Curated SIEM queries and techniques for offensive discovery of Windows privilege escalation, misconfigured ACLs, services, scheduled tasks, and vulnerable drivers.
Practical techniques for leveraging SIEM as an offensive discovery tool, helping defenders think like attackers to strengthen security from within.
See above - queries.md file.
Will keep getting updated when needed. The idea is to have layer on layer coverage using different event.codes/event.providers.
Queries for Vulnerability Management in file: vulnerabilitymanagement.md
We hope that you liked the presentation. Ping us if you (i would say when you) find vulnerabilities by using this method. A simple message like "one of your queries cathed good stuff".. is more then enough :) do it by commiting to the ping.md file or contact us in alternative ways! We would be happy to share your success!
The repo will assist you in having offensive mindset. Repo is to share the material and queries that we talked about in our presentation:
SEC-T september 2025 ⭐ https://www.youtube.com/watch?v=5nfL_4ek4dY
x33fcon updated talk june 2026 covering some new areas ⭐ https://youtu.be/dD_7AdEoj0k?is=CMp22Q9evBcqZe7L
We have included the most interesting ACL related parts and have tips & tricks.
Check out the outstanding webinars about windows local privilege escalation and windows endpoint misconfigurations which will assist you further on. There are more areas to look into.. This is only the starting point. If you build good queries in other areas - please share it with us so more in the community can use them.
The queries with ⭐ mark is extra highly relevant. The topics down below with ⭐ is really good content.
a must to watch, specially the ACL for binaries, services and schedule tasks.
Topic 2 (Insecurely installed/conf Software) And Topic 5 (Insecure Services And Tasks)
