Don't Blame the User! Stop the Phish Before it is Even Sent
summary
Teams detect and block phishing long before inbox delivery by catching domain OPSEC mistakes and correlating related infrastructure: register-watch and typo/combo/doppelganger lists, alert on dnstwister.report hits and lookups in certificate transparency logs (which can catch roughly half of naive setups), pivot via VirusTotal graph and image/favicon hash searches to find sibling sites, and apply reputation-based filtering plus Mailgun/SendGrid policy checks. If those fail, enforce signed-macro, AppLocker/Exploit Guard, file filtering and EDR to prevent execution.
AI-written summary · about
chapters (7)
- 0:00Phishing defense intro
- 2:15Malicious phishing setup
- 8:53Domain detection techniques
- 15:14Block phishing campaigns
- 21:55Endpoint hardening
- 23:22User protection summary
- 24:53Red team vs attackers Q&A
related talks
41mHook, Line, & Sinker - Addressing the Human Risk of Phishing and How to Avoid the Bait
05mKnowledge and Capabilities that Non-Expert Users Bring to Phishing Detection
09mBridging the Gap: Developing Accessible Anti-Phishing Solutions
39mProtecting SaaS Users Against Phishing: How to Partner Up with Developers
30mEvasive Maneuvers: Trends in Phishing Evasion & Anti-Evasion
29mHook, Line, and Tinker: A Dive into Phishing Campaign Sites
58mCatching Transparent Phish: Understanding and Detecting MITM Phishing Kits
38mClick Here Now: A Positive Way to Create Phishing Awareness