Youtor
Threat Hunting with Sysmon For Security Operations Center TryHackMe Sysmon
>> YOUR LINK HERE: ___ http://youtube.com/watch?v=2xA5Sm0Xdd0
This video on Threat Hunting with Sysmon in Security Operations on TryHackMe explains using Sysmon, a Windows monitoring tool, for threat detection within a Security Operations Center (SOC). It covers Sysmon’s configuration, key event types (e.g., process creation, network connections), and deployment. A practical walkthrough in the TryHackMe environment demonstrates analyzing Sysmon logs to trace potential threats, such as malicious files or network anomalies. It emphasizes customizing Sysmon rules for enhanced detection and discusses filtering techniques to streamline threat identification, making Sysmon a crucial tool for incident response and forensic analysis. • ****** • Receive Cyber Security Field, Certifications Notes and Special Training Videos • / @motasemhamdan • ****** • TryHackMe Sysmon • https://tryhackme.com/room/sysmon • Answers • https://motasem-notes.net/threat-hunt... • **** • Store • https://buymeacoffee.com/notescatalog... • Patreon • / motasemhamdan • Instagram • / mastermindstudynotes • Google Profile • https://maps.app.goo.gl/eLotQQb7Dm6ai... • LinkedIn • [1]: / motasem-hamdan-7673289b • [2]: / motasem-eldad-ha-bb42481b2 • Instagram • / mastermindstudynotes • Twitter • / manmotasem • Facebook • / motasemhamdantty • **** • 0:00 - Introduction to Threat Hunting with Sysmon • 0:15 - Overview of Sysmon and Its Uses • 1:04 - Sysmon Logs and SIEM Integration • 1:41 - Configuring Sysmon with a Configuration File • 2:32 - Types of Events Detected by Sysmon • 5:14 - DNS Event Monitoring • 5:28 - Practical Scenario Introduction • 7:19 - Downloading and Setting Up Sysmon • 8:55 - Exploring Example Sysmon Configuration Files • 10:12 - Reviewing Process Creation Rules • 12:36 - File Creation Event Rules • 13:13 - Registry Event Monitoring • 14:32 - Creating Custom Sysmon Rules • 15:34 - Examining Sysmon Logs in Event Viewer • 18:36 - Filtering Logs by Event ID • 21:18 - Using PowerShell for Log Analysis • 22:22 - Detecting Remote Threads in Sysmon • 24:03 - Metasploit Detection through Network Connections • 26:13 - Analyzing Event Details with PowerShell • 28:20 - Detecting Mimikatz Activity • 30:40 - Challenge Introduction: Investigating Sysmon Logs • 31:15 - Investigation 1: USB Device Analysis • 33:10 - Device Name and Access Read Detection • 35:47 - Investigation 2: HTML File Evasion and Alternate Data Streams • 38:04 - Detecting Payload Path and IP Address of Adversary • 39:34 - Investigation 3: Persistence and Registry Modifications • 41:54 - Detecting PowerShell Launch Code • 43:14 - Investigation 4: Botnet Detection and C2 Communication • 47:34 - Identifying IP and Port of the C2 Server • 49:22 - Final Thoughts on Sysmon and Threat Hunting • 50:11 - Creating Custom Rules and Expanding Sysmon Detection • 50:36 - Conclusion and Next Steps
#############################
