DETECTION PITFALLS YOU MIGHT BE SLEEPING ON

Summary from the TLDR InfoSec newsletter

This post presents five common Windows detection pitfalls that can lead to gaps in detection. The pitfalls include parameters being able to be called in multiple different ways, & and | causing multiple log entries for a single command, extra whitespace in commands, other forms of command obfuscation, and commands that don't cause process creation events. Each pitfall also includes detection tips to circumvent it.