2.3 | SOC Tier 2 | Built-In Admin - RID 500 (Elastic Defend EDR)

Lesson Description

Who ran Rider.exe? It was the domain built-in Administrator (RID 500), which changes the severity of the intrusion. How to identify the user behind a process, how Windows SIDs and RIDs are built, domain versus local SIDs, and why many EDRs lean on Windows event logs for this data. Resources: Understand security identifiers (learn.microsoft.com) · EDR Telemetry Project (edr-telemetry.com)

Enroll in Chasing Rider to unlock the full curriculum.