Monitoring the wrong things
Posted in Business, Security Architecture on Feb 24th, 2023
In my last post I described AdminSDHolder, an object in Active Directory that attackers can change to keep their access. One change, in one place, and very few organisations monitor it. At the same time, the same organisations often pay a lot to monitor things that rarely matter. Every firewall flow, every successful logon to […]