Windows Event Logs -- Zero 2 Hero

Presented at DerbyCon 7.0 Legacy (2017), Sept. 24, 2017, 10 a.m. (50 minutes)

"In this talk you will be shown logging, consuming, and analyzing (on a small & large scale) WMI tracing logs, Windows Event Logs, PowerShell logs, Cuckoo malware sandbox Windows logs (to give yourself new ideas/hunts), and more. Everything shown is free (granted you have 1-2+ available Windows Licenses) and can be setup and deployed in less than a day (Zero 2 Hero). You will have a demonstration of immediate benefits for active/historical breach detection, sysadmin, helpdesk, and forensics for windows hosts. Demonstrations will also be shown for things, that would be a supplement to Sysmon, such as once an ""entity"" already has DomainAdmin creds ( ie: detecting https://www.harmj0y.net/blog/activedirectory/the-most-dangerous-user-right-you-probably-have-never-heard-of/ ). Slides and scripts will be released immediately after the presentation (git commit+push cronjob)." Nate - Utility man who, in his short 4 yr career in infosec, has worked on everything from engineering a 40Gbps+ Bro solution to incident response to database/SIEM implementation+design. Adam - Bio will fit in one line... a malware reverse engineer and incident responder. Nate - @neu5ron Adam - @acalarch

Presenters:

• Adam Swan
• Nate Guagenti

Links:

• https://www.derbycon.com/sunday-schedule/#event-199
• https://infocon.org/cons/DerbyCon/DerbyCon 7 2017/Windows Event Logs Zero 2 Hero Nate Guagenti Adam Swan.mp4

Similar Presentations:

• DerbyCon 7.0 Legacy (2017) / Introducing DeepBlueCLI v2, now available in PowerShell and Python
• BruCON 0x09 (2017) / Getting the Most Out of Windows Event Logs Workshop
• 44CON 2019 / Logging Made Easy Workshop Workshop