THREAT OPS › Threat News › From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
From Code to Coverage (Part 6): What netlogon.log Sees That Event 1644 Never Will
ldapnomnom claims it leaves no Windows audit logs. This post shows why Event 1644 misses LDAP Ping and where defenders can still catch it.