Blue Team Village at DEF CON 30 focuses on digital forensics, incident response, threat hunting tradecraft, malware reverse engineering, and defensive tooling.
1–24 of 85 talks / 86
Blue Team Village·23 min
Sarthak Taneja
Sarthak Taneja presents an accessible, real-world approach to threat modeling, showing how everyday risk intuition translates to software and architecture defense.
Blue Team Village·21 min
Gilmar Esteves · Filipi Pires
Gilmar Esteves and Filipi Pires present Horusec, an open-source multi-language static analysis (SAST) tool designed to democratize code security scanning.
Blue Team Village·29 min
Anton Ovrutsky
Anton Ovrutsky demonstrates behavioral detection patterns, static parsing tools, and deobfuscation methods to hunt malicious Office VBA macros.
Blue Team Village·59 min
Matt Scheurer
Matt Scheurer shares battle-tested incident response methodologies, telemetry sources, and fast containment strategies for enterprise defenders.
Blue Team Village·1 hr
Connor Morley
Connor Morley analyzes Windows in-memory injection techniques—including process hollowing and thread hijacking—and how defenders detect them.
Blue Team Village·52 min
Filipi Pires
Filipi Pires demonstrates techniques for dissecting malicious PDF documents, extracting embedded JavaScript, and uncovering hidden exploit streams.
Blue Team Village·18 min
Project Obsidian
Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.
Blue Team Village·50 min
Project Obsidian
Project Obsidian details hunting for malicious scheduled tasks, cron jobs, and stealthy persistence mechanisms across enterprise endpoints.
Blue Team Village·41 min
Project Obsidian
Project Obsidian demonstrates detecting SharpHound and BloodHound reconnaissance by hunting anomalous LDAP queries and Active Directory enumeration patterns.
Blue Team Village·41 min
Project Obsidian
Project Obsidian demonstrates using graph visualization tools to map phishing infrastructure, identify sender anomalies, and correlate multi-stage campaigns.
Blue Team Village·36 min
Project Obsidian
Project Obsidian shows how threat hunters investigate compromises when adversaries clear event logs, leveraging USN journals, volume shadow copies, and memory artifacts.
Blue Team Village·31 min
Project Obsidian
Project Obsidian explains how to extract actionable cyber threat intelligence, TTPs, and indicator clusters from real-time incident investigations.
Blue Team Village·30 min
Project Obsidian
Project Obsidian shares guidelines for translating complex forensic findings into clear, impactful incident reports for leadership and stakeholders.
Blue Team Village·38 min
Project Obsidian
Project Obsidian details the critical initial phase of incident response: defining the blast radius, scoping compromised systems, and setting containment boundaries.
Blue Team Village·34 min
Project Obsidian
Project Obsidian breaks down the Observe-Orient-Decide-Act (OODA) loop applied to real-time incident triage and crisis response.
Blue Team Village·29 min
Project Obsidian
Project Obsidian walks through an end-to-end endpoint forensic investigation, reconstructing attacker actions using MFT, Prefetch, and Shimcache artifacts.
Blue Team Village·46 min
Project Obsidian
Project Obsidian explains forensic preparation and tooling organization to accelerate digital forensics and incident triage workflows.
Blue Team Village·43 min
Project Obsidian
Project Obsidian explores methods for decoding and analyzing heavily obfuscated PowerShell scripts used in initial access payloads.
Blue Team Village·36 min
Project Obsidian
Project Obsidian walks through triaging and reverse engineering high volumes of malicious email attachments and phishing lures.
Blue Team Village·21 min
Project Obsidian
Project Obsidian details configuring Sysinternals Sysmon to capture critical process creation, network connection, and DLL load events for investigations.
Blue Team Village·22 min
Project Obsidian
Project Obsidian demonstrates using Chainsaw and Sigma rules to rapidly parse gigabytes of Windows event logs and identify malicious artifacts.
Blue Team Village·1 hr 5 min
Mark Morowczynski
Microsoft Principal Program Manager Mark Morowczynski examines conditional access, identity integration, and posture management for macOS and Linux on Azure AD.
Blue Team Village·55 min
Meisam Eslahi
Meisam Eslahi presents advanced threat hunting tradecraft to track stealthy adversaries lurking across enterprise infrastructure.
Blue Team Village·17 min
Saurabh Chaudhary
Saurabh Chaudhary demonstrates crafting high-performance, modular YARA rules to detect complex malware variants and streamline threat hunting.
