Name: Trust in Tech - Who littered the sandbox? Scooping up new malware behavior.
Start: 2021-08-24T18:00:00+02:00
End: 2021-08-24T21:00:00+02:00

Endpoint Detection Super Powers on the cheap, with Sysmon

In order to become a super hero, able to hunt for bad in your environment you first need some great powers. Starting blind, you need means to listen. I will introduce a modular Sysmon configuration to cover your Windows environment, mapped extensively to the ATT&CK framework.
By using the ATT&CK framework as a basis for hunting the likelihood of catching at least part of the attackers trail is significantly increased. To make use of this rich data source I will demonstrate a Threat Hunting application which will guide your investigation along all covered ATT&CK techniques.

Who littered the sandbox? Scooping up new malware behavior.
A malware infection is still the most common initial entry point for most ransomware problems. Towards the year of the introvert I read an article that provided an overview the links between some of the larger malware families and ransomware that was dropped as a result of that.
Obviously mitigation is the best way to combat these infections but most organizations struggle to get these implemented.
As a passionate detection engineer I require telemetry to be able to build meaningful detections. I need to understand what happens and what can be logged in order to build meaningful detections. To be able to track changes of behavior and spot commonalities I wanted to do this at scale, over time. This is where sandbox telemetry came in to play, a lot of it.
This is a story about my road to acquire, process and analyze the data and the insights that it has brought me.

ITPirate

Trust in Tech Cologne

Technology

System Administration

Software Development

Microsoft Windows

Web Technology

Cloud Computing

Cybersecurity

Microsoft Azure

Black Hat Hacking

Microsoft

Windows

Web Application Security

The Secret

White Hat Hacking

Trust in Tech - Who littered the sandbox? Scooping up new malware behavior.

Online event

Share

Trust in Tech Cologne

Trust in Tech - Who littered the sandbox? Scooping up new malware behavior.

Trust in Tech Cologne

Details

Members are also interested in