Dabble or Deep Dive: 7 Different Threat Hunts You Can Do With Available Resources In this real training for free session, we will discuss the minimum toolset and data requirements (and not necessarily volume) you need for successful threat hunting. We will take into account that while some of you can devote most of your time to threat hunting, most of us have limited time and resources for this activity. The good news is that threat hunting is flexible and anyone can do it, ranging from a few hours a week to full-time. As just one example, a great type of threat hunting is to look for unrecognized/suspicious executables running on you network. You can dip your toe in the water with this type of hunt with a small commitment of time and resources or you can plunge in deep with a major data collection and analysis effort. Starting out simple means you just focus on EXE names; baseline the EXE names being executed on your network, and then perform a daily review of new EXE names showing up for the first time. You can get this information from event ID 4688 and the query capabilities are very light. But I think you’ll be surprised what you are able to learn and catch. We will take the same approach with a total of 7 types of threat hunting: Recognizing suspicious software Scripting abuse AV follow-up Lateral movement Persistence DNS abuse Bait-the-bad-guy LogRhythm is sponsoring this real training for free event and Nathan Quist (aka “Q”) is helping me on this event. Q is LogRythm’s Threat Research Engineer and works with LogRhythm’s internal SOC team and its clients to perform deep dives into their environments to uncover threats facing our industry.

Hora

19:00 - 20:00 hs GMT+1

Organizador

LogRhythm | The Security Intelligence Company
Compartir
Enviar a un amigo
Mi email *
Email destinatario *
Comentario *
Repite estos números *
Control de seguridad
Agosto / 2019 472 webinars
Lunes
Martes
Miércoles
Jueves
Viernes
Sábado
Domingo
Lun 29 de Agosto de 2019
Mar 30 de Agosto de 2019
Mié 31 de Agosto de 2019
Jue 01 de Agosto de 2019
Vie 02 de Agosto de 2019
  • Ask an Expert: Windows

    19:00 - 20:00 hs GMT+1

    Fecha
    Vie 2-Ago-2019, 19:00 - 20:00 hs GMT+1
    Descripción
    As Ansible has grown in popularity, so have its ability to automate Windows systems. Whether you’re deploying Windows in the cloud, or managing on-prem instances, Ansible offers a number of capabilities that can help with the deployment and management of (...)
    Cerrar
  • Ask an Expert: Windows

    19:00 - 20:00 hs GMT+1

    Fecha
    Vie 2-Ago-2019, 19:00 - 20:00 hs GMT+1
    Descripción
    As Ansible has grown in popularity, so have its ability to automate Windows systems. Whether you’re deploying Windows in the cloud, or managing on-prem instances, Ansible offers a number of capabilities that can help with the deployment and management of (...)
    Cerrar
Sáb 03 de Agosto de 2019
Dom 04 de Agosto de 2019
Lun 05 de Agosto de 2019
Mar 06 de Agosto de 2019
Mié 07 de Agosto de 2019
Jue 08 de Agosto de 2019
Vie 09 de Agosto de 2019
Sáb 10 de Agosto de 2019
Dom 11 de Agosto de 2019
Lun 12 de Agosto de 2019
Mar 13 de Agosto de 2019
Mié 14 de Agosto de 2019
Jue 15 de Agosto de 2019
Vie 16 de Agosto de 2019
Sáb 17 de Agosto de 2019
Dom 18 de Agosto de 2019
Lun 19 de Agosto de 2019
Mar 20 de Agosto de 2019
Mié 21 de Agosto de 2019
Jue 22 de Agosto de 2019
Vie 23 de Agosto de 2019
Sáb 24 de Agosto de 2019
Dom 25 de Agosto de 2019
Lun 26 de Agosto de 2019
Mar 27 de Agosto de 2019
Mié 28 de Agosto de 2019
Jue 29 de Agosto de 2019
Vie 30 de Agosto de 2019
Sáb 31 de Agosto de 2019
Dom 01 de Agosto de 2019

Publicidad

Ofertas de empleo para profesionales IT en España y América Latina - TIC-Jobs.com

Ofertas de empleo IT, TIC, ERP, Consultor, Administrador, Programador, Desarrollador, Business Intelligence, BI, Business Process Management, BPM, CRM, Dynamics, ECM, RRHH, SAP, Sharepoint, WCM, Sharepoint, Navision, España, México, Argentina, Chile, Brasil,Perú

Lo más leído »

Publicidad

Más Secciones »

Hola Invitado