Name: Offensive Countermeasures: Threat Hunting Spotlight with Matthew Hosburgh
Start: 2017-09-14T18:00:00Z
End: 2017-09-14T18:22:35.000Z
Location: BrightTALK

Sqrrl is the threat hunting company that enables organizations to target, hunt, and disrupt advanced cyber threats.

Join us for a Q&A session with SANS Fellow Dr. Eric Cole, as we explore current hunting trends and best practices from Dr. Cole's 20+ years of infosec experience. We'll be diving into topics like:

-Network vs. host-based hunting
-How to jump-start a hunting program
-Current and future trends in threat hunting

Q&A With Hunting Expert Eric Cole

Veteran threat researcher Keith Gilbert sits down for an interview on threat intelligence in hunting. Watch to learn about:

-How to convert data into actionable threat intel
-Best techniques for leveraging threat intel on a hunt
-Tips and best practices from Keith's threat hunting career

The Role of Intelligence in Hunting: Spotlight Interview with Keith Gilbert

In this half-hour interview, Sqrrl sits down with experienced hunter Samuel Alonso for his best advice on threat hunting, focusing on:

- Gaining network visibility (best tools, data sources, and more)
- Samuel's experience as a threat hunter and lessons learned
- Practical tips for both new and experienced hunters

About the Threat Hunter:
Samuel is a Senior Cybersecurity Analyst, formerly working at KPMG. He has extensive experience in threat hunting, information security practices, and business development,

Hunter Spotlight with Samuel Alonso: Gaining Network Visibility

In this month's hunter spotlight, we sit down with Chris Sanders, veteran hunter with over 10 years experience, as we discuss:
 - How to manage different data sources for hunting
 - Best pivoting practices and rules of thumb
 - How to convert findings into actionable intelligence
 - Techniques for reducing evidence abstraction

Knowing and Pivoting Through Your Data (Hunter Spotlight)

This panel reunites the original GE CIRT incident handlers to share their perspective on threat huntings origins and current direction. Topics include:

- Foundations, principles, and how to get started
- Requirements, data sources, and visibility
- Early technologies and approaches
- Personnel development and mentoring
- Challenges, especially at scale

Threat Hunting: Past, Present, and Future

Danny Akacki works on the Hunt Team for a Fortune 100 Finance Company. In this interview, Danny will share his experiences hunting and discuss:

1. What makes a good hunter?
2. What makes a good hunt program?
3. How mature does an org need to be in order to benefit from a hunting program?
4. Why should you avoid hunting before your org is ready?
5.What's the difference between an investigation and a hunt?

Hunter Spotlight: Interview with Danny Akacki, Fortune 100 Hunter

Ryan Nolette, Sqrrl's hunter and security technologist, will break down:
     • Determining what endpoints to investigate in a hunt
     • Pivoting from network to endpoint investigations
     • Essential tools and best practices for endpoint hunting

About the hunter:
Ryan is Sqrrl's primary security technologist and expert. He has previously held a variety of roles including threat research, incident response consulting, and every level of security operations. With over a decade in the infosec field, Ryan has been on the product and operations side of companies such as Carbon Black, Crossbeam Systems, SecureWorks and Fidelity. Ryan has been an active speaker and writer on threat hunting and endpoint security.

Hunting From Network to Endpoint (Hunter Spotlight)

Veteran threat hunter Jason Smith will detail:
     • How to structure your Security Operations Center (SOC) and network to help uncover hidden threats
     • Best practices to make hunting data accessible and fluid
     • Essential tools and tips from Jason's hunting experiences

About the hunter:
Jason Smith has a background in physics and has built everything from particle
accelerators to explosive neutralizing robots used by the military. He has worked in multiple US Department of Defense SOCs and has worked with the largest security vendors to operationalize security in the world's largest
organizations. Jason co-wrote Applied Network Security Monitoring and maintains the open source project FlowBAT, a graphical flow data analysis tool. Jason currently works remotely for Cisco from his home in Nashville, TN.

