Enhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns
summary
Tracks hands‑on‑keyboard Linux intrusions, noting raw counts rising from 660 in 2020 to 958 in 2021 and a jump from ~3–4 to dozens per week; uses MISP repurposed for intrusion enrichment, MITRE ATT&CK tagging and a SEARCH framework to standardize events, command lines and timing. Analysts parse wget/chmod/frpc attempts, EDR blocking of binaries and failed bash reverse shells, and map noisy telemetry, process lineage gaps and distro/kernel variance while building an internal tool to correlate command arguments to techniques.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 2:00What is intrusion research
- 4:00Why intrusion research
- 6:30Data management
- 10:00Search framework
- 11:50Linux intrusions
- 17:57Techniques
- 19:00Heat Map
- 20:13Case Study
- 27:23Questions
related talks
42mKeynote: The Expanding Universe of Cyber Threats
51mTrack the Attacker’s Actions — Understanding and Investigating Cross‑Cutting Intrusions Based on Behavior Patterns
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
40mThreat Informed Planning with Macro-level ATT&CK Trending
27m“Why are they asking me to do this?” or Adventures in IR Land
26mLooking at 4 years of web honeypot attacks: tactics, ...
32mHey Attacker! I Can See You!
40mStrengthening Cyber Resiliency in a Time of Geopolitical Crises...