Tool

BSides talks featuring Sysmon

87 talks mention this tool across 41 BSides chapters.

Talks featuring Sysmon

Post-Exploit Threat Modeling with ATT&CK

BSides Delaware · 2016

Open →2016-11

BSides Iowa 2018: "Threat Hunting Windows Event Logs w/ Powershell"

Open →2018-04

Threat Hunting On Linux And Mac With Auditbeat System Module

BSides Luxembourg · 2019

Technical DFIR Detection Engineering Blue Talk

Open →2019-11

Windows 10 Forensics

BSides Warsaw · 2018

Open →2018-10

Keynote - Jeff Banner

Open →2019-09

Threat Hunting by Dhruv Majumdar

BSides Edmonton · 2018

Open →2018-09

Don't Boil the Ocean: Using MITRE ATT&CK to Guide Hunting Activity

BSidesSF · 2019

Technical Blue Talk

Open →2019-03

Quick And Easy Forensic Timelines Via Sysmon, WEF, And ELK

BSides Munich · 2019

Technical DFIR Detection Engineering Blue Talk

Open →2019-03

Log All The Things! Proactive Forensics using Log Analysis

Aaron Beuhring Kyle Salous

BSides DC · 2015

Open →2015-11

Using DeTT&CT and the MITRE ATT&CK Framework to Assess Your Security Posture

David Branscome

BSides Knoxville · 2022

Technical Detection Engineering Threat Modeling Intermediary Blue Demo Talk

Open →2022-05

White Collars & Black Hats: Bitcoin, Dark Nets and Insider Trading by Ken Westin

BSides Edmonton · 2018

Open →2018-09

Windows Event Forwarding and OSSEC — You can do this!

BSides Augusta · 2018

Technical DevSecOps Blue Talk

Open →2018-11

Let's Start Over!

Craig Chamberlain

BSides DC · 2018

Open →2018-11

Cobalt Strike – A Defender's Perspective

BSides Islamabad · 2020

Technical Blue Talk

Open →2020-11

EDR Internals for macOS and Linux - Kyle Avery

BSides SATX · 2024

Technical Technical Deep-dives Talk

Open →2024-06

Unpacking Impacket: Detect remote execution of offensive tools

BSides SLC · 2022

Technical Active Directory DFIR Detection Engineering Blue Talk

Open →2023-01

ELK: Not P.O.S.

BSides Toronto · 2014

Open →2014-12

Open Source GitOps for Detection Engineering

BSides Las Vegas · 2023

Technical Detection Engineering DevSecOps Blue Demo Talk

Open →2023-10

BSides Toronto 2019 Anton Ovrutsky

Open →2019-10

Think You're Stealthy? How to Detect Attacks in AD

Rachit Arora Sai Sathvik Ruppa Aakash Raman

BSides Charm · 2025

Technical Active Directory DFIR Detection Engineering Intermediary Blue Talk

Open →2025-05

From Kali and a Couple of VMs to NextGen Home Lab - An Approach to Practice and Develop your Skills

BSides SATX · 2020

Open →2020-08

Making a State-Backed Implant Invisible: A New Blind Spot in Modern A/V & HIDS Solutions

Dimitrios Bougioukas

BSides Athens · 2018

Technical Advanced Red Technical Deep-dives Demo

Open →2018-08

Testing Endpoint Security Solutions with Atomic Red Team

BSides Asheville · 2018

Technical Detection Engineering Threat Modeling Intermediary Blue Purple Methodology Demo

Open →2019-03

When a Security Architect Writes an Application

BSides Charleston · 2014

Technical Web AppSec Talk

Open →2014-11

MS SQL Super Quality Logs

BSides Perth · 2023

Technical Detection Engineering Threat Intel Intermediary Blue Methodology Technical Deep-dives Talk

Open →2023-08

Red and Blue Ping Pong: Living Off the Land in Windows Attack and Defense

Lee Kagan Anton Ovrutsky

BSides Toronto · 2017

Technical Active Directory Malware Analysis Purple Demo Talk

Open →2018-01

Spotting The Adversary Using The ATT&CK Matrix: A Practical Approach

BSides Bristol · 2019

Technical Detection Engineering Threat Intel Blue Talk

Open →2019-07

Threat Hunting: Out of the Gate with Windows Logs

Greg Longo Brian Gardiner

BSides Peru · 2019

Technical Detection Engineering Malware Analysis Threat Intel Intro Blue Technical Deep-dives Talk

