Uncovering and Visualizing Malicious Infrastructure - SANS Threat Hunting Summit 2018

Показать описание

How much information about a threat can you find using a single IP address, domain name, or indicator of compromise (IOC)? What additional threats can you identify when looking at attacker
and victim infrastructure? To discover and analyze the infrastructure behind large-scale malware activity, we’ll look at known indicators from popular botnets spreading such threats as Locky, Globeimposter, and Trickbot. We will highlight co-occurring malicious activities observed on the infrastructure of popular botnets, and demonstrate practical techniques to find threats, analyze botnet and malware infrastructure in order to identify actor and victim infrastructure, and show how to pivot to discover additional IOCs using such techniques as passive DNS and OSINT. Finally, we will demonstrate how visualizing known IOCs helps to better understand the connections between infrastructure, threats, victims, and malicious actors.

Josh has worked in security for 14 years. He’s been a threat analyst at NASA and also helped to build
the Security Operations Center at Mandiant. His professional interests involve network, computer, and
data security.

Andrea worked as a Sysadmin for 12 years and has worked with Hewlett Packard and the city of Danville, CA. She began working with Open DNS in 2015 and has worked tirelessly to make the Internet a safer place.

Рекомендации по теме

Комментарии

At the end: pretty cool to correlate DNS occurrence over a timeline, looks like Emotet and Hancitor could be related. Would be interesting to see more data over a longer time period.

Ichinin

Uncovering and Visualizing Malicious Infrastructure - SANS Threat Hunting Summit 2018

Uncovering and Visualizing Malicious Infrastructure - SANS Threat Hunting Summit 2018

A Practical Case of Threat Intelligence – From IoC to Unraveling an Attacker Infrastructure

Using Artificial Intelligence to Predict Malicious Infrastructure Activity - Staffan Truvé

AI in Cybersecurity

Real-Time DDoS Attack Showcase

Fighting Malware with Graph Analytics: An End-to-End Case Study

Malware Infrastructure Easier to Deploy | AT&T ThreatTraq

DEF CON 21 - Remy Baumgarten - Combatting Mac OSX iOS Malware with Data Visualization

Upgrading Your CTI to Track Down Criminal Hosting Infrastructures - SANS CTI Summit 2018

Hunting Hidden Empires with TLS - Certified Hypotheses - SANS Cyber Threat Intelligence Summit 2018

Cyber Threat Workshop - 2-17-2022 -Threat Hunting - How to Find Malware Phishing Infrastructure

Catching Malware En Masse: DNS and IP Style

Wireshark Tip 4: Finding Suspicious Traffic in Protocol Hierarchy

Hunting Threat Actors Using OSINT

Full System Emulation: Achieving Successful Automated Dynamic Analysis of Evasive Malware

DEF CON 22 - Mahjoub, Reuille, and Toonk - Catching Malware En Masse: DNS and IP Style

Investigating APT malware with Maltego and ThreatCrowd

How to Improve Threat Detection and Hunting in the AWS Cloud Using the MITRE ATT&CK Matrix

E-MIMICS: Extended Malware in Modern ICS - SANS ICS Security Summit 2021

OpenDNS Investigate Use Case: Find Related Attacker Infrastructure

Detecting the malicious insider (and those masquerading as malicious insiders) - Cindy Cullen

Virtual Machines vs Containers

Threat Intelligence and the Limits of Malware Analysis with Joe Slowik - SANS CTI Summit 2020

Understanding Linux Malware