Upload File

threat hunting workshop

74
Threat Hunting with Splunk Presenter: Ken Westin, M.Sc, OSCP Splunk, Security Market Specialist

Upload: splunk

Post on 16-Apr-2017

1.379 views

Category:

Technology


0 download

Report

TRANSCRIPT

Page 1: Threat Hunting Workshop

ThreatHuntingwithSplunkPresenter: KenWestin,M.Sc,OSCPSplunk,SecurityMarketSpecialist

Page 2: Threat Hunting Workshop

Agenda

• ThreatHutingBasics

• ThreatHuntingDataSources

• Sysmon EndpointData

• CyberKillChain

• WalkthroughofAttackScenarioUsingCoreSplunk (handson)

• EnterpriseSecurityWalkthrough

• ApplyingMachineLearningandDataSciencetoSecurity

Page 3: Threat Hunting Workshop

LogInCredentials

January,February&March https://od-norcal-2.splunkoxygen.comApril,May&June https://od-norcal-3.splunkoxygen.comJuly,August&September https://od-norcal-4.splunkoxygen.comOctober,November&December https://od-norcal-5.splunkoxygen.com

User:hunterPass:pr3dator

BirthMonth

Page 4: Threat Hunting Workshop

Thesewon’twork…

Page 5: Threat Hunting Workshop

AmIintherightplace?

Somefamiliaritywith…

● CSIRT/SOCOperations

● GeneralunderstandingofThreatIntelligence

● GeneralunderstandingofDNS,Proxy,andEndpointtypesofdata

5

Page 6: Threat Hunting Workshop

Thisisahands-onsession.

Theoverviewslidesareimportantforbuildingyour“hunt”methodology

10minutes- Seriously.

Page 7: Threat Hunting Workshop

ThreatHuntingwithSplunk

7

Vs.

Page 8: Threat Hunting Workshop

SANSThreatHuntingMaturity

8

AdHocSearch

StatisticalAnalysis

VisualizationTechniques

Aggregation Machine Learning/DataScience

85%55%50%48%32%

Source:SANSIR&ThreatHuntingSummit2016

Page 9: Threat Hunting Workshop

HuntingTools:InternalData

9

• IPAddresses:threatintelligence,blacklist,whitelist, reputationmonitoringTools:Firewalls, proxies, Splunk Stream,Bro,IDS

• NetworkArtifactsandPatterns:networkflow,packetcapture,activenetworkconnections, historicnetworkconnections, portsandservicesTools:Splunk Stream,BroIDS,FPC,Netflow

• DNS:activity,queries andresponses, zonetransferactivityTools:Splunk Stream,BroIDS,OpenDNS

• Endpoint– HostArtifactsandPatterns:users,processes, services, drivers, files, registry,hardware,memory, disk activity,filemonitoring: hashvalues, integritycheckingandalerts,creationordeletionTools:Windows/Linux, CarbonBlack,Tanium, Tripwire,ActiveDirectory

• VulnerabilityManagementDataTools:TripwireIP360,Qualys, Nessus

• UserBehaviorAnalytics:TTPs,usermonitoring, timeofdaylocation,HRwatchlistSplunk UBA,(All oftheabove)

Page 10: Threat Hunting Workshop

LogInCredentialsJanuary,February&March https://od-norcal-2.splunkoxygen.com

April,May&June https://od-norcal-3.splunkoxygen.com

July,August&September https://od-norcal-4.splunkoxygen.com

October,November&December https://od-norcal-5.splunkoxygen.com

User:hunterPass:pr3dator

Page 11: Threat Hunting Workshop

Endpoint:MicrosoftSysmonPrimer

11

● TAAvailable ontheAppStore

● GreatBlogPosttogetyoustarted

● Increases thefidelity ofMicrosoftLogging

BlogPost:http://blogs.splunk.com/2014/11/24/monitoring-network-traffic-with-sysmon-and-splunk/

Page 12: Threat Hunting Workshop

Showapptoclickon

12

Page 13: Threat Hunting Workshop

January,February&March https://od-norcal-2.splunkoxygen.comApril,May&June https://od-norcal-3.splunkoxygen.comJuly,August&September https://od-norcal-4.splunkoxygen.comOctober,November&December https://od-norcal-5.splunkoxygen.com

