Modern SOC:Less Than One and More Than Infinity
summary
Argues SOC is essential and demonstrates concrete detections: shows golden ticket evidence by comparing token group memberships produced by mimikatz forged PK against Active Directory group lists and flags discrepancies, uses PSExec/Windows tokens as ground truth, and notes the mimikatz default group IDs like 500 as indicators. Builds a tool called estm-info that moves from noisy full SQL dumps and ElasticSearch to a VM subscription model for SCCM/SSM, receives real-time callbacks and successfully aggregates incidents (three hosts collapsed into one alert)
AI-written summary · about
chapters (6)
- 0:00Modern SOC necessity
- 3:48Golden ticket attacks in SOC
- 15:10Monitoring Microsoft SCCM
- 21:51SOC case studies and reports
- 26:14Every company needs SOC
- 27:19Q&A on SOC correlation
related talks
51mThe No BS SOC Story
32mThe SOC Of The Future… The Future Is Now
41mOne SOC, The Whole SOC, and Nothing But The SOC, So Help Me
30mThe SOC Counter ATT&CK
33mFree SOC? — how open source tools can come to our aid
51mThe Hole in Your SOC: How a compromise of your SIEM could
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
22mTechnical Tracks