4. Examples: Cloud logging. Dropbox logins. Example query
11
Dropbox logins cont.
12
4. Examples: Windows Office Macro Implants
13
Skip a few steps...
14
End result
15
4. Examples: Windows Powershell
16
Windows PS cont
17
4. Examples: Mac implants wlosquery
18
Mac & osquery cont: (edited for readability)
19
4. Examples: Mac implants w/Santa
20
4. Examples: Network monitoring Bro FTW
21
Q&A Questions? Comments?
Description:
Explore effective intrusion detection strategies in this BSidesSF 2017 conference talk. Learn how to build a robust program using affordable or free tools, focusing on cloud applications, endpoints, and network security monitoring. Discover techniques to identify and mitigate modern breaches, which often go undetected for extended periods. Compare recent high-profile security incidents and learn timely detection methods. Gain insights into logging best practices, Network Security Monitoring (NSM), and platform-specific tools for Mac and Windows environments. Examine real-world examples of cloud logging, including Google and Dropbox logins, as well as detecting Windows Office Macro implants and PowerShell threats. Investigate Mac implants using osquery and Santa, and explore network monitoring with Bro. Enhance your organization's security posture by implementing crowd-sourced incident response techniques and leveraging the power of effective intrusion detection.