Basic's of Windows\AD & commands

 #🔹 Basic Server & System Commands

===========================
1️⃣ hostname – Display the server name 🖥️
2️⃣ whoami – Display the logged-in user 👤
3️⃣ net stats srv – Show last reboot time ⏱️
4️⃣ diskmgmt.msc – Manage and view existing disks 💽
5️⃣ ncpa.cpl – Show network connections 🌐
6️⃣ secpol.msc – Open Security Policies 🔐
7️⃣ dsa.msc – Open Active Directory console 🗂️
8️⃣ services.msc – Manage Windows Services ⚙️
9️⃣ ipconfig /all – Display NIC & MAC info 📡
🔟 mmc – Microsoft Management Console 🧰
1️⃣1️⃣ repadmin /showrepl – AD replication details 🔄
1️⃣2️⃣ shutdown /r – Restart the server 🔁
1️⃣3️⃣ shutdown /s – Shutdown the server 📴
1️⃣4️⃣ repadmin /replsum – AD replication summary 📊
1️⃣5️⃣ regedit.msc – Open Registry Editor 📝

#🔹 Active Directory Ports (Server ↔ Client)
==============================
🔹 25 – TCP/SMTP 📧
🔹 53 – UDP/DNS 🌍
🔹 67 – DHCP 📦
🔹 80 – HTTP 🌐
🔹 443 – HTTPS 🔒
🔹 88 – Kerberos 🔑
🔹 3389 – RDP 🖥️

#🔹 Networking Commands
====================
◾ ipconfig – Show basic network config 🌐
◾ ipconfig /all – Detailed IP configuration 📡
◾ ipconfig /release – Release current IP 🚪
◾ ipconfig /renew – Renew IP from DHCP 🔄
◾ ipconfig /flushdns – Clear DNS cache 🧹
◾ ping \[IP] – Test connectivity 📶
◾ tracert \[IP] – Trace route to destination 🛣️
◾ nslookup \[domain] – DNS lookup 🌍
◾ netstat -an – Show active connections & ports 🔍
◾ arp -a – Display ARP table 📝
◾ hostname – Show computer name 🖥️
◾ getmac – Show MAC address 📡
◾ net use – Connect to shared resource 🔗
◾ net share – List shared resources 📂
◾ net start – Show running services ⚙️
◾ net stop – Stop a service ⛔
◾ netsh – Configure advanced network settings 🛠️

Windows SIEM Use Cases & Event ID's

==================================

1.Failed Login Attempts - Event ID: 4625
2.Account Lockouts - Event ID: 4740
3.Successful Login Outside Business Hours - Event ID: 4624
4.New User Creation - Event ID: 4720
5.Privileged Account Usage - Event ID: 4672
6.User Account Changes - Event IDs: 4722, 4723, 4724, 4725, 4726
7.Logon from Unusual Locations - Event ID: 4624 (with geolocation analysis)
8.Password Changes - Event ID: 4723 (change attempt), 4724 (successful reset)
9.Group Membership Changes - Event IDs: 4727, 4731, 4735, 4737
10.Suspicious Logon Patterns - Event ID: 4624 (anomalous logons)
11.Excessive Logon Failures - Event ID: 4625
12.Disabled Account Activity - Event ID: 4725
13.Dormant Account Usage - Event ID: 4624 (rarely used accounts)
14.Service Account Activity - Event IDs: 4624, 4672
15.RDP Access Monitoring - Event ID: 4624 (with RDP-specific filtering)
16.Lateral Movement Detection - Event ID: 4648 (network logons)
17.File and Folder Access - Event ID: 4663
18.Unauthorised File Sharing - Event IDs: 5140, 5145
19.Registry Changes - Event IDs: 4657
20.Application Installation and Removal - Event IDs: 11707, 1033
21.USB Device Usage - Event IDs: 20001, 20003 (from Device Management logs)
22.Windows Firewall Changes - Event IDs: 4946, 4947, 4950, 4951
23.Scheduled Task Creation - Event ID: 4698
24.Process Execution Monitoring - Event ID: 4688
25.System Restart or Shutdown - Event IDs: 6005, 6006, 1074
26.Event Log Clearing - Event ID: 1102
27.Malware Execution or Indicators - Event IDs: 4688, 1116 (from Windows Defender)
28.Active Directory Changes - Event IDs: 5136, 5141
29.Shadow Copy Deletion - Event ID: 524 (with VSSAdmin logs)
30.Network Configuration Changes - Event IDs: 4254, 4255, 10400
31.Execution of Suspicious Scripts - Event ID: 4688 (process creation with script interpreter)
32.Service Installation or Modification - Event ID: 4697
33.Clearing of Audit Logs - Event ID: 1102
34.Software Restriction Policy Violation - Event ID: 865
35.Excessive Account Enumeration - Event IDs: 4625, 4776
36.Attempt to Access Sensitive Files - Event ID: 4663
37.Unusual Process Injection - Event ID: 4688 (with EDR or Sysmon data)
38.Driver Installation - Event IDs: 7045 (Service Control Manager)
39.Modification of Scheduled Tasks - Event ID: 4699
40.Unauthorised GPO Changes - Event ID: 5136
41.Suspicious PowerShell Activity - Event ID: 4104 (from PowerShell logs)
42.Unusual Network Connections - Event ID: 5156 (network filtering platform)
43.Unauthorised Access to Shared Files - Event ID: 5145
44.DNS Query for Malicious Domains - Event ID: 5158 (DNS logs required)
45.LDAP Search Abuse - Event ID: 4662
46.Process Termination Monitoring - Event ID: 4689
47.Failed Attempts to Start a Service - Event ID: 7041
48.Audit Policy Changes - Event IDs: 4719, 1102
49.Time Change Monitoring - Event IDs: 4616, 520
50.BitLocker Encryption Key Changes - Event ID: 5379