Getting The Most Out Of Sysmon
summary
Covers using the Sysinternals tool Sysmon to extend Windows logging for threat hunting and testing detections, with concrete use cases and real-world examples where Sysmon detected malicious behavior. Focuses on practical techniques to get more value from Sysmon than from default Microsoft logs.
AI-written summary · about
chapters (11)
- 0:00Start
- 8:18Threat Hunting with Sysmon
- 12:25Adversary Emulation & Detection Testing
- 14:32Detection Testing & Adversary Emulation
- 15:41Use Case 1
- 20:38Use Case 2
- 26:31sidebar
- 30:27YAY Cobalt Strike!
- 30:45Use Case 3 - Detection & Summary
- 34:50Exchange Compromise Detection
- 35:22Immediate Actions
related talks
32mSysmon Deep Dive: Real Detection Scenarios You Can Reproduce
40mAnd You, Sysmon, Against Me?
40mHunt and Gather: Developing Effective Threat Hunting Techniques
01h 01mSysinternals for Linux
11mSysmon Monitoring Different Way
30mThe SOC Counter ATT&CK
29mDetection Engineering: Defending Networks with Purpose
45mAdvanced Security Operations with Elastic Security