Open →2019-07

Reverse-Shell Fallacy: An introduction into defence evasion techniques

BSides Joburg · 2024

Technical Red Talk

Open →2024-08

Purple Teaming Cloud Identity Simulation Labs for Red and Blue teams

BSides Dallas/Fort Worth · 2022

Technical Cloud IAM Detection Engineering Threat Modeling Purple Technical Deep-dives Demo Talk

Open →2022-11

BSidesAugusta 2014 Tim Crothers - Techniques for Fast Windows Investigations

Open →2014-09

Tony Lambert - Spotting Lateral Movement with Endpoint Data

BSides Augusta · 2019

Open →2019-10

Security Operations with Velociraptor

Eric Capuano Whitney Champion

Open →2023-09

Tactics, Techniques and Procedures - Building and Running a Blue Team from Scratch

Abhishek Tripathi

BSides SATX · 2018

Technical Detection Engineering Threat Intel Blue Talk

Open →2018-10

Ransomware Emulation Done Right

Shreyas Rami Shaun Jones

BSides Las Vegas · 2022

Technical Detection Engineering Malware Analysis Threat Intel Purple Case Studies and Incidents Analysis Talk

Open →2022-09

Brandon George - Hunt Like You Mean It

BSides Columbus

Open →2020-08

Windows Management Instrumentation for Good and Evil

BSides Delaware · 2017

Open →2017-11

Detect the Undetectable with Sysmon and PowerShell Logs

Dimitrios Margaritis

BSides Athens · 2017

Technical Detection Engineering Malware Analysis Threat Intel Blue Talk

Open →2017-10

Applying Sysmon-type Filtering to Elastic Agent Process Auditing

BSides Augusta · 2023

Technical DFIR Detection Engineering Blue Demo Talk

Open →2023-10

The Threat Hunting Solution You Might Not Have Expected

BSides Buffalo · 2022

Open →2022-06

BSides DC 2019 - Digital Canaries in Coal Mines: Detecting Adversarial Enumeration with DNS & AD

BSides DC · 2019

Technical Active Directory Talk

Open →2019-10

A Journey Through MITRE Evaluation - Alex Davies

BSides Cymru Wales · 2019

Open →2019-10

Xavier Mertens - All Your Logs Are Belong To You!

BSides London · 2014

Open →2014-09

Host-Hunting on a Budget

BSides Augusta · 2019

Technical DFIR Detection Engineering Threat Intel Blue Talk

Open →2019-10

Sysmon Monitoring Different Way

BSides Vancouver · 2021

Tooling Demo Talk

Open →2021-06

What is eBPF and Why Should You Care!

BSides Athens · 2022

Technical Detection Engineering Reverse Engineering Tooling Advanced Blue Red Talk

Open →2023-06

Microsoft Quick Assist

BSidesROC · 2025

Open →2025-03

Sysmon or it Didn't Happen

Gerard Johansen

BSides Charm · 2024

Technical DFIR Detection Engineering Blue Talk

Open →2024-06

Robust Defense for the Rest of Us

BSides Las Vegas · 2017

Technical Detection Engineering Network Security Threat Modeling Blue Talk

Open →2017-08

Wes Lambert - Endpoint Excavation: Digging Through Host Artifacts with Velociraptor

BSides Augusta · 2021

Technical Blue Talk

Open →2021-10

BSidesCharm 2024 - Defenders can use ATT&CK! Oh really? - Lex Crumpton

Open →2024-06

What the Log?! So Many Events, So Little Time...

BSides Luxembourg · 2019

Open →2019-11

Purple Teaming 301 – Free Attack Simulation and Control Validation via Atomic Red Team

BSides Charm · 2024

Technical Detection Engineering Threat Modeling Purple Talk

Open →2024-06

From Noise To Insight: Supercharge Your SOC With Automated Alert Correlation

Anicet Fopa Tchoffo

Open →2024-07

Visualize Windows Events using Python3 & Neo4j

Tasos Chatziefstratiou

BSides Athens · 2020

Technical Blue Demo Talk

Open →2020-06

Nicholas Gobern - Good Behavior is it's own reward

Nicholas Gobern

Open →2023-10

BSides SLC · 2015

Open →2015-04

Fantastic Clear-Text Passwords And Where To Collect Them

BSides Munich · 2025

Technical Active Directory Malware Analysis Threat Intel Blue Case Studies and Incidents Analysis Talk

Open →2026-02

Have Lab, Now What?

