Practical Sysmon Event ID Interpretation for SOC Analysts

Master the art of interpreting Sysmon logs to detect and respond to advanced threats, transforming raw data into actionable security intelligence.
...

Foundational Sysmon Event Analysis

Unit 1: Sysmon Basics & Process Activity

Unit 2: Network & Driver Activity

Unit 3: File & Stream Activity

Advanced Threat Detection with Sysmon

Unit 1: Unmasking Process Manipulation

Unit 2: Advanced Data & Device Monitoring

Detecting Persistence and Evasion Techniques

Unit 1: Registry Monitoring for Persistence

Unit 2: WMI and Named Pipe Monitoring

Unit 3: File System Evasion