Blue Team Village·9 min
Introduces the DEF CON Safe Mode Blue Team Village track sessions, OpenSOC CTF, and community workshops.
blue-teamdefensecommunity
DEF CON Safe Mode/Blue Team Village across years
Blue Team Village Safe Mode
Virtual (Discord and Twitch) · 6-9 August 2020 · 22 talks
Blue Team Village focuses on defensive cybersecurity operations, incident response, network monitoring, and security tooling. Talks cover purple team adversary simulation, endpoint detection engineering, forensic tool demos for the OpenSOC CTF, and real-world breach investigations.
1–21 of 21 talks / 22
Blue Team Village·52 min
Jake Smith · Jack McDowell
Introduces BLUESPAWN, an open-source active defense and EDR software platform for Windows environments.
edractive-defensewindows+2
Blue Team Village·32 min
Mangatas Tondang
Uncovers popular Not-PowerShell offensive tools and demonstrates how defenders can spot non-PowerShell tradecraft.
powershelldetection-engineeringwindows+1
Blue Team Village·44 min
Lennart Koopmann
Demonstrates deploying and querying Graylog centralized log management for real-time threat investigation in OpenSOC.
grayloglog-managementopensoc+1
Blue Team Village·21 min
Allen Baranov
Recounts how diligent spreadsheet tracking and structured asset management neutralized the NotPetya global outbreak.
incident-responseasset-managementexcel+1
Blue Team Village·1 hr 16 min
Frontline incident response leaders discuss breach triage, common operational mistakes made by victims, and readiness best practices.
incident-responsebreachdigital-forensics+1
Blue Team Village·36 min
ch33r10
Proposes extracting indicators of emulation from cyber threat intelligence to model adversary behaviors more accurately.
threat-inteladversary-emulationcti+2
Blue Team Village·31 min
Tim Johnson
Demonstrates using Kibana to query, visualize, and analyze security event logs during the OpenSOC defense CTF.
kibanaopensocctf+2
Blue Team Village·1 hr 29 min
Introduces the Blue Team Village Meet-a-Mentor initiative connecting cybersecurity veterans with aspiring defenders.
mentorshipcareerdiversity+1
Blue Team Village·20 min
Bashar Shamma
Walks through full packet capture analysis, session reconstruction, and PCAP carving using Moloch in OpenSOC.
molochfull-packet-captureopensoc+1
Blue Team Village·25 min
corvusactual
Recounts the investigation and law enforcement aftermath of an internal keylogger breach traced through TeamViewer logs and OSINT.
incident-responseteamviewerosint+1
Blue Team Village·19 min
Juan Francisco Bolívar · Jose Miguel Marichal
Presents a Python tool to proactively identify typosquatted domains pre-configured against Office 365 infrastructure.
office-365typosquattingphishing+1
Blue Team Village·9 min
Whitney Champion
Demonstrates using Osquery SQL syntax to query endpoint state and investigate security incidents during the OpenSOC defense CTF.
osqueryopensocctf+2
Blue Team Village·37 min
Connor Morley
Explores methods for exploiting, monitoring, and enumerating the UEFI memory space to detect pre-boot firmware persistence.
uefihardwarememory-forensics+1
Blue Team Village·1 hr 5 min
Olaf Hartong · Mauricio Velazco
Presents open-source tooling and methodologies to measure defensive coverage and test detection engineering pipelines.
purple-teamadversary-emulationdetection-engineering+1
Blue Team Village·31 min
JunWei Song · KunYu Chen
Introduces Quark-Engine, an open-source Python malware scoring and analysis framework for Android applications.
androidmalware-analysisreverse-engineering+1
Blue Team Village·1 hr
Holger Unterbrink
Demonstrates Dynamic Data Resolver, an IDA Pro plugin leveraging DynamoRIO to unpack and analyze obfuscated malware.
reverse-engineeringida-prodynamorio+2
Blue Team Village·32 min
Josh
Explains how to write, tune, and inspect Suricata intrusion detection signatures to identify exploit traffic in OpenSOC.
suricataids-ipsopensoc+1
Blue Team Village·33 min
Thinkst Canary
Shows how deception technology and Thinkst Canary tokens generate high-fidelity alerts during unauthorized network traversal.
canary-tokensdeceptionopensoc+1
Blue Team Village·43 min
Mike Cohen
Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.
velociraptorendpoint-forensicsopensoc+1
Blue Team Village·33 min
Zeek Team
Shows how to analyze network traffic, extract protocol metadata, and identify malicious connections using Zeek in OpenSOC.
zeeknetwork-securityopensoc+1