- 31
- 30 465
bluecapesec
United States
เข้าร่วมเมื่อ 4 ม.ค. 2020
CyberSecurity: Courses • Workshops • Virtual Labs • Content Development
Blue Cape Security, LLC provides high-quality cyber security training services for individuals and teams alike, based on sharing everything that we've learned from years of working in the trenches responding to cyber threats.
www.bluecapesecurity.com
Blue Cape Security, LLC provides high-quality cyber security training services for individuals and teams alike, based on sharing everything that we've learned from years of working in the trenches responding to cyber threats.
www.bluecapesecurity.com
Join Now: Jumpstart Your DFIR Journey Webinar Series!
Ready to kickstart your DFIR journey? Join our upcoming webinar series with Markus Schober and gain insights into current threats, incident response and digital forensic concepts, and building effective DFIR environments.
Over three detailed sessions, you’ll learn what it takes to perform incident response to combat current threats, explore forensic artifacts that are critical in every investigation, and discover how to build both basic and advanced DFIR labs within enterprise environments.
Register now to get access to all sessions and elevate your cybersecurity skills!
tinyurl.com/dfir-webinars
📆 Webinar Schedule:
1. Understanding the Threat Landscape and DFIR Fundamentals | August 7
2. Cyber Threats and Important Forensic Concepts | August 14
3. Essential Tools and Applications for DFIR Environments | August 21
#cybersecurity #dfir #enterprisesecurity #infosec
Over three detailed sessions, you’ll learn what it takes to perform incident response to combat current threats, explore forensic artifacts that are critical in every investigation, and discover how to build both basic and advanced DFIR labs within enterprise environments.
Register now to get access to all sessions and elevate your cybersecurity skills!
tinyurl.com/dfir-webinars
📆 Webinar Schedule:
1. Understanding the Threat Landscape and DFIR Fundamentals | August 7
2. Cyber Threats and Important Forensic Concepts | August 14
3. Essential Tools and Applications for DFIR Environments | August 21
#cybersecurity #dfir #enterprisesecurity #infosec
มุมมอง: 67
วีดีโอ
CyberLabHero - Virtual Labs Platform Demo
มุมมอง 1112 หลายเดือนก่อน
Introducing CyberLabHero by Blue Cape Security - the ultimate stand-alone platform for training providers and educational institutions. CyberLabHero revolutionizes virtual lab accessibility, allowing you to offer immersive lab environments directly through the browser on an on-demand basis. With CyberLabHero, you can: - Easily Integrate: Compatible with existing Learning Management System (LMS)...
Malicious PowerShell Execution Techniques
มุมมอง 3464 หลายเดือนก่อน
Ever wondered what those PowerShell commands in your logs mean? Learn how PowerShell is being used by threat actors to execute malicious payloads. We'll start by demonstrating simple examples and end with how real world CobaltStrike payload (beacons) is being executed and can be analyzed. This session is a free preview of our comprehensive "Enterprise Security Fundamentals" course, exclusively ...
Understanding Advanced PowerShell Logging
มุมมอง 3674 หลายเดือนก่อน
One of the most important events are recording PowerShell activity. There are critical nuounces when it comes to settings such as PowerShell Script Block Logging, Transcription Logs and Module Logging. Learn how PowerShell event logs can generate warnings for events and even provide decoded payloads. Background - Mandiant PowerShell Logging Threat Research: www.mandiant.com/resources/blog/great...
Introduction Into Domain Controllers and User Accounts
มุมมอง 1254 หลายเดือนก่อน
Understand the essentials of managing domain users, groups, and privileges on domain controllers with this informative lab session. Mastering these concepts is crucial for safeguarding enterprise environments effectively. This session is a free preview of our comprehensive "Enterprise Security Fundamentals" course, exclusively available at bluecapesecurity.com/courses/101-enterprise-security-fu...
Enterprise Security Fundamentals Course Introduction
มุมมอง 1685 หลายเดือนก่อน
This is the introductory lesson of our "Enterprise Security Fundamentals" course only available at bluecapesecurity.com/courses/101-enterprise-security-fundamentals/ Released in early 2024, this is a fully hands-on course that covers everything you need as a security professional working within enterprise environments. You'll gain practical experience via our lab system by using many industry-s...
