Detection Technique Deep Dive

Having detection techniques at hand – which you can apply in systematic approaches across different environments – is a ninja skill detection engineers and threat hunters need to have. In this session, Senior Threat Hunter Doug Brown will provide you with just that. Join Doug as he explores a range of concrete search techniques to measure a variety of behavioural changes, and demonstrates how to map those to MITRE ATT&CK techniques. Attend this session to learn how to: Map advanced statistics to MITRE ATT&CK techniques Detect spikes with median absolute deviation and handle data with seasonality Identify first-time events in new values seen in a field or combination of fields, including cardinality of distinct fields to measure behaviour change Detect C2 beaconing through domain parking and lateral movement with RDP for first-time users by applying simple sequencing techniques Plus, you’ll get bonus examples of highly complex sequencing approaches.