🚨 It’s back! 🚨 The INFOSEC SURVIVAL GUIDE has returned! Read our FREE Orange Book: Incident Response below or at the link here -- blackhillsinfosec.com/prompt… In the United States? Get a physical copy shipped to you for FREE -- spearphish-general-store.mys… If you loved our Yellow and Green book or it's your first time hearing about our survival guides — now’s your chance. If you didn’t… you already know why this one’s worth grabbing. 🟧💥

"When performing Windows endpoint investigations, with a typical average of 200K-500K event log entries per host, we can use Hayabusa to reduce and prioritize our event analysis." Read more: blackhillsinfosec.com/wrangl… Wrangling Windows Event Logs with Hayabusa and SOF-ELK (Part 1) by: @securecake Published: 9/17/2025

"In part 1, we used Hayabusa to reduce/refine Windows Event Logs from a single endpoint [...] But what if we need to wrangle Windows Event Logs for more than one system?" Read more: blackhillsinfosec.com/wrangl… Wrangling Windows Events Logs with Hayabusa and SOF-ELK (Part 2) by: Patterson Cake Published: 10/01/2025

**NEW** BHIS | Blog When investigating a security event on a Windows endpoint, what is your favorite Windows Event ID? Wrangling Windows Events Logs with Hayabusa and SOF-ELK (Part 2) by: @securecake Published: 10/01/2025 Learn more: blackhillsinfosec.com/wrangl…

"Although Direct Send is not new, we have seen a recent surge in threat actors abusing it..." Read more: blackhillsinfosec.com/disabl… Stop Spoofing Yourself! Disabling M365 Direct Send by: @securecake Published: 8/20/2025

"[...] we’ll discuss how Hayabusa and [...] (SOF-ELK) can help us wrangle EVTX files (Windows Event Log files) for maximum effect during a Windows endpoint investigation!" Read more: blackhillsinfosec.com/wrangl… Wrangling Windows Event Logs with Hayabusa and SOF-ELK (Part 1) by: @securecake Published: 9/17/2025

Hey folks! Join us for a free one-hour training session with Antisyphon instructors and AI security researchers Derek Banks and Brian Fehrman on attacking and defending AI systems. Wednesday, June 4th - 12:00 PM EDT Register: events.zoom.us/ev/AokxHboDBG…

What could an attacker do with access to your AI assistant? Bronwen Aker joined us for a free one-hour Black Hills Information Security webcast to give us some on security lessons! We got a hands-on look at how Microsoft Copilot works in business settings, as Bronwen showed how it accesses data and helps with tasks like drafting emails or finding files, which can be useful or risky depending on permissions and context! Watch it for FREE here - youtube.com/live/-lwe9yc9fv0

You’ve received a “true positive” security alert for a Windows or Linux endpoint. This is not a drill! Your environment is under attack! This is war and you need to take rapid, decisive steps to determine: Has the endpoint been compromised? Have other systems been impacted? What actions should come next? Patterson Cake will take you through live demonstrations & hands-on labs to help you get through similar IR scenarios with confidence in our next Pay-What-You-Can Workshop: Rapid Endpoint Investigations, live THIS FRIDAY, June 6th. Register here: antisyphontraining.com/cours…

Hey folks! From multiple layers of obfuscation to conditional behavior to sandbox avoidance, malware can indeed be complicated. But ultimately, when a Windows malware event occurs, the most important questions are “if” and “how” it impacted your environment! Thursday, March 14th - 1:00 PM EDT Register: events.zoom.us/ev/An_coMKNRm… In this free one-hour Black Hills Information Security (BHIS) webcast, Patterson Cake - Incident Responder, will discuss a simplified approach and tactical tips for answering those questions when investigating malware events on your Windows endpoints. If you want to register for upcoming webcast you can below: events.zoom.us/eo/AqZceUFfoY…

**NEW** BHIS | BLOG Do you use OSINT for IR? How about investigating bank robberies? OSINT for Incident Response (Part 2) by: @Securecake Published: 3/7/2024 Learn more: blackhillsinfosec.com/osint-…

If you happened to miss yesterday’s webcast, don't worry – we've got you covered! The entire webcast is available on our YouTube channel linked below! youtube.com/watch?v=rqEjxZph…

Hey folks! You've had a "true positive" security event on a Windows endpoint (or more than one). Now what!?!? Combining investigative methodology with creative utilization of some free tools! We'll discuss "tactical forensics" in response to Windows endpoint security events, with artifact acquisition and analysis to rapidly determine what happened, identify indicators of compromise, and help make informed decisions regarding scope of impact and next steps. Thursday, December 7th - 1:00 pm EST Register: events.zoom.us/ev/AsevhSXim3… Show up early for pre-show banter! Chat with your fellow attendees in the Black Hills Infosec Discord server here: discord.gg/BHIS -- in the #webcast-live-chat channel.

Hello all! Brush your teeth! Exercise! Analyze your log files! We've all heard the experts harping on these tenets of basic hygiene, but how do we even start? In this next Black Hills Information Security (BHIS) webcast, come join @EthanRobish & @0xderuke as they get you started in log file analysis while exercising your fingers. (You're on your own for teeth brushing.) Thursday, September 14th - 1:00 PM ET (UTC -4) Register: blackhillsinfosec.zoom.us/we… * Fundamental analysis techniques; building blocks we reach for again and again. * Technologies used in data science like Parquet, dataframes, and OLAP databases. * What to do when your log volume goes through the roof. Show up early for the pre-show! - John, Ethan, & Derek P.S. Join us for Wild West Hackin' Fest (WWHF) in Deadwood, SD in October!

*NEW* BHIS | Tester's Blog In part 1, we discussed extracting M365 UAL JSON via SOF-ELK. If you only have access to CSV data, can you still use SOF-ELK? Wrangling the M365 UAL with SOF-ELK and CSV Data (Part 3 of 3) by: @SecureCake Published: 9/7/2023 rebrand.ly/0bhn9z2