Threat Hunting Tutorial- Day 4, Malicious Macro Executed- What's Next?
Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Cyber threat hunting digs deep to find malicious actors in your environment that have slipped past your initial endpoint security defenses.
After sneaking in, an attacker can stealthily remain in a network for months as they quietly collect data, look for confidential material, or obtain login credentials that will allow them to move laterally across the environment.
Once an adversary is successful in evading detection and an attack has penetrated an organization’s defenses, many organizations lack the advanced detection capabilities needed to stop the advanced persistent threats from remaining in the network. That’s why threat hunting is an essential component of any defense strategy.
Today is Day4 of Threat Hunting Tutorial and today is a Live Demo.
Modern cyber defense requires the mindset of “assume breach,” but with so much data generated by our networks and endpoints, how can we collect the information needed to identify attacks in an affordable way, let alone sort through it all? We will discuss the unique challenges of finding post-exploitation activity in our mountains of data and walk through using the open source Elastic Stack to identify the techniques enumerated in MITRE’s ATT&CK framework. We will demonstrate an overview of how to leverage the ATT&CK body of knowledge, options for data collection, and suggested rules and dashboards that specifically target finding post-exploitation activity. The goal of this talk is to arm defenders with industry-validated attack knowledge, and demonstrate how late-stage compromises can be identified and stopped before significant damage is caused.
WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!
-------------------------------------------------------------------------------------------------------------------------
INCIDENT RESPONSE TRAINING Full Course 👉 • BlackPerl DFIR || INCIDENT RESPONSE TRAIN...
DFIR Free Tools and Techniques 👉 • BlackPerl DFIR || DFIR Tools and Techniques
Windows and Memory Forensics 👉 • BlackPerl DFIR || Windows and Memory Foren...
Malware Analysis 👉 • BlackPerl DFIR || Malware Analysis Series
SIEM Tutorial 👉 • BlackPerl DFIR || Learn SIEM with me & Cre...
Threat Hunt & Threat Intelligence 👉 • BlackPerl DFIR || Threat Hunt & Threat Int...
⌚
Timelines
-------------------------------------------------------------------------------------------------------------------------
0:00 ⏩ Introduction
0:51 ⏩ What is the Compromise?
2:45 ⏩ What logs we need for Hunt?
7:39 ⏩ Demo Starts
8:00 ⏩ Identify Persistence
12:19 ⏩ Identify Execution
15:24 ⏩ Identify Lateral Movement
20:18 ⏩ Identify Exfiltration
24:31 ⏩ Identify Command and Control
26:15 ⏩ Attack Summery
28:34 ⏩ Conclusion
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Git: https://github.com/archanchoudhury
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [email protected]
Sur cette page du site, vous pouvez voir la vidéo en ligne Threat Hunting Tutorial- Day 4, Malicious Macro Executed- What's Next? durée heure minute seconde en bonne qualité , qui a été Téléchargé par l'utilisateur BlackPerl 17 avril 2022, Partagez le lien avec vos amis et connaissances, sur youtube cette vidéo a déjà été regardée 4,613 fois et il a aimé 169 téléspectateurs. Bon visionnage!