User:hunterPass:pr3dator

Page 14: Threat Hunting Workshop

SysmonEventTags

14

MapsNetworkCommtoprocess_id

Process_id creation andmapping toparentprocess_id

Page 15: Threat Hunting Workshop

sourcetype=X*|searchtag=communicate

15

Page 16: Threat Hunting Workshop

sourcetype=X*|deduptag|searchtag=process

16

Page 17: Threat Hunting Workshop

DataSourceMapping

Page 18: Threat Hunting Workshop

DemoStory- KillChainFrameworkSuccessfulbruteforce– downloadsensitivepdfdocument

Weaponize thepdffilewithZeusMalware

Convincingemailsentwithweaponizedpdf

Vulnerablepdfreaderexploitedbymalware.Dropper createdonmachine

Dropper retrievesandinstallsthemalware

Persistence viaregularoutboundcomm

DataExfiltration

Source:LockheedMartin

Page 19: Threat Hunting Workshop

Servers

Storage

DesktopsEmail Web

TransactionRecords

NetworkFlows

DHCP/DNS

HypervisorCustomApps

T

PhysicalAccess

Badges

ThreatIntelligence

Mobile

CMDB

IntrusionDetection

Firewall

DataLossPrevention

Anti-Malware

VulnerabilityScans

Traditional

Authentication

StreamInvestigations– chooseyourdatawisely

19

Page 20: Threat Hunting Workshop

20

Let’sdigin!

Please,raisethathandifyouneedustohitthepausebutton

Page 21: Threat Hunting Workshop

APTTransactionFlowAcrossDataSources

21

http(proxy)sessiontocommand&controlserver

RemotecontrolStealdataPersistincompanyRentasbotnet

Proxy

ConductBusiness

Createadditionalenvironment

GainAccesstosystemTransaction

ThreatIntelligence

Endpoint

NetworkEmail,Proxy,DNS,andWeb

DataSources

.pdf

.pdf executes&unpacksmalwareoverwritingandrunning“allowed”programs

Svchost.exe(malware)

Calc.exe(dropper)

AttackerhackswebsiteSteals.pdf files

WebPortal

.pdf

Attackercreatesmalware,embed in.pdf,

emailstothetarget

MAIL

Reademail,openattachment

OurInvestigationbeginsbydetectinghighriskcommunicationsthroughtheproxy,attheendpoint, andevenaDNScall.

Page 22: Threat Hunting Workshop

Tobeginourinvestigation,wewillstartwithaquicksearchtofamiliarizeourselveswiththedatasources.

Inthisdemoenvironment,wehaveavarietyofsecurityrelevantdataincluding…

WebDNSProxyFirewallEndpointEmail

Page 23: Threat Hunting Workshop

Takealookattheendpointdatasource. WeareusingtheMicrosoftSysmon TA.

Wehaveendpointvisibilityintoallnetworkcommunicationandcanmapeachconnectionbacktoaprocess.

}Wealsohavedetailedinfooneachprocessandcanmapitbacktotheuserandparentprocess.}

Letsgetourdaystartedbylookingusingthreatintel toprioritizeoureffortsandfocusoncommunicationwithknown highriskentities.

Page 24: Threat Hunting Workshop

WehavemultiplesourceIPscommunicatingtohighriskentitiesidentifiedbythese2threatsources.

Weareseeinghighriskcommunicationfrommultipledatasources.

Weseemultiplethreatintel relatedeventsacrossmultiplesourcetypesassociatedwiththeIPAddressofChrisGilbert.Let’stakecloserlookattheIPAddress.

Wecannowseetheownerofthesystem(ChrisGilbert)andthatitisn’taPIIorPCIrelatedasset,sotherearenoimmediatebusinessimplicationsthatwouldrequireinformingagencies orexternal customerswithinacertaintimeframe.

Thisdashboardisbasedoneventdatathatcontainsathreatintelbasedindicatormatch(IPAddress,domain,etc.).ThedataisfurtherenrichedwithCMDBbasedAsset/identityinformation.

Page 25: Threat Hunting Workshop

Wearenowlookingatonlythreatintel related activityfortheIPAddressassociatedwithChrisGilbertandseeactivityspanningendpoint,proxy,andDNSdatasources.

