blue-team
2026-05Endpoint Telemetry Validation with Sysmon & Atomic Red Team
Executed controlled credential-access and persistence tests on Windows endpoints to verify Sysmon visibility and Sigma rule coverage.
Attack: Simulated credential dumping against lsass.exe (T1003.001) and persistence via schtasks.exe (T1053.005).
Detection: Monitored Sysmon Event ID 10 (ProcessAccess targeting lsass.exe) and Event ID 1 / 4698 for task creation.
Mitigation: Iteratively refined Sysmon XML filtering to capture high-signal offensive artifacts without overwhelming log storage.