Blue Team Village·52 min
John Bambenek
John Bambenek recounts pro bono digital forensics casework, exposing flawed prosecution expert testimony and emphasizing sound forensic methodologies.
dfirdigital-forensicspro-bono+2
DEF CON 29/Blue Team Village across years
Blue Team Village DC29
Paris and Bally's Hotels, Las Vegas · 5-8 August 2021 · 17 talks
Blue Team Village focuses on defensive security operations, digital forensics and incident response (DFIR), multi-cloud posture, threat intelligence pivoting, Velociraptor, and Osquery detection engineering.
1–17 of 17 talks
Blue Team Village·32 min
Renzon Cruz
Renzon Cruz investigates host forensic artifacts left by cloud sync clients (OneDrive, Google Drive, Dropbox), tracing insider data exfiltration.
dfircloud-storageonedrive+2
Blue Team Village·26 min
Henry
Henry delivers an energetic, practical guide to securing multi-cloud environments, eliminating dangling DNS, exposed storage buckets, and IAM privilege sprawl.
multi-cloudcloud-securityiam+2
Blue Team Village·24 min
Drimacus
Drimacus presents research on operating passive Next-Generation Firewalls (NGFWs) alongside existing detection stacks to enhance network threat hunting and visibility.
threat-huntingfirewallsblue-team+1
Blue Team Village·36 min
Defenders explore unconventional log analysis techniques, correlating seemingly unrelated telemetry sources to uncover stealthy enterprise intrusions.
log-analysisthreat-huntingsiem+2
Blue Team Village·45 min
Mark Morowczynski
Microsoft identity expert Mark Morowczynski demystifies modern authentication protocols (SAML, OAuth, OIDC, JWTs) for non-identity security administrators.
authenticationoauthsaml+2
Blue Team Village·30 min
Meisam Eslahi
Meisam Eslahi introduces 'Scope X', a threat hunting methodology designed to discover and defend against entry points outside traditional assessment scopes.
threat-huntingattack-surfacescope-x+2
Blue Team Village·32 min
Rabbit
Rabbit refactors CIA Structured Analytic Techniques (SAT) for cybersecurity, eliminating cognitive bias and improving incident response investigations.
satciathreat-analysis+2
Blue Team Village·10 min
Igal Flegmann
Igal Flegmann introduces SubWatcher, an open-source tool to monitor Azure RBAC assignments, scan subscriptions, and detect unauthorized access paths.
azurerbacsubwatcher+2
Blue Team Village·28 min
Gert-Jan Bruggink
Gert-Jan Bruggink conducts a meta-analysis on industry threat forecasts, evaluating the predictive accuracy of annual vendor cybersecurity predictions.
threat-forecastingmeta-analysiscyber-trends+2
Blue Team Village·56 min
Ch33r10 · Jorge Orchilles
Ch33r10 and Jorge Orchilles turn standard threat reports into actionable intelligence, demonstrating advanced TTP extraction, adversary emulation, and hunting pivots.
threat-intelligencectittp+2
Blue Team Village·31 min
Charles Rumford
Charles Rumford challenges overly complex network security designs, showing how simplifying routing and segmentation enhances defensive posture.
network-architecturenetwork-securitysegmentation+2
Blue Team Village·49 min
Karl Lovink
Dutch Tax and Customs investigator Karl Lovink uses DNS telemetry and Splunk to detect fraudulent domains abusing agency brands for phishing in real time.
dnsphishingspf+2
Blue Team Village·35 min
Mike Cohen
Velociraptor creator Mike Cohen demonstrates advanced enterprise endpoint forensics and live incident triage using Velociraptor Query Language (VQL).
velociraptordfirendpoint-telemetry+2
Blue Team Village·25 min
Wendy Edwards
Wendy Edwards separates hype from reality in security AI, analyzing where machine learning excels in anomaly detection and where it fundamentally fails.
machine-learningaianomaly-detection+2
Blue Team Village·33 min
muteki
Blue Team Village celebrates the first anniversary of Meet-a-Mentor, sharing lessons learned and stories from mentor-mentee matches in defensive cybersecurity.
mentorshipcareerblue-team-village+2
Blue Team Village·48 min
Sebastian Provost
Sebastian Provost demonstrates using Osquery to complement EDR/XDR systems, writing SQL queries to detect open-source C2 implant payloads on endpoints.
osqueryedrsql+2