These trendlinestellaveryinterestingvisualstory.ItappearsthattheassetmakesaDNSqueryinvolvingathreatintel relateddomainorIPAddress.

ScrollDo

wn

Scrolldownthedashboardtoexamine thesethreatintel eventsassociatedwiththeIPAddress.

Wethenseethreatintel relatedendpointandproxyeventsoccurringperiodicallyandlikelycommunicatingwithaknownZeusbotnetbasedonthethreatintelsource(zeus_c2s).

Page 26: Threat Hunting Workshop

It’sworthmentioningthatatthispointyoucouldcreateatickettohavesomeonere-image themachinetopreventfurtherdamageaswecontinueourinvestigationwithinSplunk.

Withinthesamedashboard,wehaveaccesstoveryhighfidelityendpointdatathatallowsananalysttocontinuetheinvestigationinaveryefficientmanner.Itisimportanttonotethatnearreal-timeaccesstothistypeofendpointdataisnotnotcommonwithinthetraditionalSOC.

Theinitialgoaloftheinvestigationistodeterminewhetherthiscommunicationismaliciousorapotentialfalsepositive.Expandtheendpointeventtocontinuetheinvestigation.

Proxyrelated threatintel matchesareimportantforhelpingustoprioritizeoureffortstowardinitiatinganinvestigation.Furtherinvestigationintotheendpointisoftenverytimeconsumingandofteninvolvesmultipleinternalhand-offstootherteamsorneeding toaccess additionalsystems.Thisencryptedproxytrafficisconcerningbecauseofthelargeamountofdata(~1.5MB)beingtransferredwhichiscommonwhendataisbeingexfiltrated.

Page 27: Threat Hunting Workshop

Exfiltrationofdataisaseriousconcern andoutboundcommunicationtoexternal entitythathasaknownthreatintelindicator,especiallywhenitisencrypted asinthiscase.

Letscontinuetheinvestigation.

Anotherclue.Wealsoseethatsvchost.exe shouldbelocatedinaWindowssystemdirectorybutthisisbeingrunintheuserspace.Notgood.

Weimmediatelyseetheoutboundcommunicationwith115.29.46.99viahttpsisassociatedwiththesvchost.exeprocessonthewindowsendpoint. Theprocessidis4768.There isagreatdealmoreinformationfromtheendpointasyouscrolldownsuchastheuserIDthatstartedtheprocessandtheassociatedCMDBenrichment information.

Page 28: Threat Hunting Workshop

WehaveaworkflowactionthatwilllinkustoaProcessExplorerdashboardandpopulateitwiththeprocessidextracted fromtheevent(4768).

Page 29: Threat Hunting Workshop

ThisisastandardWindowsapp,butnotinitsusualdirectory, tellingusthatthemalwarehasagainspoofedacommonfilename.

Wealsocanseethattheparentprocessthatcreated thissuspicuous svchost.exe processiscalledcalc.exe.

ThishasbroughtustotheProcessExplorer dashboardwhichletsusviewWindowsSysmon endpointdata.

SuspectedMalware

Letscontinuetheinvestigationbyexaminingtheparentprocessasthisisalmostcertainlyagenuine threatandwearenowworkingtowardarootcause.

ThisisveryconsistentwithZeusbehavior.Theinitialexploitationgenerally createsadownloaderordropperthatwillthendownloadtheZeusmalware.Itseemslikecalc.exemaybethatdownloader/dropper.

SuspectedDownloader/Dropper

Thisprocesscallsitself“svchost.exe,”acommonWindowsprocess, butthepathisnotthenormalpathforsvchost.exe.

…whichisacommontraitofmalwareattemptingtoevadedetection.WealsoseeitmakingaDNSquery(port53)thencommunicatingviaport443.

Page 30: Threat Hunting Workshop

TheParentProcessofoursuspecteddownloader/dropper isthelegitimatePDFReaderprogram.Thiswilllikelyturnouttobethevulnerable appthatwasexploitedinthisattack.

SuspectedDownloader/Dropper

SuspectedVulnerableAppWehaveveryquicklymovedfromthreatintel relatednetwork andendpointactivitytothelikelyexploitationofavulnerableapp.Clickontheparentprocesstokeepinvestigating.

