A compact reference for day-to-day security checks.
Common ports
- 53 DNS
- 88 Kerberos
- 389 LDAP
- 443 HTTPS
- 445 SMB
- 3389 RDP
Useful Windows logs
- Security
- System
- Application
- Windows Defender/Operational
- PowerShell Operational
High-signal Event IDs
- 4624, 4625, 4688, 4720, 4726, 4732, 4733, 4740, 4768, 4769, 4771, 7045, 1102, 1116
Get-WinEvent -LogName Security -MaxEvents 50`nTest-NetConnection -ComputerName 8.8.8.8 -Port 53`nGet-FileHash C:\Path\file.exe -Algorithm SHA256