Conducive Environments for Successful Threat Hunting (Hunter Spotlight)

Our Hunter Spotlight series kicks off with Alan Orlikoski. From his 16+ years of security experience, Alan will share:
     • Organizational strategies that work for both hunters and SOC managers
     • How to create and sustain effective hunting teams
     • Best practices and tools in the field

About the hunter:
Alan Orlikoski is a Security Engineer and Incident Responder with over 17 years of experience. He analyzes and tests existing incident response plans, conducts forensic investigations and provides incident response and forensics training. Alan has an extensive computer forensics background and has been a leader in some of the largest incident response and security operations center development programs in the history of the respective companies.

Leading and Building Threat Hunting Teams (Hunter Spotlight)

Modern SOCs looks very different than those that were built even a few years ago. This webinar discusses the fundamental shifts in thinking and technology that allow security teams to spend more time seeking out and detecting advanced attacks. You'll learn:

     • Key characteristics of high-performing security programs
     • How to react faster and more efficiently to new, advanced threats 
     • Necessary skills for hunt teams and how to measure their performance
     •The effectiveness of threat hunting in reducing the dwell time of adversaries

Modernizing Your SOC: A CISO-led Training

Sqrrl's Security Technologist Josh Liburdi provides an overview of how Sqrrl is used to detect C2 through a combination of automated detection and hunting. You'll learn:

     • How hunting can fill gaps not covered by automated alerts
     • The Hunting Maturity Model and how Sqrrl's capabilities align with it
     • Sqrrl's machine learning TTP detectors use in detecting C2, including Domain Generation Algorithms and DNS tunneling
     • Walkthroughs of detecting C2 with common hunting techniques, including IOC searching and data stacking

Threat Hunting for Command and Control Activity

Watch this training to learn how to uncover advanced threats using DNS and data science. You'll learn:

     • What DNS is and how adversaries can utilize it to carry out attacks 
     • How to use DNS data to launch an incident investigation
     • How to leverage data science techniques to detect DNS behaviors like DGA
     • The practical fundamentals of how these data science techniques work

Leveraging DNS to Surface Attacker Activity

Threat Hunting - An In-depth Explanation

CPE Webinar - Cyber Strong: Preparing the Nation’s Cyber Workforce

Moving to an Active Defense - how far can you go?

Leveraging Threat Hunting To Investigate Advanced Threats

Anatomy of a Cyber Security Breach: The Hero's Journey

Innovate Faster with Collaborative Security

The Best Defense Is An Offense-Informed Defense

First – Fix the Plumbing - What’s broken in cyberspace and How to Fix it

Tracking Hackers - AI cybersecurity for APIs

Threat Hunting Series: Rethinking Persistency

Will Artificial Intelligence Strengthen Your Security Stance?

Addressing The Cyber Skills Gap

Q&amp;A With Hunting Expert Eric Cole

Cyber Threat Predictions &amp; Security for 2018

Threat Hunting – What Is It, and Why Should You Do It

Wear Camouflage While Hunting Threats

An ACE Up the Sleeve: Designing Active Directory DACL Backdoors

Attack and Defense Training: Saving Mr Robot’s WordPress with the Free AppArmor

The Not So Same-Origin Policy &amp; Web Security

Threat Hunting Tool: Sweet Security Supercharged [Hunter Spotlight]

Threat Hunting Scenario: Monitoring for Insider Data Exfiltration

Using the Hacker Supply Chain to Get Ahead of the Attack [Threat Hunting Series]

Threat Hunters in Action

Join us for a new spotlight interview with Matthew Hosburgh, threat hunter for Radian. We'll be talking about:

-Offensive Countermeasures/Decoy Platforms: what they are, and how to use them
-How to build a threat hunting program 
-Threat hunting vs. alert-based investigations

Offensive Countermeasures: Threat Hunting Spotlight with Matthew Hosburgh

threat hunting

dfir

hunting

cybersecurity

infosec

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Offensive Countermeasures: Threat Hunting Spotlight with Matthew Hosburgh

Presented by

About this talk

More from this channel