Page 31: Threat Hunting Workshop

WecanseethatthePDFReaderprocesshasnoidentifiedparentandistherootoftheinfection.

ScrollDo

wn

Scrolldownthedashboardtoexamine activityrelated tothePDFreaderprocess.

Page 32: Threat Hunting Workshop

Chrisopened2nd_qtr_2014_report.pdfwhichwasanattachmenttoanemail!

Wehaveourrootcause!Chrisopened aweaponized .pdf filewhichcontained theZeusmalware. Itappearstohavebeendelivered viaemailandwehaveaccesstoouremaillogsasoneofourimportantdatasources.Letscopythefilename2nd_qtr_2014_report.pdf andsearchabitfurthertodeterminethescopeofthiscompromise.

Page 33: Threat Hunting Workshop

Letsdigalittlefurtherinto2nd_qtr_2014_report.pdf todeterminethescopeofthiscompromise.

Page 34: Threat Hunting Workshop

Letssearchthoughmultipledatasourcestoquicklygetasenseforwhoelsemayhavehavebeenexposed tothisfile.

Wewillcomebacktothewebactivitythatcontainsreference tothepdf filebutletsfirstlookattheemaileventtodetermine thescopeofthisapparentphishingattack.

Page 35: Threat Hunting Workshop

Wehaveaccesstotheemailbodyandcanseewhythiswassuchaconvincingattack.Thesenderapparentlyhadaccesstosensitiveinsiderknowledge andhintedatquarterlyresults.

There isourattachment.

HoldOn!That’snotourDomainName!Thespellingisclosebutit’smissinga“t”.Theattackerlikelyregistered adomainnamethatisveryclosetothecompanydomainhopingChriswouldnotnotice.

Thislookstobeaverytargetedspearphishingattackasitwassenttoonlyoneemployee (Chris).

Page 36: Threat Hunting Workshop

RootCauseRecap

36

DataSources

.pdf executes&unpacksmalwareoverwritingandrunning“allowed”programs

http(proxy)sessiontocommand&controlserver

RemotecontrolStealdataPersistincompanyRentasbotnet

Proxy

ConductBusiness

Createadditionalenvironment

GainAccesstosystemTransaction

ThreatIntelligence

Endpoint

NetworkEmail,Proxy,DNS,andWeb

.pdfSvchost.exe(malware)

Calc.exe(dropper)

AttackerhackswebsiteSteals.pdf files

WebPortal

.pdf

Attackercreatesmalware,embed in.pdf,

emailstothetarget

MAIL

Reademail,openattachment

Weutilizedthreatintel todetectcommunicationwithknownhighriskindicatorsandkickoffourinvestigationthenworkedbackwardthroughthekillchaintowardarootcause.

Keytothisinvestigativeprocessistheabilitytoassociatenetworkcommunicationswithendpointprocessdata.

Thishighvalueandveryrelevantabilitytoworkamalwarerelated investigationthroughtorootcausetranslatesintoaverystreamlinedinvestigativeprocesscomparedtothelegacy SIEMbasedapproach.

Page 37: Threat Hunting Workshop

37

Letsrevisitthesearchforadditionalinformationonthe2nd_qtr_2014-_report.pdf file.

Weunderstandthatthefilewasdeliveredviaemailandopenedattheendpoint.Whydoweseeareference tothefileintheaccess_combined (webserver) logs?

Selecttheaccess_combinedsourcetype toinvestigatefurther.

Page 38: Threat Hunting Workshop

38

Theresultsshow54.211.114.134hasaccessed thisfilefromthewebportalofbuttergames.com.

There isalsoaknownthreatintelassociationwiththesourceIPAddressdownloading (HTTPGET)thefile.

Page 39: Threat Hunting Workshop

39

SelecttheIPAddress,left-click,thenselect“New search”.WewouldliketounderstandwhatelsethisIPAddresshasaccessed intheenvironment.

Page 40: Threat Hunting Workshop

40

That’sanabnormallylargenumberofrequestssourcedfromasingleIPAddressina~90minutewindow.

Thislookslikeascriptedactiongiventheconstanthighrateofrequestsoverthebelowwindow.

ScrollDo

wn

Scrolldownthedashboardtoexamineotherinterestingfieldstofurtherinvestigate.

