Threat Hunting Tutorial- Day 12, Hunting PowerShell With Splunk
Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Cyber threat hunting digs deep to find malicious actors in your environment that have slipped past your initial endpoint security defenses.
In the ransomware hunt series, I introduced you to process creation log sources in Windows, relevant data fields for analysis, and instructions on how to import this data into Splunk. Here I am going to focus on some basic queries you can use to interrogate those logs and how to filter benign results. There will also be a small section on hypothesis and questions you can ask of this data to help discover anomalous activity.
In Day-11 we have observed very basic level of data analysis of doing baselining with Process Creation events and how to efficiently use Splunk queries to understand what is normal and what is not. In today's episode we will use the same technique but we will focus on live data set and uncover some anomaly using Splunk.
If you haven't watch Day-11 Please watch it now here- • Threat Hunting Tutorial- Day 11, Hunting P...
🔗Github Link for the presentation- https://github.com/archanchoudhury/Th...
🔗Some Related Episodes-
1. Powershell Decode- • Incident Response Training, Decoding Power...
2. Decoding Shell Code- • Finding and Decoding Malicious Scripts- Di...
WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!
-------------------------------------------------------------------------------------------------------------------------
INCIDENT RESPONSE TRAINING Full Course 👉 • BlackPerl DFIR || INCIDENT RESPONSE TRAIN...
DFIR Free Tools and Techniques 👉 • BlackPerl DFIR || DFIR Tools and Techniques
Windows and Memory Forensics 👉 • BlackPerl DFIR || Windows and Memory Foren...
Malware Analysis 👉 • BlackPerl DFIR || Malware Analysis Series
SIEM Tutorial 👉 • BlackPerl DFIR || Learn SIEM with me & Cre...
Threat Hunt & Threat Intelligence 👉 • BlackPerl DFIR || Threat Hunt & Threat Int...
Threat Hunt with Jupyter Notebook👉 • Threat Hunt with Jupyter Notebook
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Git: https://github.com/archanchoudhury
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [email protected]
Auf dieser Seite können Sie das Online-Video Threat Hunting Tutorial- Day 12, Hunting PowerShell With Splunk mit der Dauer stunde minuten sekunde in guter Qualität ansehen, das der Benutzer BlackPerl 23 August 2022 hochgeladen hat, den Link mit Freunden und Bekannten teilen, dieses Video wurde auf Youtube bereits 4,692 Mal angesehen und es wurde von 100 den Zuschauern gefallen. Viel Spaß beim Betrachtenden Zuschauern gefallen!
