Name: Spoofing Commands - Can You Trust Process Creation Logs?
Start: 2025-06-10T17:00:00+08:00
End: 2025-06-10T19:30:00+08:00
Location: Microsoft Perth

Mixing it up this month with how Security Logging can be fooled in Windows OSes!

Typically, we trust what is written to the security logs on Windows servers and workstations to be accurate, even just viewing these logs requires local administrator rights. More importantly log based detections as well as some Endpoint Detection & Response products will utilize process creation events written to Windows Security to either enrich detections and show an analyst exactly what was run, or they will be part of the detection itself.

Unfortunately, there has existed a technique for some time now which allows an attacker to stop what is really being run on the command line from being logged. This works for process creation logs generated by Windows itself, Sysmon and even Defender XDR Device logs. This presents attackers with an opportunity to evade some types of detection and if they pair EDR/logging bypass techniques with this technique it makes the job of an analyst trying to deconstruct what has actually occurred incredibly difficult!

Come and learn about this attack vector and ask what can be done about it.

Michelle Sandford

George Coldham

Anthony Porter

Jeff B.

Perth Microsoft Security Meetup

Azure Tech Groups

Technology

Network Security

Computer Security

Web Security

Software Security

Information Security

Microsoft Azure

**Security Researcher at Seamless Intelligence**

Experienced Security Consultant with a demonstrated history of working in the cyber security industry. Skilled in SIEM technology, Data Visualization, Checkpoint & Endpoint Security. Strong information technology professional with a Bachelor of Computer Science focused in Computer Science & Computer Security from Edith Cowan University.

Tristan's linkedin doesn't say how nice a guy he is! Truly, awesome dude, come and say hi!

Tristan Bennett

Spoofing Commands - Can You Trust Process Creation Logs?

Microsoft Perth

Share

Perth Microsoft Security Meetup

Spoofing Commands - Can You Trust Process Creation Logs?

Perth Microsoft Security Meetup

Details

Members are also interested in