Leveraging Beacon Detection Techniques to Identify Anomalous Logons | 2020 THIR Summit

Attackers attempting to compromise passwords via brute forcing or password spraying usually do so with the help of automated scripts. Sophisticated versions of these scripts may borrow techniques from C2 frameworks, such as implementing sleep timers and jitter between login attempts. In this talk, we'll walk through how we applied C2 beacon analysis techniques to look for evidence of an adversary performing password spraying.

Speakers
Fred Nolte,- Senior Cybersecurity Analyst, Threat Hunting, Target
Nikita Jain, Cybersecurity Analyst, Incident Response, Target
Dante Razo, - Intern, Incident Response, Target
Jacob Alongi, - Intern, Incident Response, Target

[jayinfosec]

The fact that this video only has 873 views is a travesty. BLUE TEAMS - DO