Project Obsidian: Kill Chain Endpoint Forensics Walkthrough
Project Obsidian walks through an end-to-end endpoint forensic investigation, reconstructing attacker actions using MFT, Prefetch, and Shimcache artifacts.
Summary
This talk covers industrial control systems security and critical infrastructure protection.
(AI summary — Claude Haiku)
Related talks
Blue Team Village·18 min
Project Obsidian
Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.
Blue Team Village·43 min
Mike Cohen
Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.
Blue Team Village·9 min
Whitney Champion
Demonstrates using Osquery SQL syntax to query endpoint state and investigate security incidents during the OpenSOC defense CTF.