Sysmon is a free endpoint monitoring tool published by Microsoft in their sysinternals suite. It generates process creations, network connections, file creations, DNS, and now clipboard monitoring with v12. We'll discuss what's in the events and how to easily visualize and search them with Gravwell's new Sysmon Kit. This segment is sponsored by Gravwell.

 

Show Notes: https://wiki.securityweekly.com/psw671

Visit https://securityweekly.com/gravwell to learn more about them!

Visit https://www.securityweekly.com/psw for all the latest episodes!