Скачать или смотреть Applied Purple Teaming - How to Build a Purple Team Lab w/ Kent & Jordan (4-Hours)

This is an edited recording from the June 6th, 2020, 4-hour online training workshop: Applied Purple Teaming: Infrastructure, Threat Optics, and Continuous Improvement w/ Kent Ickler & Jordan Drysdale (4-Hours)

For slides, labs, resources: https://github.com/DefensiveOrigins/A...

New blog post with supplemental information: https://www.blackhillsinfosec.com/how...

0:00 - I Heard We Were Good
2:31 - Course Objectives
4:53 - Course Components
6:59 - Applied Purple Teaming Course Matrix
12:41 - Endpoint Optics Sysmon Audit Policy
14:09 - What Is Sysmon
37:49 - Audit Policy
38:59 - Windows Event Collection
46:45 - We Have Some Questions
1:01:08 - Break Time 01
1:11:40 - Back To Work
1:13:25 - Event Handlers WEC / WEF Event Subscriptions
2:06:10 - I Break For Questions (Break Time 02)
2:18:11 - Log Shipping Event Ingestors
2:36:17 - Moar Questions
3:00:32 - Break Time 03
3:13:06 - Back To Work
3:26:42 - Atomic Purple Team / APT Lifecycle Lifecycle
3:46:22 - Final Questions And Thoughts

Build your own Purple Team lab in 4 hours (or less!)
Implement Sysmon with the modular configuration
Configure and launch meaningful audit policies
Deploy the WEF / WEC model of event collection
Install WinLogBeat to push logs to....
The Hunting ELK (HELK)

Join the BHIS Discord Channel to ask questions about the labs or training:   / discord  
(Use the training-prep-questions channel)

For slides, labs, resources: https://github.com/DefensiveOrigins/A...

New blog post with supplemental information: https://www.blackhillsinfosec.com/how...

Kent Ickler & Jordan Drysdale are teaching a paid ($395) 3-day, 5.5-Hour sessions (16.5-hours), training course on — Applied Purple Teaming — June 30-July 2 | Learn more: https://wildwesthackinfest.com/online...

Please send your questions, comments and feedback to: [email protected]