Supercharge Your SOC with Sysmon

Supercharge Your SOC with Sysmon

Learn how to enhance your Security Operations Center (SOC) using Sysmon in this conference talk from BSidesPhilly 2017. Explore endpoint visibility, Sysmon configuration, log transportation, and SIEM integration. Discover techniques for detecting various malicious activities, including Word macro payloads, PowerShell execution, physical attacks, lateral movement, and credential dumping. Gain insights into investigation methods using PowerShell and Excel, and learn about advanced analytics with Spoor. Get practical advice on implementing Sysmon to improve your organization's security posture.