File-Centric Analysis through the Use of Recursive Scanning Frameworks

No ratings

Presented at FIRSTCyberThreatIntelligenceSymposium 2019 by

David Zawdie

Defenders encounter a myriad of ways in which threat actors operate to deliver, exploit and install payloads in order to achieve their objective. Regardless of methods employed, the needs of an attacker frequently requires the use of an object contained in a particular file format. Analyzing various file types requires knowledge of numerous specifications and disparate tools to parse data structures. In addition, there is a need to identify interesting observations from metadata, as well as techniques and embedded objects contained inside bespoke files.This session will provide background regarding the needs for and requirements of file-centric analysis, demonstrate the effectiveness of popular open source frameworks, and highlight opportunities for extending detection and response efforts. The discussion will include an overview of the frameworks, their approach for presenting a unified system for analysis, and details on how to actively participate in the respective open source projects through contributions that further extend capabilities via new modules and integrations.At the conclusion of this session, attendees will be able to:Define the intent, purpose and scope of file-centric analysisList and describe capabilities from several open source recursive scanning frameworksDetermine potential opportunities to improve existing analysis workflowsIdentify opportunities to further extend the existing frameworks by contributing to open source projects