Attack & Defend Your Lab
มุมมอง 1335 หลายเดือนก่อน
This is a preview of our FREE "C2 Attack & Defend" course at bluecapesecurity.com/courses/c2-attack-and-defend/ Check out the course for the full investigation steps. In this course, you will execute and investigate a realistic cyber attack scenario. You will utilize the Empire Command and Control (C2) framework to carry out an attack on a Windows target VM. Following this, you will transition ...
Build Your Lab: Velociraptor Setup and Configuration
มุมมอง 1.9K6 หลายเดือนก่อน
This video is part of Blue Cape Security's free "Build Your Lab" tutorials. bluecapesecurity.com/build-your-lab/velociraptor-setup In this video tutorial we are demonstrating how to install Velociraptor, which is an advanced digital forensic and incident response tool. We'll do this in our Medium Lab build, which includes a Windows client and Windows Domain Controller, but instructions apply to...
Build Your Lab: Installing Splunk Server and Forwarders
มุมมอง 2.2K6 หลายเดือนก่อน
This video is part of Blue Cape Security's free "Build Your Lab" tutorials. bluecapesecurity.com/build-your-lab/splunk-lab-installation In this video tutorial we are demonstrating how to install a Splunk server and clients within your lab environment in order to forward Windows event logs to your server in real-time. We’ll do this in our Medium Lab build, which includes a Windows client and Win...
Practical Windows Forensics Online Labs
มุมมอง 34810 หลายเดือนก่อน
We've released our Practical Windows Forensics course fully supporting in-browser lab VMs! In this video, we provide you with a sneak peek into the user experience of our course. We guide you through what it's like to navigate the course material and utilize the in-browser labs. You'll get a firsthand glimpse into how seamlessly our platform integrates theory with practical application, ensurin...
Digital Forensics - Reporting and Presentation of Findings
มุมมอง 484ปีที่แล้ว
This is the final part of the Practical Windows Forensics course. Once you have finished an investigation, it is equally important to present your findings. There are many ways to do this right and wrong. In this video we present best practices in terms of reporting considerations and the different types of how you can present your findings. This video is part of a free preview series of the Pr...
Essential Skills for Investigating Ransomware Attacks
มุมมอง 1.1Kปีที่แล้ว
In this webinar we discuss: 1:35 - Ransomware overview 12:53 - Ransomware attack infrastructure 17:03 - Beacons and post-exploitation 22:43 - Decoding Cobalt Strike beacons using CyberChef, any.run and ChatGPT 34:18 - MITRE ATT&ACK tactics and techniques 38:33 - Blue team skills and knowledge you need 41:16 - DIY training labs 44:32 - Attack simulation with Atomic Red Team 45:30 - Hands-on rans...
Dumping and analyzing processes from the memory with Volatility3
มุมมอง 934ปีที่แล้ว
Dumping and analyzing processes from the memory with Volatility3
Detecting suspicious Windows processes with Volatility3
มุมมอง 609ปีที่แล้ว
Detecting suspicious Windows processes with Volatility3
Memory Analysis with Volatility3 - Overview
มุมมอง 1.4Kปีที่แล้ว
Memory Analysis with Volatility3 - Overview
Practical Windows Forensics (PWF) - Containment and Preservation of Evidence using VirtualBox
มุมมอง 414ปีที่แล้ว
Practical Windows Forensics (PWF) - Containment and Preservation of Evidence using VirtualBox
Practical Windows Forensics (PWF) - Disk Acquisition with VirtualBox
มุมมอง 518ปีที่แล้ว
Practical Windows Forensics (PWF) - Disk Acquisition with VirtualBox
Practical Windows Forensics (PWF) - Memory Acquisition with VirtualBox
มุมมอง 776ปีที่แล้ว
Practical Windows Forensics (PWF) - Memory Acquisition with VirtualBox
Practical Windows Forensics (PWF) - The Forensic Procss
มุมมอง 665ปีที่แล้ว
Practical Windows Forensics (PWF) - The Forensic Procss
Practical Windows Forensics (PWF) - User Accounts Analysis
มุมมอง 743ปีที่แล้ว
Practical Windows Forensics (PWF) - User Accounts Analysis
Practical Windows Forensics (PWF) - BONUS: Amcache in-depth analysis and why scheduled tasks matter
มุมมอง 1.5Kปีที่แล้ว
Practical Windows Forensics (PWF) - BONUS: Amcache in-depth analysis and why scheduled tasks matter
Enterprise DFIR: How to conduct a forensic investigation of a compromised employee workstation
มุมมอง 7K2 ปีที่แล้ว
Enterprise DFIR: How to conduct a forensic investigation of a compromised employee workstation
Practical Windows Forensics (PWF) - Target System Setup
มุมมอง 8322 ปีที่แล้ว
Practical Windows Forensics (PWF) - Target System Setup
Practical Windows Forensics (PWF) - Forensic Workstation Installation
มุมมอง 2.6K2 ปีที่แล้ว
Practical Windows Forensics (PWF) - Forensic Workstation Installation
Practical Windows Forensics (PWF) - Lab Setup Overview
มุมมอง 6242 ปีที่แล้ว
Practical Windows Forensics (PWF) - Lab Setup Overview
Practical Windows Forensics (PWF) - Introduction and Overview
มุมมอง 2.6K2 ปีที่แล้ว
Practical Windows Forensics (PWF) - Introduction and Overview
Practical Windows Forensics (PWF) - Course Roadmap
มุมมอง 6492 ปีที่แล้ว
Practical Windows Forensics (PWF) - Course Roadmap
Practical Windows Forensics (PWF) - Resources
มุมมอง 7812 ปีที่แล้ว
Practical Windows Forensics (PWF) - Resources
Pretty neat!
