First, describe the attack in detail $($e$.$g$.,$ lateral movement, credential dumping, ransomware encryption, etc.$).$

Next, describe the logs that are created when this attack is successfully run. Make sure you answer all of the following questions.

Are the logs unique, or would they blend in with similar events?

How would you use this information to search for the specific attack in a SIEM?

Are there any security tools that would make detecting these types of attacks easier?

Make sure you pick an attack that generates sufficient logging on your chosen operating system. For example, you may use the Japan Computer Emergency Response Team Coordination Center report on Detecting Lateral Movement through Tracking Event Logs or this presentation by a Kaspersky senior SOC analyst on Hunting for Credential Dumping in Windows Environments. You may also use another reference of your choosing if it provides relevant detail. Another resource you may find helpful is the Active Directory Security website.

This assignment should be $2-3$ pages in length when using APA formatting standards.