Learning Sysmon - File Create Stream Hash Event (Video 15)
This week, Carlos goes over how to use Sysmon to track the creation of an alternate data stream on an NTFS file system located on a Windows host. He also demonstrates how it can be used to track downloads when an alternate data stream is used for zone identifiers.
Oddvar's Gist:
https://gist.github.com/api0cradle/cd...
Sysmon Modular:
https://github.com/olafhartong/sysmon...
Sysmon Community Guide:
https://github.com/trustedsec/SysmonC...
PSGumshoe PowerShell Module
https://www.powershellgallery.com/pac...
Sysmon Visual Studio Code Extension
https://marketplace.visualstudio.com/...
00:00 Intro
02:51 Configuration
06:30 Event Fields
06:57 Resources
08:09 Considerations