Intrusion Detection with Windows Event ID’s

This paper is the best I have ever read on how to build IOC’s with Windows Event ID’s. I highly recommend you to read it, it contains very useful information and some very interesting behavioural examples of attacker activity. If you are looking to enhance your detection in your core network this is the document! http://tinyurl.com/zpggnfq

Hunting down Threat Infrastructure (1)

In this two article series, I am going to explain how to spot anomalous activity in proxies and DNS queries coming out of your network. Additionally, I am also explaining how to recognize suspicious threat infrastructure, what elements you need to pay attention to, how this infrastructure behaves, what are the challenges for the defender and…

The evil side of DNS

Detection on this phase of the kill chain is not extremely complex, however from a business perspective it is critical for the organization to find this activity. An attacker who has progressed his attack to the C&C phase may be a dangerous and impactful threat for the business. Whether your organization is part of botnet…

December webinars

I leave you here some interesting webinars for those looking to get some CPE credits. I am currently researching the role of the use of privileges accounts in the attack lifecycle and some of these webinars focus on the subject. The Most Travelled Attack Path: Securing the Privileged Pathway Stopping Attacks Before They Stop Business…

Advance Hunting and Content Development with RSA Analytics

Looking to extend my knowledge on Security Analytics from RSA I came across this video. It explains very well some of the capabilities SA from RSA provides, also some good practices to follow such as involved defenders in content development. It is a long video but easy to watch.