windows-event-logs

Blue Team Village·21 min

• DEF CON
• Blue Team
• Date: Aug 2022
• Location: Las Vegas

Project Obsidian

Project Obsidian details configuring Sysinternals Sysmon to capture critical process creation, network connection, and DLL load events for investigations.

Blue Team Village·22 min

• DEF CON
• Blue Team
• Date: Aug 2022
• Location: Las Vegas

Project Obsidian

Project Obsidian demonstrates using Chainsaw and Sigma rules to rapidly parse gigabytes of Windows event logs and identify malicious artifacts.