April 13

Webinar Takeaway: Cyber Threat Hunting Level 1

Security

0  comments

My key takeaways

  • the juicy stuff is the traffic leaving the network: is there a business need for it?
  • Bro / Zeek : Bro old, Zeek new, almost same
  • Figuring out beacons best over long period of times, eg 24h
  • almost all c2 beacons are encrypted, use meta information to detect them
  • today heartbeats without jitter timing: 50% chance of a false positive
  • ==RITA does not install on Ubuntu 20.04==

Env

additional links

Tags

threat hunting

You may also like

Webinar takeaway – Applying The Threat Hunter’s Runbook

My key takeaways threat hunting runbook Identify connection persistency Identify if there is a business need Protocol analysis Investigate external IP address Investigate internal IP address Threat hunting is stealthy only when in IR mode, the adversary should be allowed to notice we are after him set the TCP timeout from 5min to 1h in

Read More

Webinar takeaway – The Ins and Outs of RITA

My key takeaways RITA is made to detect beacons and long connections open source tool Signature based detection of malicious code is outdated Average detect time is over 6 month > 50% of compromised systems are detected by outsiders RITA is behaviour based Needs a bunch of pakets to work on min 1h, default 24h

Read More
Leave a Comment