CISSP Cram Session 2026
Here is a link to my talk CISSP Cram Session 2026
Eric Conrad
Author, SANS Faculty Fellow, and CTO of Backshore Communications
Latest posts
Detecting Malware via HTTPS Analysis
Here is a copy of my talk: Detecting Malware via HTTPS Analysis and ja4db-search .
Building Containment Fields: How to Secure Containers
Links for my AtlSecCon talk : My slides Docker: https://www.docker.com/ Container Escape CVEs: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=container+escape CIS Docker Benchmark: https://www.cisecurity.org/benchmark/docker Docker Bench Security https://github.com/docker/docker-bench-security
Detecting Command and Control frameworks via Sysmon and Windows Event Logging
My talk: https://github.com/eric-conrad/c2-talk/ Team Cymru - S2 Threat Research Team: Top C2 Frameworks My previous C2 detection talk: Leave Only Footprints: When Prevention Fails EVTX files from Leave Only Footprints: When Prevention Fails Sysmon: https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon Impacket: https://github.com/fortra/impacket wmiexec,py:…
Introducing DeepBlueCLI v3
Here are my slides from my SANS Webcast Introducing DeepBlueCLI v3. DeepBlueCLI is available here .
Leave Only Footprints: When Prevention Fails
Here are links and EVTX files from my SANS Blue Team Summit keynote Leave Only Footprints: When Prevention Fails. Here are my slides Here are the EVTX files Sysmon The Rise of C2 Frameworks Most Popular C2 Frameworks – May 2023 Busting the Ghost in the Logs - Randy Pargman & Jean-Francois Maes Tracking Malware with Import Hashing Impacket Hydra Metasploit Sliver Enabling logging of failed logons…
Blind Data Exfiltration Using DNS and Burp Collaborator
Here's a copy of my slides for my SANS webcast Blind Data Exfiltration Using DNS and Burp Collaborator: Blind Data Exfiltration Using DNS and Burp Collaborator Here are the links: Link to the webcast (this will link to the webcast archive afterward) DNS-Exfiltrate Github site DNS Query Length... Because Size Does Matter
Information Security for the Long Haul: Building a Career That Lasts
Here's a list of links from my AtlSecCon 2022 talk Information Security for the Long Haul: Building a Career That Lasts . Link to my talk Cliff Stoll makes Klein Bottles Cliff Stoll on Numberphile Stuck by Amy Reardon $300 in Google Compute Credits Free Google Compute Training Free AWS Training Free Azure Training East Coast Infosec Podcast We All Have Our Masters Degree!" with Eric Conrad…
Decrypt all the Things: How Encryption is Impacting Network-Based Security Controls
Here's a copy of my SANS @Mic webcast slides: Decrypt all the Things: How Encryption is Impacting Network-Based Security Controls
Threat Hunting via DNS
My SANS @Mic talk Threat Hunting via DNS Link to the Youtube video . Here are the links: DNS New World Order: QuadX! DoH! DoT! Da Fuq? Paul Vixie on DoH Firefox continues push to bring DNS over HTTPS by default for US users Firefox to enable DNS-over-HTTPS by default to US users Firefox HTTP logging Tutorial to setup your own DNS-over-HTTPS (DoH) server DNS-over-HTTPS with Pi-Hole…
CISSP Cram Session
Here are the slides for my CISSP Cram Session webcast. The webcast is available here: http://sans.org/u/140g
BSides Halifax
Here's a link to my BSides Halifax talk Threat Hunting via DNS
(untitled)
Here's a link to my SANS Miami 2020 keynote talk: Threat Hunting via Sysmon
Maine DEFCON 207
Here's a copy of my DEFCON 207 talk Threat Hunting via Windows Event Logs DeepBlueCLI GitHub site: https://github.com/sans-blue-team/DeepBlueCLI
Threat Hunting via Windows Event Logs
Here's a copy of my SANS Security West keynote Threat Hunting via Windows Event Logs
(untitled)
Here's a copy of my Atlantic Security Conference talk: Build it Once, Build it Right: Architecting for Detection
The Perimeter is Dead
Here's a copy of my SANS CDI Keynote The Perimeter is Dead.
Build it Once, Build it Right: Architecting for Detection
Here's a copy of my Tactical Detection & Data Analytics Summit & Training 2018 keynote: Build it Once, Build it Right
SANS Blue Team Summit
Here is a copy of my SANS Blue Team Summit talk Threat Hunting via Windows Event Logs
Threat Hunting via Windows Event Logs
Copy of my #SANS2018 keynote talk: Threat Hunting via Windows Event Logs
DerbyCon 7: DeepBlueCLIv2 Talk and links
Here's a link to my DerbyCon 7 talk: Introducing DeepBlueCLI v2, Now Available in PowerShell and Python Viedo of my talk (thank you: Adrian Crenshaw ): http://www.irongeek.com/i.php?page=videos/derbycon7/t205-introducing-deepbluecli-v2-now-available-in-powershell-and-python-eric-conrad DeepBlueCLI GitHub site: https://github.com/sans-blue-team/DeepBlueCLI Last year's talk:…
ShadowBrokers PCAPs, etc.
I spent some time enjoying Easter Sunday by analyzing the Shadowbrokers EternalBlue attacks vs. a Windows 7 system. It is a service-side attack vs. TCP port 445. On Monday I analyzed EternalRomance and DoublePulsar. I will update this post as I test other exploits and victim operating systems. EternalBlue is the 2017 version of MS08-067 , which was the last universal service-side vulnerability in…
Quality not Quantity talk, commands, and links
Quality not Quantity: Continuous Monitoring's Deadliest Events Commands: Search service creation events and errors: PS> Get-WinEvent -FilterHashtable @{logname='system'; id=7045,7030} User creation events and users added to local and global security-enabled group: PS> Get-WinEvent -FilterHashtable @{LogName="Security"; ID=4720,4732,4728} Full command line of all processes (requires…
DeepBlueCLI: a PowerShell Module for Hunt Teaming via Windows Event Logs
Here's a video of my 2016 DerbyCon talk DeepBlueCLI . Thank you, @irongeek_adc A copy of my 2016 DerbyCon talk DeepBlueCLI slides: Github site: https://github.com/sans-blue-team/DeepBlueCLI Link to my Quality Not Quantity talk , which inspired DeepBlueCLI.
C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels
Video of the talk Links from my Security Onion Con 2016 talk: C2 Phone Home: Leveraging SecurityOnion to Identify Command and Control Channels Link to all pcaps, Bro logs and Whitecap Snort Rules