Security Onion Conference 2021 - Hunting Malware with Suricata Metadata by Josh Stroschein скачать в хорошем качестве

Security Onion Conference 2021 - Hunting Malware with Suricata Metadata by Josh Stroschein

Don't forget to like and subscribe! Hunting Malware with Suricata Metadata Josh Stroschein Closing the gap between when an infection occurs and when it is detected is a key goal of an effective threat hunting program. While many security solutions focus on detecting adversarial activity in real time, skilled threat actors have demonstrated the ability to bypass these security tools. This can leave an organization vulnerable to further compromise and data breaches. Having the right data available during an incident or when performing proactive threat hunting activities is crucial for success. More than just an IDS/IPS, Suricata can provide the visibility to solve incidents quickly and more accurately by enabling context before, during, and after an alert. In this presentation, attendees will learn the skills required to identify, respond and protect against threats in their network day to day as well as identify new threats through structured data aggregation and analysis. Adversary tactics and techniques from delivery mechanisms to post-infection traffic and data exfiltration will be explored to highlight real-world analysis. This talk will cover the key functional aspects of Suricata as well as all of the data that it generates, such as protocol specific logs (HTTP, DNS, and many more), TLS information, file identification and extraction and generated data such as JA3 hashes and community ID. Network traffic from prevalent malware will be used to demonstrate In-depth analysis and the development of threat hunting strategies. Additional techniques to detect anomalous or malicious activity will be accomplished with tools such as Arkime, Kibana and CyberChef. Threat intelligence feeds and other online resources will also be explored to learn how to pivot between data sources while performing proactive threat hunting activities.