“Why are they asking me to do this?” or Adventures in IR Land
summary
X‑Force finds a spike in Linux malware in 2020 with more cryptominers and ransomware and Linux variants of Defray/REvil‑like families; response uses the NIST 800‑61r2 lifecycle: preparation, detection, containment, recovery. Typical asks are deploy an EDR, run triage collectors like Velociraptor or UAC, and upload artifacts (/etc, /home, /var — check wtmp btmp lastlog and memory) to cloud storage. Containment happens via network quarantine or EDR isolation, recovery uses clean restores after validating backups, and post‑incident work updates playbooks, runs tabletop exercises and considers a retainer for third‑party IR.
AI-written summary · about
chapters (9)
- 0:00Introduction
- 1:10About me
- 1:58Agenda
- 4:31Security Incident
- 5:43Security Incident Diagram
- 6:07Preparation
- 11:18Detection Analysis
- 14:55Containment
- 18:00Lessons Learned
related talks
51mReal World Stories of Incident Response and Threat Intelligence
24mThreat Response Needs New Thinking. Don't Ignore This Key Resource.
40mIncident Response – How to Give the Advantage to the Hackers!
45mChoose Your Own Adventure: Group Interactive IR Scenario
39mBattle-Tested Incident Recovery: Lessons from the Front Lines
52mRansomware; The Real Pandemic
33mBasic Malware Analysis for Incident Responders
35mEnhancing Operations Through the Tracking of Interactive Linux-based Intrusion Campaigns