Purpose Driven Hunt - What Do I Do With All This Data
Explore a comprehensive analysis of purpose-driven threat hunting in this conference talk from Derbycon 7. Delve into the problems associated with generic hunt processes and discover the benefits of hypothesis-driven hunting. Learn how to focus data collection efforts, set specific goals for hunt teams, and eliminate analysis paralysis. Examine the MITRE Cyber Attack Lifecycle and understand how to identify tactics, techniques, and procedures. Gain insights on determining collection requirements, defining scope, and documenting excluded factors. Investigate specific examples such as Pass the Ticket attacks and credential theft. Acquire practical knowledge on enumerating logon sessions and detecting Silver Ticket attacks. Access valuable resources to enhance your threat hunting capabilities and stay ahead of evolving cyber threats.