackers have been leveraging Internet Information Services (IIS) extensions to covertly backdoor Windows servers: https://www.microsoft.com/security/blog/2022/07/26/malicious-iis-extensions-quietly-open-persistent-backdoors-into-servers/ The Microsoft post contains a wealth of information on this topic, but I really wanted to dig through the specifics in order […]

The post Analyzing & Detecting IIS Backdoors first appeared on RobWillis.info.

Defending Against PowerShell Attacks

robwillisinfo — Mon, 22 Feb 2021 04:07:54 +0000

It’s no secret that I am a big fan of PowerShell and recently I have been spending a considerable amount of time researching and testing it from a security perspective. While there is a lot of solid information out there, I have found it can still be a challenge to really get a solid grasp […]

The post Defending Against PowerShell Attacks first appeared on RobWillis.info.

Gathering Windows, PowerShell and Sysmon Events with Winlogbeat – ELK 7 – Windows Server 2016 (Part II)

robwillisinfo — Tue, 07 May 2019 02:43:19 +0000

In part I of this series, Installing ELK 7 (Elasticsearch, Logstash and Kibana) on Windows Server 2016, I covered the following: Installing and configuring Elasticsearch, Logstash, and Kibana as Windows services Installing and configuring Winlogbeat to forward logs from the ELK server into ELK Installing and configuring Curator as a scheduled task (optional) Now, in […]

The post Gathering Windows, PowerShell and Sysmon Events with Winlogbeat – ELK 7 – Windows Server 2016 (Part II) first appeared on RobWillis.info.

Installing ELK 7 (Elasticsearch, Logstash and Kibana) – Windows Server 2016 (Part I)

robwillisinfo — Tue, 07 May 2019 02:42:55 +0000

I am a huge fan of the Elastic stack as it can provide a great deal of visibility into even the largest of environments, which can help enable both engineering and security teams rapidly triage technical issues or incidents at scale. There’s also the fact that unlike Splunk, the Elastic software is free to use […]

The post Installing ELK 7 (Elasticsearch, Logstash and Kibana) – Windows Server 2016 (Part I) first appeared on RobWillis.info.

Home Lab Cooling Upgrade!

robwillisinfo — Mon, 29 Oct 2018 03:24:14 +0000

In this video I show off my latest project – Upgrading the cooling system on my home lab in hopes of making it a little more efficient while quieting things down a bit. The original setup consisted of the following: 2 x 6″ Ducts with Fans 6″ Flexible Ducting Originally there was just a single […]

The post Home Lab Cooling Upgrade! first appeared on RobWillis.info.

My Journey Into The OSCP

robwillisinfo — Fri, 13 Jul 2018 13:28:40 +0000

Intro This post is going to break away from my typical technical how-to style posts, and talk a little bit about something that has been a personal goal of mine for some time – The Offensive Security Certified Professional. When it comes to even thinking about enrolling in the OSCP, most people will question if […]

The post My Journey Into The OSCP first appeared on RobWillis.info.

Home Lab Setup (2017)

robwillisinfo — Sun, 04 Feb 2018 15:51:15 +0000

In this post and video I give a quick run down of my Home Lab – everything from the rack itself, to the hardware and the basics of what everything is being used for. I started this project towards the end of 2012 with a single Dell PowerEdge 2950 GII and was hoping to teach […]

The post Home Lab Setup (2017) first appeared on RobWillis.info.

ELK Stack – Installing and Configuring Curator

robwillisinfo — Thu, 16 Nov 2017 15:42:29 +0000

In this post I am going to quickly cover what is needed to get Curator up and running on the ELK stack. In the last few posts about the ELK stack I covered everything needed to get it installed, configured and ingesting logs reliably. If you missed those posts, you can find them here: ELK […]

The post ELK Stack – Installing and Configuring Curator first appeared on RobWillis.info.

ELK Stack – Tips, Tricks and Troubleshooting

robwillisinfo — Fri, 10 Nov 2017 02:55:43 +0000

This post is going to be a sort of a follow up to my ELK 5 on Ubuntu 16.04 series. I am going to cover some of the lessons I have learned over the last few months of maintaining a running ELK stack instance. I am also going to cover some one liners that can […]

The post ELK Stack – Tips, Tricks and Troubleshooting first appeared on RobWillis.info.

ELK 5: Setting up a Grok filter for IIS Logs

robwillisinfo — Thu, 11 May 2017 14:47:05 +0000

In Pt. 3 of my setting up ELK 5 on Ubuntu 16.04 series, I showed how easy it was to ship IIS logs from a Windows Server 2012 R2 using Filebeat. One thing you may have noticed with that configuration is that the logs aren’t parsed out by Logstash, each line from the IIS log […]

The post ELK 5: Setting up a Grok filter for IIS Logs first appeared on RobWillis.info.