Threat Hunting Tutorial- Day 11, Hunting Process Creation with Splunk
Threat hunting is the practice of proactively searching for cyber threats that are lurking undetected in a network. Cyber threat hunting digs deep to find malicious actors in your environment that have slipped past your initial endpoint security defenses.
In the ransomware hunt series, I introduced you to process creation log sources in Windows, relevant data fields for analysis, and instructions on how to import this data into Splunk. Here I am going to focus on some basic queries you can use to interrogate those logs and how to filter benign results. There will also be a small section on hypothesis and questions you can ask of this data to help discover anomalous activity.
So in today's episode we will focus on very basic level of data analysis of doing baselining with Process Creation events and how to efficiently use Splunk queries to understand what is normal and what is not. In coming up episodes, we will focus on live demo using these same methods and will explore how can we identify anomalous behavior in a set of data.
🔗Github Link- https://github.com/archanchoudhury/Th...
WATCH BELOW Playlists as well, if you want to make your career in DFIR and Security Operations!!
-------------------------------------------------------------------------------------------------------------------------
INCIDENT RESPONSE TRAINING Full Course 👉 • BlackPerl DFIR || INCIDENT RESPONSE TRAIN...
DFIR Free Tools and Techniques 👉 • BlackPerl DFIR || DFIR Tools and Techniques
Windows and Memory Forensics 👉 • BlackPerl DFIR || Windows and Memory Foren...
Malware Analysis 👉 • BlackPerl DFIR || Malware Analysis Series
SIEM Tutorial 👉 • BlackPerl DFIR || Learn SIEM with me & Cre...
Threat Hunt & Threat Intelligence 👉 • BlackPerl DFIR || Threat Hunt & Threat Int...
Threat Hunt with Jupyter Notebook👉 • Threat Hunt with Jupyter Notebook
📞📲
FOLLOW ME EVERYWHERE-
-------------------------------------------------------------------------------------------------------------------------
✔ LinkedIn: / blackperl
✔ You can reach out to me personally in LinkedIn as well- https://bit.ly/38ze4L5
✔ Twitter: @blackperl_dfir
✔ Git: https://github.com/archanchoudhury
✔ Insta: (blackperl_dfir) / blackperl_dfir
✔ Can be reached via [email protected]
Nesta página do site você pode assistir ao vídeo on-line Threat Hunting Tutorial- Day 11, Hunting Process Creation with Splunk duração hora minuto segundo em boa qualidade , que foi baixado pelo usuário BlackPerl 01 Agosto 2022, compartilhe o link com seus amigos e conhecidos, no youtube este vídeo já foi visto 6,616 vezes e gostou 131 espectadores. Boa visualização!
