Sponsors
.png){kind=logo}
.png){kind=logo}
Agenda | Tuesday, August 16, 2022
Time | Description |
|---|---|
9:45 - 10:00 AM CT | Welcome & Opening RemarksDomenica "Lee" Crognale, Certified Instructor, SANS Institute |
10:00 - 10:40 AM CT | How to Hunt for Cyber Threats Using Network Meta Data and AIThe network metadata the Vectra platform produces can be valuable for threat investigations. Have you wondered how you could make use of same metadata to proactively hunt for threats? In this session, Our analysts will describe techniques to identify three common attacker behaviors in your environment and walk you through the specific workflows for each attack technique, provide best practices for hunting in your own environment, and answer questions about how to threat hunt using the Vectra platform. However, the same methodologies can be applied to network metadata obtained from Stream. Matt Pieklik, Special Projects Lead - Professional Services, Vectra AI |
10:45 - 11:25 AM CT | Eliminating Social Engineering Pathways for APTsAccording to the 2022 Verizon Data Breach Investigation report, 82% of data breaches contain a human element. This is unsurprising since humans are seen as soft targets that attackers can manipulate into handing over information or performing a desired action. Advanced Persistent Threat (APT) actors are regularly abusing the human element using social engineering techniques to infiltrate critical national infrastructure. In this talk, we will explore how Russian and other foreign APT actors are successfully using social engineering to advance their cyber-espionage campaigns. This includes looking at how they are developing their TTPs over time, using spear-phishing, supply chain abuse, public exploits, and stolen credentials. Based on these lessons learned, we will look at how organizations can reduce their attack surface and use Picnic to make it harder for these actors to exploit the human element. Manit Sahib, Director of Global Intelligence, Picnic Corporation |
11:30 - 12:10 PM CT | How to Benchmark Your Threat Hunting Readiness and Prepare for the Next StepMany organizations want to start threat hunting but struggle with knowing where to begin, how to measure success, and how to scale an effective program. This presentation draws on the experience of elite hunters and teams around the world and will discuss an actionable threat hunting maturity model and help you prepare for each step of the journey with specific guidance, concrete examples, and sample threat hunts. John Gamble, Sr. Director of Product Marketing, Corelight |
12:15 - 1:15 PM CT | Lunch |
1:15 - 1:55 PM CT | Threat Hunting with Active and Passive DNSWhen adversaries register malicious domains for C2 servers, phishing, or payload servers, the choices they make when it comes to registration, hosting, certificates, mail servers, subdomains, and more can be useful in discovering a fuller picture of their operations. In this session we’ll take a look at how to:
Taylor Wilkes-Pierce, Sales Engineer Lead, DomainTools |
2:00 - 2:40 PM CT | How to Use Different Types of Threat Intel in Threat HuntingAdversaries today are continually using new techniques to compromise hosts and evade detection. Cybercriminals, no longer satisfied with traditional ransomware attack tactics, have turned to double, triple, and even quadruple extortion to extract ever increasing ransoms from their victims. Attend this session to understand the latest cybersecurity trends observed by Palo Alto Networks Unit 42, a world-recognized authority on threat research. During this session, we will discuss:
Dominique Kilman, Director - Unit 42, Palo Alto Networks |
2:45 - 3:00 PM CT |
|
3:00 - 3:40 PM CT | How to unlock achievements in Threat Hunting using VelociraptorVelociraptor is the open source DFIR framework that everyone is talking about! Have you ever needed to respond to an incident in a large enterprise network? Have you wondered how many of your 10,000 endpoints are compromised? You know you should be hunting for common forensic artifacts but how do you do it in a scalable way, in a reasonable time? Well… now you can! This session will introduce Velociraptor and cover the recent capabilities investigating and monitoring the security of Linux hosts. Velociraptor’s superpower is its flexible and powerful query language called VQL. Using VQL we can implement novel detection, hunt for compromise and automate all our response needs. We will cover common use cases such as hunting for ssh keys across large networks or automatic escalation when suspicious events are discovered. We also cover real time monitoring of the endpoint (for example webshell detection via process parent/child analysis) and how VQL can be used to build sophisticated alerting around process execution chains, network connections and even bash instrumentation of the command line, all done at scale with the click of a few buttons. Michael Cohen, Consulting Software Engineer, Rapid7 |
3:45 - 4:25 PM CT | How to Reap the Benefits Of Threat Hunting in the New Post-Macro WorldThe promised land for each threat hunting exercise is to uncover an attack that has gone unnoticed despite the layers of security tools. But it’s not as easy as just typing some indicators in a search box, especially when the threat landscape is continuously changing. Even if the hunt results in success, the next step is to formulate this for future protection by turning unknown threats into contextual threat intelligence. Blocking of Macros in Office applications is one of the recent developments that will likely affect the delivery tactics of the bad actors. With all these moving targets, successful threat hunting requires rigorous understanding of unknown threat behaviours. Join this session to hear about:
H. Fatih Akar, Security Product Manager, VMRay |
4:30 - 4:45 PM CT |
|
.PNG "DFIR_ICON_(1).PNG"){kind=icon}
.png "CTI_Blog_part_1_(1).png")