NoticetheGooglebotuseragent string whichisanotherattempttoavoidraisingattention..

Page 41: Threat Hunting Workshop

41

Therequestsfrom52.211.114.134aredominatedbyrequeststotheloginpage(wp-login.php). It’sclearlynotpossibletoattemptaloginthismanytimesinashortperiodoftime– thisisclearlyascriptedbruteforceattack.

Aftersuccessfullygainingaccesstoourwebsite, theattackerdownloaded thepdf file,weaponized itwiththezeusmalware, thendelivered ittoChrisGilbertasaphishingemail.

Theattackerisalsoaccessingadminpageswhichmaybeanattempttoestablishpersistence viaabackdoorintotheweb site.

Page 42: Threat Hunting Workshop

KillChainAnalysisAcrossDataSources

42

http(proxy)sessiontocommand&controlserver

RemotecontrolStealdataPersistincompanyRentasbotnet

Proxy

ConductBusiness

Createadditionalenvironment

GainAccesstosystemTransaction

ThreatIntelligence

Endpoint

NetworkEmail,Proxy,DNS,andWeb

DataSources

.pdf

.pdf executes&unpacksmalwareoverwritingandrunning“allowed”programs

Svchost.exe(malware)

Calc.exe(dropper)

AttackerhackswebsiteSteals.pdf files

WebPortal

.pdf

Attackercreatesmalware,embed in.pdf,

emailstothetarget

MAIL

Reademail,openattachment

Wecontinuedtheinvestigationbypivotingintotheendpointdatasourceandusedaworkflowactiontodeterminewhichprocessontheendpointwasresponsible fortheoutboundcommunication.

WeBeganbyreviewingthreatintel relatedeventsforaparticularIPaddressandobservedDNS,Proxy,andEndpointeventsforauserinSales.

Investigationcomplete!LetsgetthisturnedovertoIncident Reponse team.

Wetracedthesvchost.exeZeusmalwarebacktoit’sparentprocessIDwhichwasthecalc.exedownloader/dropper.

Onceourrootcauseanalysiswascomplete,weshiftedoutfocusintotheweblogstodetermine thatthesensitivepdffilewasobtainedviaabruteforceattackagainstthecompanywebsite.

Wewere abletoseewhichfilewasopenedbythevulnerable appanddetermined thatthemaliciousfilewasdeliveredtotheuserviaemail.

Aquicksearchintothemaillogsrevealed thedetailsbehindthephishingattackandrevealed thatthescopeofthecompromisewaslimitedtojusttheoneuser.

Wetracedcalc.exe backtothevulnerable applicationPDFReader.

Page 43: Threat Hunting Workshop

WanttoFollowAlong?

● DownloadSplunk6.4.2http://www.splunk.com/en_us/download-21.html

● Download&InstalltheMachineLearningToolkithttp://tiny.cc/splunkmlapp

Page 44: Threat Hunting Workshop

Break!

Page 45: Threat Hunting Workshop

Splunk EnterpriseSecurity

Page 46: Threat Hunting Workshop

OtherItemsToNote

ItemstoNote

Navigation- HowtoGetHere

Descriptionofwhattoclickon

Click

Page 47: Threat Hunting Workshop

KeySecurityIndicators(buildyourown!)

Sparklines

Editable

Page 48: Threat Hunting Workshop

Variouswaystofilterdata

Malware-Specific KSIsandReports

SecurityDomains->Endpoint->MalwareCenter

Page 49: Threat Hunting Workshop

Filterable

KSIsspecifictoRisk

Riskassignedtosystem,userorother

UnderAdvancedThreat,selectRiskAnalysis

Page 50: Threat Hunting Workshop

(ScrollDown)

RecentRiskActivity

UnderAdvancedThreat,selectRiskAnalysis

Page 51: Threat Hunting Workshop

Filterable, downtoIoC

KSIsspecifictoThreat

Mostactivethreatsource

Scrolldown… Scroll

UnderAdvancedThreat,selectThreatActivity

Page 52: Threat Hunting Workshop

Specificsaboutrecentthreatmatches

UnderAdvancedThreat,selectThreatActivity

Page 53: Threat Hunting Workshop

Toaddthreatintelgoto:Configure ->DataEnrichment ->ThreatIntelligence Downloads

Click

Page 54: Threat Hunting Workshop

Click“ThreatArtifacts”Under“AdvancedThreat”