Gracias por el vídeo. !
thanks!
Walker Frank Moore James Williams Ruth
Thank you buddy
Hello, are your IP from virtual machine has same gateway with Splunk Server?
Thanks for this, I wonder where the config file came from though
That's just a basic sample to forward all event logs. You can certainly get more creative: docs.splunk.com/Documentation/Splunk/9.3.0/Admin/Inputsconf
@@bluecapesec Thanks for the quick response on a simple question but now I'm wondering what type of connection you using for the VMs. Nat, Nat-Network?
@@NoLaSoulja86 It's a NAT network similar to this: bluecapesecurity.com/build-your-lab/medium-lab/
Link for MS Edge windows10 is now expired so i am taking my target system windows 10 but while running sysmon it generates unable to restart error and if i bypass all that then my disk image file is only of 2mb. Kindly comment how to resolve this issue?
Please keep this course going. Your new sub.
Thanks for sharing
still i have trouble executiig the PS script in 15:28, "right click the file, properties. In the bottom right there is "unblock" " this unblock option is not present please help me out @bluecapsec
Very helpful!
Great Video! do these log settings take up a lot of space under C:/Sysmon? we have had issues with C:/sysmon taking up heaps of storage on devices.
Thank you and yes - that is always an important consideration, finding the tradeoff between how much you need to log, how much visibility you gain and where to store it and there's no one size fits all solution. Naturally at least critical logs of critical systems should go into a SIEM. You can always set Sysmon and other log sizes individually for endpoints. And if you can't forward those logs to a SIEM, it'd still be a good idea to at least have them on the endpoint for analysis in case it's needed, even if it's just a few weeks of log data.
Hello There. Beginner and want to break into Cybersecurity. Just want to check if this a free course or paid one? Thank you
Hello, this is a paid course on bluecapesecurity.com/courses/101-enterprise-security-fundamentals/
'Promosm' 💦
Hi when did you take registry back up of infected machine? I could not find it in video
please let me know if you find the way because it seems like a video was missing
The data collection is part of the course, but you can find instructions on how to go about disk and memory acquisition in the Github project readme: github.com/bluecapesecurity/PWF
Is detection engineering part of DFIR?
If you have trouble executiig the PS script in 15:28, right click the file, properties. In the bottom right there is "unblock"
i could not find the option of unblock
Amazing video! Thanks!
Thank you for this webinar.
In real scenario we will not have VirtualBox• How to take memory image of VISTA on other environments?
That primarily depends on the infrastructure that it's running on. On-prem, virtual, cloud? The data acquisition part in this video will help you with some considerations and solutions on this: th-cam.com/video/y_yR5C0pWcs/w-d-xo.html
Well done ! Thank you for this very usefull tutorial :)
Really nice video! Informative and explained well
😻 ᵖʳᵒᵐᵒˢᵐ
Thanks for the video...
𝐩яⓞ𝓂𝓞Ş𝐦 🤤
In the GMS switch the “Program” to Analog app 1 TE
Hi Thanks for the info. Gr8 video
Do more video practical related incident response with different scenarios..
Thanks for the video...