My Detecting Command and Control Frameworks via Sysmon and Windows Event Logging webcast just posted.

https://www.youtube.com/watch?v=x7xXEyTWgrs&list=PLs4eo9Tja8bj3__-glm8g0Bamd5kYm1SU

Here's the abstract: Prevention eventually fails. Bypassing tools such as Windows Defender Antivirus may be challenging, but it can be done. What then? What's left? Command and control (C2) frameworks such as Cobalt Strike, Sliver, and Metasploit typically leave telltale signs of their presence. This talk will largely be demo-based, showing how to analyze Windows event logs (including Sysmon logs) to hunt for traces left behind by modern C2 frameworks.

@Nerdpyle @carmencr @fpieces @ian_infosec @ajohnsocyber @khaxan @bjsplash @RichLang @zarchasmpgmr @Sqlcheesecake @blemley @markmorow

Sorry to bring up a sad subject. The edgelord is deleting inactive accounts, including those of deceased people.

https://mashable.com/article/twitter-purge-inactive-accounts-deceased-user-concerns

Semi-random photo #25. I spotted this walking home from my office today

Here's the backstory: https://www.pressherald.com/2023/04/07/police-chief-to-update-portland-council-on-response-to-neo-nazi-march/

I'm testing Sysmon 14.15, including FileBlockShredding.

https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon

It works well against Sysinternals' sdelete.

But: it does not prevent Metasploit's sdel post module from doing the same thing