Attack Tactics 7: The logs you are looking for

Join us in the Black Hills InfoSec Discord server here:   / discord   to keep the security conversation going! Reach out to Black Hills Infosec if you need pentesting, threat hunting, ACTIVE SOC, incident response, or blue team services -- https://www.blackhillsinfosec.com/ 00:00 - Preshow Anouncements 06:03 - Introduction and background, JPCert, integration of pen testers, forensics, and defense, questions for business managers 12:37 - How Attack Tactics is trying to bridge the three disciplines, proper settings for command line logging, enabling power shell logging 22:23 - Generating events and finding them with Invoke-expression, Group Policy configurations, and answering questions about system configurations 30:17 - Exchange logging, Sysmon installation, usage, and results, LSASS Dump, Deep Blue CLI, and Logon Tracer 43:26 - Q&A and Closing Thoughts Description: So we went through an attack in the BHIS Webcast, "Attack Tactics 5! Zero to Hero Attack." Then we went through the defenses in a follow-up webcast, "Attack Tactics 6! Return of the Blue Team," and now we need to have a talk about logs. Here is the deal, most of the default logging settings for IIS, Exchange, Active Directory and the workstations would have missed the entire attack. So, let's fix that. In this webcast we will be walking through some configuration changes required in order to detect attacks. We will also show you exactly what those logs will produce when configured properly. Finally, we show you tools like LogonTracer, DeepBlueCLI and some cool basic PowerShell to pull out important information from these logs. John Slides for this webcast can be found here: https://www.blackhillsinfosec.com/wp-... Black Hills Infosec Socials Twitter:   / bhinfosecurity   Mastodon: https://infosec.exchange/@blackhillsi... LinkedIn:   / antisyphon-training   Discord:   / discord   Black Hills Infosec Shirts & Hoodies https://spearphish-general-store.mysh... Black Hills Infosec Services Active SOC: https://www.blackhillsinfosec.com/ser... Penetration Testing: https://www.blackhillsinfosec.com/ser... Incident Response: https://www.blackhillsinfosec.com/ser... Backdoors & Breaches - Incident Response Card Game Backdoors & Breaches: https://www.backdoorsandbreaches.com/ Play B&B Online: https://play.backdoorsandbreaches.com/ Antisyphon Training Pay What You Can: https://www.antisyphontraining.com/pa... Live Training: https://www.antisyphontraining.com/co... On Demand Training: https://www.antisyphontraining.com/on... Educational Infosec Content Black Hills Infosec Blogs: https://www.blackhillsinfosec.com/blog/ Wild West Hackin' Fest YouTube:    / wildwesthackinfest   Active Countermeasures YouTube:    / activecountermeasures   Antisyphon Training YouTube:    / antisyphontraining   Join us at the annual information security conference in Deadwood, SD (in-person and virtually) — Wild West Hackin' Fest: https://wildwesthackinfest.com/ #bhis #infosec