Beginner Blue Team Training!

This live stream demonstrates how blue team analysts can detect potentially malicious script execution in Windows environments using Chainsaw and Sigma rules, providing practical threat hunting skills without requiring expensive SIEM infrastructure.

This is a live stream from Just Hacking Training (JHT) focused on beginner blue team training, particularly Windows log analysis and threat hunting using Sigma rules 1:30. The presenter demonstrates how to detect script execution artifacts in Windows logs using Chainsaw, a tool for analyzing Windows event logs 19:22.

Key Takeaways:
• JHT offers cybersecurity training with a non-subscription model providing lifetime access to materials 3:57
• Blue team roles make up most cybersecurity jobs, focusing on defense, forensics, and security operations 9:08
• Chainsaw is a powerful tool for analyzing Windows event logs offline without needing a full SIEM solution 19:33
• Sigma rules provide a standardized way to write detection rules that can work across different security tools 34:46
• The demo shows creating a Sigma rule to detect wscript.exe and cscript.exe execution in user directories 39:04

The stream concludes with a practical demonstration of building and testing Sigma rules to detect potentially malicious script execution, showing how blue team analysts can hunt for threats using Windows native logging capabilities 44:00.

Sources:

• 1:30 Introduction to blue team training and Sigma rules
• [3:57](https://www.youtube.com/watch?v=DjTI