Finding Haystacks in Your Needles: Threat Hunting Problems in Real World Data

No ratings

Presented at BSidesNola 2017 by

Sarah Miller

Resources such as SANS's "Know Normal, Find Evil" and MITRE's ATT&CK framework are a great starting point when looking for malicious activity ... but what happens when you actually start diving into the data? Is finding malware really as easy as just looking for any port 80/443 connection that's not from a browser? (Spoilers: It isn't.) This talk goes through a number of real scenarios where legitimate applications behave just like malware, and how to improve behavioral detection.