PowerSIEM - Analyzing Sysmon Events with PowerShell - Dynamic Malware Analysis

00:00 - Intro
00:36 - Talking about PowerSIEM
01:40 - Installing Sysmon with Florian Roth's default config
03:30 - Showing what PowerSIEM does by running it and opening a command prompt, browser, etc
04:50 - Explaining the PowerSIEM Script, how it works, and all the current sysmon events
07:50 - Setting breakpoints in Powershell ISE
08:48 - Adding data to the Registry Set event
11:58 - Showing just running a SysInternals tool creates a registry key for accepting the EULA
13:45 - Running Impackets PSEXEC, to find out Defender stopps it. Running Sysinternals Version and showing defender allows it.
14:50 - Using PowerSIEM to show how the Sysinternals PSEXEC works.
15:50 - Disabling AV, Running impacket's version again to show how it differs
17:35 - Creating a Cobalt Strike Beacon and showing some alerts
18:25 - Hiding network connection alerts in PowerSIEM by just commenting out the Write Alert line
20:00 - Running a shell command in CobaltStrike and showing what it looks like in PowerSIEM
21:00 - Running Mimikatz and talking about its sacrificial process, pipes, and mimikatz accessing LSASS
24:05 - Showing not everything will be logged

[saurabhshinde]

Thank you so much IppSec for such short and informative videos. These videos motivate us to try out these stuff on local VM. Btw watched twitch stream as well.. :)

[mindtropy]

Great content! Nice to see you share stuff on mixed subjects

[-Giuseppe]

That's pretty funny. We had just yesterday an IR case with Cobalt Strike DNS Beacon. Thanks for sharing this!

[sechvnnull]

Hey, love the content on defensive security! Your twitch stream on sysmon was awesome. Unfortunately, I don't get to watch live as I'm swamped with homework. But I truly appreciate the videos on defensive security, it helps in many different important if not more important ways then offensive!

[blabla-grtj]

Thank you so much Ippsec, don't have enough words to thank you for these informative videos!🙏🙏

[beyblade]

Thanks for this I'll try to integrate this with my Opensource NSM

[guyashkenazi]

hii ippsec love the u have twitch, about the time i use to see that all the time, just sad that not on my UTC when im free on Israel, ur smart and love to see ur explane on some things.
hope to be some day like you, for now im n00b.

[wkppp]

Finally! Ipp starts to brach off from htb!🎉

[skywlker]

I hope you make more BLUE team content. Thanks

[maclie]

How many programming do I need to learn to became full cybersecurity professional or to reach the level your

[mzynehtb]

Thank you so much for sharing. It would be great if you could do more blue team videos.

[takeshikovacs]

great stuff! it it was to go into a SIEM like Splunk I think it would be good to add timestamps to each event as otherwise it would be indexed with the index/current time rather than the actual event time

[pensee]

I stumbled a bit on the powershell execution scope.
Pay attention to the execute permission.

[domnovoi]

Hey mate love your content please never stop! Could you possibly link your git project, and Florian's in the description?

[cookiemaster]

Brilliant work is it possible to capture the results as csv?