endpoint-forensics

Blue Team Village·18 min

• DEF CON
• Blue Team
• Date: Aug 2022
• Location: Las Vegas

Project Obsidian

Project Obsidian demonstrates writing custom Velociraptor Query Language (VQL) artifacts to hunt for IOCs and collect forensic evidence across thousands of endpoints.

Blue Team Village·29 min

• DEF CON
• Blue Team
• Date: Aug 2022
• Location: Las Vegas

Project Obsidian

Project Obsidian walks through an end-to-end endpoint forensic investigation, reconstructing attacker actions using MFT, Prefetch, and Shimcache artifacts.

Blue Team Village·9 min

• DEF CON
• Blue Team
• Date: Aug 2020
• Location: Online

Whitney Champion

Demonstrates using Osquery SQL syntax to query endpoint state and investigate security incidents during the OpenSOC defense CTF.

Blue Team Village·43 min

• DEF CON
• Blue Team
• Date: Aug 2020
• Location: Online

Mike Cohen

Demonstrates endpoint hunting, artifact collection, and forensic querying using Velociraptor VQL in OpenSOC.