Skip to main content
CPEBuddy
Windows Endpoint Telemetry (ft. Jonny Johnson)

Windows Endpoint Telemetry (ft. Jonny Johnson)

Source: YouTube · John Hammond · published Jun 10, 2025 · 46:41

Malware Analysis
No ratings yet Log in to rate
Transcript Available
Description

Johnny Johnson discusses his cybersecurity journey and demonstrates his tools, Johnmon and ETW Inspector, which enhance Windows telemetry visibility.

Key Takeaways:
• Johnny entered security by chance, learning detection engineering at Specter Ops alongside experts 1:09-3:34.
• Johnmon is a homegrown EDR using a kernel minifilter and ETW trace logging with JSON configuration 5:56-6:33.
• The tool enables stealthy malware analysis and defensive testing, like detecting EDR silencing techniques 15:15-17:41.
• ETW Inspector helps enumerate providers, parse PEs for trace logging providers, and identify security descriptors 26:00-28:40.
• Johnson advises developers to prioritize OS understanding, coding efficiency, and kernel debugging skills 20:46-23:32.

He emphasizes telemetry identification is critical for both red and blue teams to ensure data reliability and discover undocumented OS features 43:00-43:55.

Sources:

  • 0:46 Introduction of Johnny's projects
  • 1:09 Johnny's background
  • 5:56 Johnmon architecture
  • 15:15 Johnmon for malware analysis
  • 26:00 ETW Inspector

Generate CPE Credits

Generate a professional CPE document from this video's transcript.

Estimated credit: 1 CPE hours

Estimate uses the video runtime (1 hour ≈ 1 CPE, rounded to the nearest 0.5, minimum 0.5, maximum 2.0). The final amount can be lower after review, never higher.

Topic: Malware Analysis. Commonly maps to: Security Operations, Security Architecture and Engineering. Exact CISSP domains are assigned during generation.

CISSP Domain Mapping
Learning Objectives
Self-Assessment Questions
PDF Export Ready

Free account. One generation at a time, with a daily limit.

CPEBuddy is independent and not affiliated with or endorsed by ISC2, ISACA, or any certification body. Exports are formatted for common CPE submissions; acceptance is at your certification body's discretion.

Watch on YouTube

Transcript Preview

First 800 characters of the transcript

All right, everyone. Hey, thanks so much for tuning in. Look, I am super excited to finally spend some time with a good friend of mine, Johnny Johnson. How are you, dude? Look, I uh I don't know if I can I don't I don't want to steal your thunder. You've got your intro. You've got your own spiel, but I am quite a fanboy. You're over here at Huntress kind of as a teammate and uh co-orker or my day job, but I know you've been in through plenty of places and doing incredible stuff here and there and all prior. So, uh super happy to hang out and spend some time with you, Johnny. What are you up to? Hey. Yeah, thanks so much, John. And the pleasure is all mine, man. You know, I uh it's a pleasure to work with you and learn from you as well. And uh things are going great on my end. The weather o…