Great to see so many of you on the session today and interacting - thanks! I hope the new platform worked well for you.
Here's a few query resources that I wanted to share following Andy's session:
- https://community.sophos.com/intercept-x-endpoint/i/threat-hunting/threat-hunting---account-discovery
- https://community.sophos.com/intercept-x-endpoint/i/threat-hunting/threat-hunting---discovery-of-password-policies
- https://community.sophos.com/intercept-x-endpoint/i/processes/threat-hunting---powershell-script-blocks
As Andy mentioned, let us know if you have any other useful queries, and we can share the goodness with the community here!
See you tomorrow for session 5...
