Open Threat Research - The Hunt for Red Apples: How to threat hunt and emulate Ocean Lotus on macOS

Автор: SANS Digital Forensics and Incident Response

Загружено: 2021-11-26

Просмотров: 1571

Описание:

Open Threat Research (OTR) is a community movement that brings together passionate security researchers from different backgrounds and levels of expertise that have a goal in common to collaborate, share, and contribute to open source initiatives! A group of researchers got together to develop a new project: "The Hunt For Red" Threat Hunt Workshop Series. To kick off the series we concentrated on MacOs and emulated a known adversary: Ocean Lotus.

In this talk we will share the ups and downs of emulating an adversary, our approach and methodology. Leveraging the Attack Life Cycle and Mitre ATT&CK framework we will share threat hunting queries and detection ideas for each stage we emulated. Finally, after the session, we will unveil and open source the final project.

Carlos R, Threat Hunting Operations Lead, Yahoo - / plugxor
Ben Bornholm, DART Engineer, Dropbox - / cptofevilminion

View upcoming Summits: http://www.sans.org/u/DuS
Download the presentation slides (SANS account required) at https://www.sans.org/u/1iaE
#ThreatHuntingSummit #OceanLotus

Open Threat Research - The Hunt for Red Apples: How to threat hunt and emulate Ocean Lotus on macOS

Доступные форматы для скачивания:

Скачать видео mp4

Информация по загрузке:

Скачать аудио mp3

Похожие видео

Full Circle Detection: From Hunting to Actionable Detection

Full Circle Detection: From Hunting to Actionable Detection

Hunting Beacon Activity with Fourier Transforms

Hunting Beacon Activity with Fourier Transforms

SOC Analyst Appreciation Day 2023 - John Hammond SOC Hacks

SOC Analyst Appreciation Day 2023 - John Hammond SOC Hacks

Applying Modular Design to Maintain IR Playbooks at Scale

Applying Modular Design to Maintain IR Playbooks at Scale

Keynote: Threat Hunting: Old Data, New Tricks!

Keynote: Threat Hunting: Old Data, New Tricks!

[Webinar] Partner Spotlight: Jamf

[Webinar] Partner Spotlight: Jamf

Мессенджер против блокировок: Delta Chat спасет от чебурнета

Мессенджер против блокировок: Delta Chat спасет от чебурнета

Keynote | DFIR AI-ze Your Workflow

Keynote | DFIR AI-ze Your Workflow

Рабочая музыка для глубокой концентрации и максимальной производительности

Рабочая музыка для глубокой концентрации и максимальной производительности

Решаем РЕАЛЬНОЕ расследование с помощью OSINT

Решаем РЕАЛЬНОЕ расследование с помощью OSINT

Музыка лечит сердце и сосуды🌸 Успокаивающая музыка восстанавливает нервную систему,расслабляющая

Музыка лечит сердце и сосуды🌸 Успокаивающая музыка восстанавливает нервную систему,расслабляющая

From Threat Research to Organizational Threat Detection w/ O'Shea Bowens & Nico Smith - DFIR Summit

From Threat Research to Organizational Threat Detection w/ O'Shea Bowens & Nico Smith - DFIR Summit

When to Conduct Structured and Unstructured Threat Hunts

When to Conduct Structured and Unstructured Threat Hunts

Digital forensics and security: Automate audits, investigations and response with AWX and Ansible

Digital forensics and security: Automate audits, investigations and response with AWX and Ansible

4 Hours Chopin for Studying, Concentration & Relaxation

4 Hours Chopin for Studying, Concentration & Relaxation

Как охотиться на опасных животных как профессионал: простой способ

Как охотиться на опасных животных как профессионал: простой способ

Extracting the unseen: Real-world RAM acquisition and analysis from Android devices

Extracting the unseen: Real-world RAM acquisition and analysis from Android devices

The Windows 11 Disaster That's Killing Microsoft

The Windows 11 Disaster That's Killing Microsoft

Kubernetes Attack and Defense: Break Out and Escalate!

Kubernetes Attack and Defense: Break Out and Escalate!

Introduction to Digital Forensics: Decoding Digital Evidence

Introduction to Digital Forensics: Decoding Digital Evidence