My Detecting Command and Control Frameworks via Sysmon and Windows Event Logging webcast just posted.

https://www.youtube.com/watch?v=x7xXEyTWgrs&list=PLs4eo9Tja8bj3__-glm8g0Bamd5kYm1SU

Here's the abstract: Prevention eventually fails. Bypassing tools such as Windows Defender Antivirus may be challenging, but it can be done. What then? What's left? Command and control (C2) frameworks such as Cobalt Strike, Sliver, and Metasploit typically leave telltale signs of their presence. This talk will largely be demo-based, showing how to analyze Windows event logs (including Sysmon logs) to hunt for traces left behind by modern C2 frameworks.