Blue Team Village·18 min
Project Obsidian
Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.
velociraptorvqldfir+2
Project Obsidian
15 talks in the archive.
Filters+
Loading filters…
1–15 of 15 talks · loading…
Blue Team Village·50 min
Project Obsidian
Project Obsidian details hunting for malicious scheduled tasks, cron jobs, and stealthy persistence mechanisms across enterprise endpoints.
scheduled-taskspersistencethreat-hunting+2
Blue Team Village·41 min
Project Obsidian
Project Obsidian demonstrates detecting SharpHound and BloodHound reconnaissance by hunting anomalous LDAP queries and Active Directory enumeration patterns.
bloodhoundactive-directorythreat-hunting+2
Blue Team Village·41 min
Project Obsidian
Project Obsidian demonstrates using graph visualization tools to map phishing infrastructure, identify sender anomalies, and correlate multi-stage campaigns.
phishingthreat-huntinggraph-analysis+2
Blue Team Village·36 min
Project Obsidian
Project Obsidian shows how threat hunters investigate compromises when adversaries clear event logs, leveraging USN journals, volume shadow copies, and memory artifacts.
threat-huntinglog-clearinganti-forensics+2
Blue Team Village·31 min
Project Obsidian
Project Obsidian explains how to extract actionable cyber threat intelligence, TTPs, and indicator clusters from real-time incident investigations.
threat-intelligencectiincident-response+2
Blue Team Village·30 min
Project Obsidian
Project Obsidian shares guidelines for translating complex forensic findings into clear, impactful incident reports for leadership and stakeholders.
incident-responsereportingexecutive-briefing+2
Blue Team Village·38 min
Project Obsidian
Project Obsidian details the critical initial phase of incident response: defining the blast radius, scoping compromised systems, and setting containment boundaries.
incident-responseincident-scopingcontainment+2
Blue Team Village·34 min
Project Obsidian
Project Obsidian breaks down the Observe-Orient-Decide-Act (OODA) loop applied to real-time incident triage and crisis response.
incident-responseooda-loopdecision-making+2
Blue Team Village·29 min
Project Obsidian
Project Obsidian walks through an end-to-end endpoint forensic investigation, reconstructing attacker actions using MFT, Prefetch, and Shimcache artifacts.
endpoint-forensicskillchainmft+2
Blue Team Village·46 min
Project Obsidian
Project Obsidian explains forensic preparation and tooling organization to accelerate digital forensics and incident triage workflows.
incident-responseforensicsinvestigation+2
Blue Team Village·43 min
Project Obsidian
Project Obsidian explores methods for decoding and analyzing heavily obfuscated PowerShell scripts used in initial access payloads.
powershelldeobfuscationmalware-analysis+2
Blue Team Village·36 min
Project Obsidian
Project Obsidian walks through triaging and reverse engineering high volumes of malicious email attachments and phishing lures.
phishingmalware-analysisreverse-engineering+2
Blue Team Village·21 min
Project Obsidian
Project Obsidian details configuring Sysinternals Sysmon to capture critical process creation, network connection, and DLL load events for investigations.
sysmontelemetryendpoint-detection+2
Blue Team Village·22 min
Project Obsidian
Project Obsidian demonstrates using Chainsaw and Sigma rules to rapidly parse gigabytes of Windows event logs and identify malicious artifacts.
chainsawwindows-event-logssigma+2