filmov
tv
Using Yara & Strelka to Identify & Detect Malware
Показать описание
Speakers: Paul Hutelmyer (Target, US), Derek Thomas (Target, US)
Adversaries try as much as possible to blend in with behavior that appears normal. However, their operations result in malicious activity, and therefore must at some point deviate from normalcy and develop specific patterns which can be identified over time. This workshop will focus on identifying, collecting, and detecting malware, using the Open Source projects "Yara" and "Strelka". The goal of the training is that the audience will be able to identify malware of interest to them, and develop enterprise level detection based on their own research.
About the Speakers
Paul Hutelmyer is a principal engineer with Target Corporation.
Derek Thomas is a lead information security analyst on Target Corporation’s Cyber Threat Intelligence (CTI) team in Brooklyn Park, Minnesota. After graduating college, Derek joined the US Army as an active duty intelligence officer where he developed a passion for intelligence analysis. After the military he worked as a contractor in Washington D.C supporting the FBI Cyber Division as a cyber-intelligence analyst pursuing financially motivated cybercriminals. Derek has since earned the PMP, GSEC, GCIH, GCIA, GPEN, and OSCP certifications and his Master’s in homeland security from Penn State. He joined Target’s CTI team in March 2018 and currently lives in the suburbs of Minneapolis with his wife, son, and golden retriever.
Adversaries try as much as possible to blend in with behavior that appears normal. However, their operations result in malicious activity, and therefore must at some point deviate from normalcy and develop specific patterns which can be identified over time. This workshop will focus on identifying, collecting, and detecting malware, using the Open Source projects "Yara" and "Strelka". The goal of the training is that the audience will be able to identify malware of interest to them, and develop enterprise level detection based on their own research.
About the Speakers
Paul Hutelmyer is a principal engineer with Target Corporation.
Derek Thomas is a lead information security analyst on Target Corporation’s Cyber Threat Intelligence (CTI) team in Brooklyn Park, Minnesota. After graduating college, Derek joined the US Army as an active duty intelligence officer where he developed a passion for intelligence analysis. After the military he worked as a contractor in Washington D.C supporting the FBI Cyber Division as a cyber-intelligence analyst pursuing financially motivated cybercriminals. Derek has since earned the PMP, GSEC, GCIH, GCIA, GPEN, and OSCP certifications and his Master’s in homeland security from Penn State. He joined Target’s CTI team in March 2018 and currently lives in the suburbs of Minneapolis with his wife, son, and golden retriever.
1:41:55
Using Yara & Strelka to Identify & Detect Malware
0:25:21
Classify Malware with YARA
0:05:43
Using YARA to identify and classify malware samples
0:14:15
What are Yara Rules (and How Cybersecurity Analysts Use Them)
0:09:49
Lab Setup: Threat Hunting With YARA
0:04:18
Scan a file using YARA and Strings for file string details(Windows)
0:25:18
Cutting Through the Chaos: File Detection and Analysis Using Strelka
0:25:58
Resource Smart Detection with YARA and osquery
0:17:57
Finding Evil with YARA
0:03:37
How to Hunt for Threats Using YARA Rules
0:26:33
Generating YARA Rules by Classifying Malicious Byte Sequences
0:02:17
How to Install and Run YARA tool on Windows?
0:07:55
Detecting VBA Macros with Yara Rules
0:07:17
Learning with ReversingLabs: What are the YARA Rules?
0:10:00
The genesis of Kaspersky’s online Threat Hunting training with Yara, with Costin Raiu
0:01:38
Hunt APTs with Yara: 5 reasons to train with us
0:25:53
YARA for Mere Mortals
0:07:55
QNI and Yara - Use Case One
0:03:04
CyberChef - YARA - The pattern matching swiss knife
0:24:05
Malware Swiss Army Knife - YARA Install Linux and Windows
0:00:20
How To Draw Beautiful Eyeliner !!!
0:35:35
Privilege Escalation Through Clam AntiVirus Yara Rules | TryHackMe Lockdown
1:12:02
CS6038 2020: Week 9 - Malware Detection and Identification with Yara
0:16:46
IOCs and Yara - Part #1
Комментарии