Kelsey Seymour Aaron Everson

Open →2024-06

DCO and Data Science: Best Friends Forever

BSides Augusta · 2022

Technical Blue Demo Talk

Open →2022-10

Keeping up with the Jones's and other APT threats

Kenneth Inkster

Technical DFIR Detection Engineering Malware Analysis Threat Intel Blue Talk

Open →2020-12

Operationalizing Purple Team

Jorge Orchilles

BSides SATX · 2021

Technical Purple Talk

Open →2021-06

Shelly Giesbrecht: The Trouble With Ransomware

Shelly Giesbrecht

BSides Calgary · 2020

Open →2020-12

Building the Panopticon: Centralized Logging and Alerting With Free Tools

BSidesROC · 2018

Technical Blue Talk

Open →2018-04

BSidesCharm 2022 - Log4j From The Trenches - Max Thauer

Open →2022-07

Escapades in DFIR, An Incident Responder's Reflections

BSides RDU · 2022

Career War Stories DFIR Detection Engineering Threat Intel Blue Purple Talk

Open →2023-03

Wes Lambert - Augmenting the (Security) Onion: Facilitating Enhanced Detection and Response

Technical DFIR Detection Engineering Threat Intel Blue Talk

Open →2019-10

Detecting the Elusive: Active Directory Threat Hunting

BSides Charm · 2017

Technical Active Directory Detection Engineering Kerberos Blue Technical Deep-dives Talk

Open →2021-05

Actioning ATT&CK

BSides Delaware · 2018

Technical Detection Engineering Threat Modeling Purple Technical Deep-dives Talk

Open →2018-11

Ransomware Threat Hunting: Commonly Overlooked Areas for Stopping Ransomware Intruders - Allan Liska

Open →2022-09

Building a Sawmill: Processing Logs with Security Onion

BSides Peru · 2024

Technical DFIR Detection Engineering Threat Intel Blue Demo Talk

Open →2024-08

Sharing Open Datasets with the World to Develop Detections from Home | Roberto Rodriguez

Roberto Rodriguez

BSides Delhi 2020

Community Technical DFIR Detection Engineering Threat Modeling Talk

Open →2020-11

Building My Ultimate Home Detection Lab - Oliver Creed

BSides Lancashire

Open →2024-06

Supercharge Your SOC with Sysmon

Chris Lee Matthew Giannetto

BSides Philly · 2018

Technical DFIR Detection Engineering Malware Analysis Blue Talk

Open →2018-11

Tom Webb - Incident Response Awakens

BSides Augusta · 2016

Open →2016-09

Catching More Files - Spotting the Adversary with Honey Techniques

BSidesROC · 2023

Open →2024-09

Yeet the Leet with Osquery

Sebastiaan Provost

BSides Newcastle · 2021

Technical Detection Engineering Malware Analysis Threat Intel Talk

Open →2021-10

What the deuce: Strategies for splitting your alerts

Open →2017-08

Emulate.Go: Adversary Emulation for CTI Analysts

BSides Toronto · 2020

Technical Detection Engineering Threat Intel Purple Demo

Open →2021-11

T1 08 I Thought I Saw a |-|4x0.-, Thomas V. Fischer (@fvt)

Thomas V. Fischer

BSides Athens · 2017

Open →2017-10

Illuminate the Grid: Building Telemetry Through Purple Teaming

BSides Charlotte · 2026

Technical Detection Engineering Threat Intel Threat Modeling Purple Case Studies and Incidents Analysis Methodology Talk

Open →2026-04

BSidesCharm - 2018 - Adam Mathis - Using Atomic Red Team to Test Endpoint Solutions

Open →2021-05

Malware Persistence in Windows

BSides Calgary · 2022

Technical Malware Analysis Talk

Open →2022-12

The Declarative Future

Technical Container Security Detection Engineering Web AppSec Keynote

Open →2021-05

Tony Drake Incident Response for the Overwhelmed, Understaffed, and Unprepared

Career DFIR Talk

Open →2021-08

What Did the SIEM Say?

Shawn Thomas JR Presmy

BSides Charm · 2019

Technical Detection Engineering Threat Intel Blue Talk

Open →2021-05

Effective Monitoring for Operational Security

Russell Mosley Ryan St. Germain

Technical Detection Engineering Threat Intel Blue Talk

Open →2021-05