Summary
In this chapter, you learned about persistence techniques such as registry run keys, Windows scheduled tasks, Windows services, and WMI event subscription. You also learned how to investigate any suspicious persistence entries by analyzing Windows event logs. Also, you learned about lateral movement techniques, such as Remote Desktop application, Windows admin shares, the PsExec Sysinternals tool, and PowerShell remoting, and you learned how to investigate such activities by analyzing the Windows event logs recorded on both source and target machines.
In the next chapter, we will learn how to analyze network firewall logs.