Click

Page 55: Threat Hunting Workshop

ArtifactCategories –clickdifferent tabs…

STIXfeed

Customfeed

UnderAdvancedThreat,selectThreatArtifacts

Page 56: Threat Hunting Workshop

Review theAdvancedThreatcontent

Click

Page 57: Threat Hunting Workshop

DatafromassetframeworkConfigurable Swimlanes

Darker=more events

AllhappenedaroundsametimeChangeto“Today”ifneeded

AssetInvestigator,enter“192.168.56.102”

Page 58: Threat Hunting Workshop

DataScience&MachineLearningInSecurity

58

Page 59: Threat Hunting Workshop

Disclaimer:Iamnotadatascientist

Page 60: Threat Hunting Workshop

TypesofMachineLearningSupervised Learning:generalizingfromlabeled data

Page 61: Threat Hunting Workshop

Supervised MachineLearning

61

DomainName TotalCnt RiskFactor AGD SessionTime RefEntropy NullUa Outcome

yyfaimjmocdu.com 144 6.05 1 1 0 0 Maliciousjjeyd2u37an30.com 6192 5.05 0 1 0 0 Maliciouscdn4s.steelhousemedia.com 107 3 0 0 0 0 Benignlog.tagcade.com 111 2 0 1 0 0 Benigngo.vidprocess.com 170 2 0 0 0 0 Benignstatse.webtrendslive.com 310 2 0 1 0 0 Benigncdn4s.steelhousemedia.com 107 1 0 0 0 0 Benignlog.tagcade.com 111 1 0 1 0 0 Benign

Page 62: Threat Hunting Workshop

Unsupervised Learning:generalizingfromunlabeled data

Page 63: Threat Hunting Workshop

Unsupervised MachineLearning

• Notuning

• Programmaticallyfindstrends

• UBAisprimarilyunsupervised

• Rigorouslytestedforfit

63

AlgorithmRawSecurityData AutomatedClustering

Page 64: Threat Hunting Workshop

64

Page 65: Threat Hunting Workshop

MLToolkit&Showcase• SplunkSupportedframeworkforbuildingMLApps

– Getitforfree:http://tiny.cc/splunkmlapp

• LeveragesPythonforScientificComputing (PSC)add-on:– Open-sourcePythondatascienceecosystem– NumPy,SciPy,scitkit-learn,pandas,statsmodels

• Showcaseusecases:PredictHardDriveFailure,ServerPowerConsumption,ApplicationUsage,CustomerChurn&more

• Standardalgorithmsoutofthebox:– Supervised:LogisticRegression,SVM,LinearRegression,RandomForest,etc.– Unsupervised: KMeans,DBSCAN,SpectralClustering,PCA,KernelPCA,etc.

• Implementoneof300+algorithmsbyeditingPythonscripts

Page 66: Threat Hunting Workshop

MachineLearningToolkitDemo

66

Page 67: Threat Hunting Workshop
Page 68: Threat Hunting Workshop

Splunk UBA

Page 69: Threat Hunting Workshop

Splunk UBAUseCases

ACCOUNTTAKEOVER• Privilegedaccountcompromise• Dataexfiltration

LATERALMOVEMENT• Pass-the-hashkillchain• Privilegeescalation

SUSPICIOUS ACTIVITY• Misuseofcredentials• Geo-locationanomalies

MALWARE ATTACKS• Hiddenmalwareactivity

BOTNET,COMMAND&CONTROL• Malwarebeaconing• Dataleakage

USER&ENTITY BEHAVIORANALYTICS• Suspiciousbehaviorbyaccountsor

devices

EXTERNAL THREATSINSIDERTHREATS

Page 70: Threat Hunting Workshop

SplunkUserBehaviorAnalytics(UBA)• ~100%ofbreachesinvolvevalidcredentials(Mandiant Report)• Needtounderstandnormal&anomalousbehaviorsforALLusers• UBAdetectsAdvancedCyberattacks andMaliciousInsiderThreats• LotsofMLunderthehood:

– BehaviorBaselining&Modeling– AnomalyDetection(30+models)– AdvancedThreatDetection

