Главная
Study mode:
on
1
Introduction
2
What Works Finding Intrusions?
3
What Do I Mean by "Hunting"?
4
Shimcache/Amcache
5
Shimcache Examples
6
What to Look for in the Shimcache/ Amcache Data
7
Server Antivirus Logs
8
Mining Netstat Data
9
User-Agent strings
10
User-Agent examples
11
o. Windows Services Example
12
+ Windows Drivers Example
13
Windows Autoruns
14
Autoruns - Examples
15
Windows Prefetch
16
Prefetch Examples
17
+ Checking How Outsiders See You
18
NTFS Extended Attributes
19
EMET Log Mining - Example
20
Hunting in RAM dumps
21
Closing Thoughts
22
Questions?
Description:
Explore practical techniques for intrusion hunting in this 46-minute conference talk from Derbycon 2015. Learn effective methods for detecting intrusions, including analyzing Shimcache/Amcache data, server antivirus logs, and netstat data. Discover how to identify suspicious user-agent strings, examine Windows services and drivers, and investigate autoruns and prefetch data. Gain insights into checking your external visibility, understanding NTFS extended attributes, and mining EMET logs. Delve into RAM dump analysis for advanced hunting techniques. Equip yourself with valuable tools and strategies to enhance your cybersecurity defenses and detect potential threats in your systems.

Intrusion Hunting for the Masses - A Practical Guide

Add to list