Главная
Study mode:
on
1
Intro
2
Log Monitoring
3
Problems!
4
It's open source!
5
Rule Format
6
Rule Example: Mimikatz Detection
7
WCE Detection
8
Rule Example: Webshell Reconnaissance Activity
9
Rule Example: Relevant AV Events
10
Rule Example: Suspicious Login Attempts
11
Example: Django Exceptions
12
Challenges in Rule Conversion
13
Sigma Converter Configurations
14
Conversion Process
15
Backend Implementation: Splunk
16
Contributors and Community
17
Current State and Future Work
18
Questions?
Description:
Explore a comprehensive conference talk on Sigma, a generic signature format for log events, presented by Thomas Patzke at Hack.lu 2017. Discover how Sigma addresses the lack of standardization in log signatures, enabling efficient sharing and distribution across heterogeneous environments. Learn about the YAML-based format, open repository of signatures, and the extensible conversion tool that transforms Sigma signatures into various query languages. Gain insights into use cases, rule examples for threat detection, challenges in rule conversion, and the project's development community. Understand the potential impact of Sigma on threat hunting, incident analysis, and SIEM system interoperability. Delve into specific examples of rules for detecting Mimikatz, WCE, webshell reconnaissance, and suspicious login attempts. Explore the current state of the project and future plans for enhancing log-based threat detection and analysis.

Sigma - Generic Signatures for Log Events

Cooper
Add to list