• E.g.,DataExfil Threat:– “Sawthisstrangelogin&datatransferfor userkwestin

at3aminChina…”– SurfacethreattoSOCAnalysts

Page 71: Threat Hunting Workshop

Workflow

Raw Events

1

Statistical methods

Security semantics

2 Threat ModelsLateralmovement

ML

Patterns

Sequences

Beaconing

Land-speedviolation

Threats

Kill chain sequence

5

Supporting evidence

Threat scoring

Graph Mining

4

Con

tinuo

us s

elf-l

earn

ing

Anomalies graph

Entity relationship graph

3

Anomalies

Page 72: Threat Hunting Workshop

Splunk UBADemo

72

Page 73: Threat Hunting Workshop

SecurityWorkshops

● SecurityReadinessAssessments● Splunk UBADataScienceWorkshop● EnterpriseSecurityBenchmarkAssessment

Page 74: Threat Hunting Workshop

SecurityWorkshopSurvey

https://www.surveymonkey.com/r/8BCWHSF


(CMC THREAT HUNTING SERVICE)

The awakening of cyber threat hunting: Intelligence

Threat Hunting with Splunk

Threat Hunting

Hunting Threat Actors with TLS Certificates · HUNTING THREAT ACTORS WITH TLS CERTIFICATES MARK PARSONS DEVELOPER/THREAT ANALYST KING AND UNION [email protected]. ... to put new

Threat Hunting in Windows – Are You Hunting or Being Hunted?

Endgame SANS - Threat Hunting Before the Incident

THREAT HUNTING CYBER-SECURITY 3 DAY …...workshop will include one day of formal, hands-on instruction on threat hunting techniques, and two days of guided and unguided hands-on technical

FALCON OVERWATCH MANAGED THREAT HUNTING · Director of Information Technology, TransPak. CrowdStrike Products FALCON OVERWATCH MANAGED THREAT HUNTING CROWDSTRIKE MANAGED THREAT HUNTING

Threat Hunting Guide - Broadcom Inc

The Elastic Guide to Threat Hunting - copyright

Threat Hunting - csirt.jabarprov.go.id

Threat Hunting workshop

2020 THREAT HUNTING REPORT - ExtraHop

Threat Hunting with ELK training - Intellectual Point

AUSTRALIAN LEADERSHIP THREAT HUNTING …...THREAT HUNTING WORKSHOP PRESENTED BY THE SCHOOL OF INFORMATION TECHNOLOGY AND ELECTRICAL ENGINEERING IN CONJUNCTION WITH ARGO P@CIFIC KRIS

Threat Hunting Report can be viewed here - News · THREAT HUNTING REPORT 3. THRET HNTING REPORT 4 KEY SURVEY FINDINGS ... Among the respondents to the threat hunting survey, six in

Threat hunting with MITRE ATT&CK

THREAT HUNTING- IOCs VS TTPs- Happiest Minds

Developing an Adaptive Threat Hunting Solution: The

GUIDE TO CYBER THREAT HUNTING - Tyler Technologies

Introduction into Threat Hunting - Sri Lanka CERT|CC · What is Threat Hunting Cyber threat hunting is an active cyber defence activity. It is "the process of proactively and iteratively

Threat Hunting with Qualys€¦ · Threat Hunting with Qualys: Going Beyond Your EDR Solutions. Adversary Threat Tactics are Changing Early 2010s Zero ... Rapidly weaponizing newly-disclosed

Cyber Threat Hunting with Phirelight

SACON - Threat hunting (Chandra Prakash)

Towards a Threat Hunting Automation Maturity Model

Industrial Control System Cyber Threat Hunting

Threat Hunting with Splunk Hands-on

Building a Successful Threat Hunting Program

Enabling Efficient Cyber Threat Hunting with Cyber Threat

Abstract Tools for Effective Threat Hunting

TTPs for Threat Hunting in Refineries · TTPs for Threat Hunting in Refineries Dan Gunter | Twitter: @dan_gunter Principal Threat Analyst @ Dragos October 2018. ... •Not Red Teaming

Kaspersky Threat Hunting · • Immediate protection against any detected threat through automatic antivirus database updates. • Retrospective analysis of incidents and threat hunting,

Threat hunting as SOC process

“Threat Hunting in Active Directory Environment”