Threat Hunting Tutorial- Day 11, Hunting Process Creation with Splunk

Publié le: 01 août 2022
sur la chaîne: BlackPerl

6,616

131

Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Cyber threat hunting digs deep to find malicious actors in your environment that have slipped past your initial endpoint security defenses.

In the ransomware hunt series, I introduced you to process creation log sources in Windows, relevant data fields for analysis, and instructions on how to import this data into Splunk. Here I am going to focus on some basic queries you can use to interrogate those logs and how to filter benign results. There will also be a small section on hypothesis and questions you can ask of this data to help discover anomalous activity.

So in today's episode we will focus on very basic level of data analysis of doing baselining with Process Creation events and how to efficiently use Splunk queries to understand what is normal and what is not. In coming up episodes, we will focus on live demo using these same methods and will explore how can we identify anomalous behavior in a set of data.

🔗Github Link- https://github.com/archanchoudhury/Th...

WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!
-------------------------------------------------------------------------------------------------------------------------
INCIDENT RESPONSE TRAINING Full Course 👉   • BlackPerl DFIR  || INCIDENT RESPONSE TRAIN...
DFIR Free Tools and Techniques 👉    • BlackPerl DFIR || DFIR Tools and Techniques
Windows and Memory Forensics 👉    • BlackPerl DFIR || Windows and Memory Foren...
Malware Analysis 👉    • BlackPerl DFIR || Malware Analysis Series
SIEM Tutorial 👉    • BlackPerl DFIR || Learn SIEM with me & Cre...
Threat Hunt & Threat Intelligence 👉    • BlackPerl DFIR || Threat Hunt & Threat Int...
Threat Hunt with Jupyter Notebook👉    • Threat Hunt with Jupyter Notebook

📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn:   / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Git: https://github.com/archanchoudhury
✔ Insta: (blackperl_dfir)  / blackperl_dfir
✔ Can be reached via [email protected]

Sur cette page du site, vous pouvez voir la vidéo en ligne Threat Hunting Tutorial- Day 11, Hunting Process Creation with Splunk durée heure minute seconde en bonne qualité , qui a été Téléchargé par l'utilisateur BlackPerl 01 août 2022, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 6,616 fois et il a aimé 131 téléspectateurs. Bon visionnage!

37,384

1.6K

00:00:00