Season 2 Episode 1: Resources

14 Jul 2021

Great to see so many of you on the sessions today - thanks for tuning in and getting stuck into the interactive side. It's really good knowing we have so many keen threat hunters out there!

Here's a collection of resources from Ashek - please do let us know if there's anything else you want to know.

OS hardening & GPO's: https://www.ncsc.gov.uk/collection/end-user-device-security/platform-specific-guidance/eud-security-guidance-windows-10-1809
Extra logging: https://community.sophos.com/kb/en-us/133907

Add "Other Object Access Events" & "Logon" as to your changes as well
A good starting Sysmon config: https://github.com/SwiftOnSecurity/sysmon-config/blob/master/sysmonconfig-export.xml
Common MITRE ATT&CK TTP's and Result enrichment queries used:

https://community.sophos.com/intercept-x-endpoint/i/xdr/hunting-in-the-data-lake-then-pivoting-to-the-device-for-details

https://community.sophos.com/intercept-x-endpoint/i/att-ck/live-discover-mitre-att-ck-classification-and-hunting

Look forward to seeing you all tomorrow for session 2!

Parents

Salim Alaeddine over 3 years ago

Hello Nick, we have benefited a lot from season 1 & eager to engage in season 2. We are late in joining & want to follow up on session 1 & 2 that we missed on.

where can we see the recording of session 1 & 2. Many thanks & appreciate all the great work that you & the team are doing.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Nick Fisher over 3 years ago in reply to Salim Alaeddine

Hi Salim,

We'll have all of the session recordings available later this week - I'll post a link in this forum when they're available for you to access and review.

Nick
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
R R over 3 years ago in reply to Nick Fisher

Hi Nick,

On playing back the session2 video1 you can hear you and Ben talking over Ashek.
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel
Nick Fisher over 3 years ago in reply to R R

Thanks for letting us know about this - we've updated the video on the OnDemand page
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Comment

Nick Fisher over 3 years ago in reply to R R

Thanks for letting us know about this - we've updated the video on the OnDemand page
- Cancel
- Vote Up 0 Vote Down
- More
- Cancel

Children

No Data