A Sysmon Event ID Breakdown – Updated to Include 26, 27 and 28!!
Jordan Drysdale // UPDATES! December 22, 2022 So – there have been some changes to Sysmon and this blog needed polishing. The latest Event IDs and descriptions are now included for […]
Sysmon
Webcast: Let’s Talk About ELK Baby, Let’s Talk About You and AD
BHIS’ Defensery Driven Duo Delivers Another Delectable Transmission! We know you are worried about your networks. After hours of discussion, we’ve come to the realization that some of our dedicated […]
Podcast: Play in new window | Download
Subscribe: Apple Podcasts | Spotify | Amazon Music | RSS
Webcast: Group Policies That Kill Kill Chains
On this webcast, we’ll guide you through an iterative process of building and deploying effective and practical Group Policy Objects (GPOs) that increase security posture. Slides for this webcast can […]
Getting Started With Sysmon
John Strand // In this blog, I want to walk through how we can set up Sysmon to easily get improved logging over what we get from normal (and just […]
Webcast: Windows logging, Sysmon, and ELK
Click on the timecodes to jump to that part of the video (on YouTube) Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_WindowsLogginSysmonELK.pdf 4:36 Problem Statement and Executive Problem Statement 9:00 […]
Webcast: Implementing Sysmon and Applocker
Click on the timecodes to jump to that part of the video (on YouTube) Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-content/uploads/2020/09/SLIDES_ImplementingSysmonAppLocker.pdf 5:03 Introduction, problem statement, and executive problem […]
Active Directory Best Practices to Frustrate Attackers: Webcast & Write-up
Kent Ickler & Jordan Drysdale // BHIS Webcast and Podcast This post accompanies BHIS’s webcast recorded on August 7, 2018, Active Directory Best Practices to Frustrate Attackers, which you can view below. […]
How To Do Endpoint Monitoring on a Shoestring Budget – Webcast Write-Up
Joff Thyer & Derek Banks // Editor’s Note: This is a more in-depth write-up based on the webcast which can be watched here. As penetration testers, we often find ourselves […]