Главная
Study mode:
on
1
Intro
2
What's happening on our endpoints?
3
Sysmon Visibility
4
Getting Started with Sysmon
5
Swift vs. SIG Sysmon Config
6
Transporting Logs with WEC
7
SIEM Integration
8
What kinds of badness can we detect?
9
Malicious Microsoft Word Macro Payload
10
Malicious PowerShell Execution
11
Rubber Ducky and Mouse Jacking Attacks
12
Sticky Keys Attack
13
Lateral Movement with WMI
14
Lateral Movement with PsExec
15
Lateral Movement with Sneaky PsExec
16
Dumping Credentials from Memory
17
Investigation with PowerShell & Excel
18
Malspam with Word Macro
19
Malspam SIEM Alert
20
Getting Sysmon Events via PowerShell
21
Adding Sysmon Fields to Events Properties
22
Interacting with Excel via PowerShell
23
Advanced Analytics with Spoor
24
How can you get started with Sysmon?
Description:
Learn how to enhance your Security Operations Center (SOC) using Sysmon in this conference talk from BSidesPhilly 2017. Explore endpoint visibility, Sysmon configuration, log transportation, and SIEM integration. Discover techniques for detecting various malicious activities, including Word macro payloads, PowerShell execution, physical attacks, lateral movement, and credential dumping. Gain insights into investigation methods using PowerShell and Excel, and learn about advanced analytics with Spoor. Get practical advice on implementing Sysmon to improve your organization's security posture.

Supercharge Your SOC with Sysmon

Add to list
#Conference Talks #Information Security (InfoSec) #Cybersecurity #Computer Science #Information Technology #PowerShell #Data Science #Data Analytics #Advanced Analytics
1 of 24

Intro