Hack The Box SOC Analyst Lab - Unit42 (Sysmon)

[@dlcrdz00]

Great video walkthrough...Haven't had much experience with Splunk but this video definitely got me excited the more we dug into the Event Logs

[@MyDFIR]

Glad it sparked some interest, Splunk is a powerful tool!

[@RubenMuñozAragon-e9n]

Great. Please I LOVE content of Splunk. Thanks.

[@MyDFIR]

More to come!

[@SayoOlanbiwonnu]

Amazing Delivery as usual ❤

[@MyDFIR]

Thank you ❤️

[@anitagd]

Great video as usual 🔥

[@MyDFIR]

Appreciate it!

[@MustafaAhmedQasemYahya]

You are anazing. Very nice. Thanks

[@MyDFIR]

Wow, thank you!

[@aplik3]

I was just planning to do this room today :D Great video!

[@MyDFIR]

Have fun!

[@mapletech_22]

Amazing work 👏 🙌 👌 ❤

[@MyDFIR]

Thank you 🙌

[@irocz5150]

Excellent video. Sad to say but sysmon generates lots of logs and sometimes there is a push back installing this amazing tool.

[@MyDFIR]

You’re absolutely correct but there are some companies out there that have it!

[@thebodythehead]

amazing video

[@MyDFIR]

Thanks!

[@frankurhioke1964]

Do you have a discount on your course presently or a payment plan in place?

[@MyDFIR]

Not yet but definitely something I plan on doing soon

[@erglaligzda2265]

Any bright idea how to monitor end-point DNS queries? Now I am using sysmon, but not always it captures end-points IP and/or user. :(

[@MyDFIR]

Strange, Sysmon Event ID 22 should capture the source IP of the endpoint and you can correlate that with other event IDs if required

[@erglaligzda2265]

@@MyDFIR I thought so too, but on-premise environment it may not happen. Thanks for pointing out Event ID. I'll take a second into config file. :)

[@MoSiraji]

Thank you good for training

[@MyDFIR]

You’re welcome! Hope you had some fun and learned new things 👍

[@MoSiraji]

@@MyDFIR Yes, I did.

[@Whiterqbbit]

Fancy using Splunk, I would of probably used ZT Timeline Explorer - Going have to checkout that splunk video.

[@MyDFIR]

heheh thanks! I love sifting through logs using Splunk as I can better visualize the data but I'd recommend using any tool that does the job!

[@myles5253]

Do you use a VM for Hackthebox labs?

[@godwinalekeobor5274]

You can use their VM, if you subscribe

[@MyDFIR]

Any labs I do, I always use a VM. That way I can revert it pretty easily if I need to.

[@Abc-sl1nf]

Thx!

[@ItsCynik]

wen next project? 😢

[@MyDFIR]

Heheh TBD! These take a long time to do. Have you completed all of the ones on my channel?

[@mariostevenquijivix5752]

Im using a Mac. Is there another way aside from 7zip top extract the folder?

[@MyDFIR]

I believe Mac has a built in extractor where you could double click and should do the trick.

[@imca_b_5517]

Brother please don't upload video of hack the box because it was not free and + we are students so we don't have enough money for that but if you make video on other Topics so I will help

[@MyDFIR]

But it is free or at least portions of it. All the labs I’ve uploaded so far are free that you can do and follow along. Unless I am missing something?