Keynote: Multiplying Threat Intelligence
summary
Outlines concrete ways to generate more threat intelligence: collect and retain broad logs so every attacker contact leaves a trace, pivot from host to identity to network using selectors, and hunt attackers outside the estate via low-cost feeds. Shows specific detections — find a registry set for sticky keys (Shift pressed five times) then pivot to the malware installer, deleted legal notice and turbo mailer downloads — and use honeypots that induce failures to reveal backup C2 domains. Uses crash‑dump skeleton signatures (getPC, nop sled, egg hunt) and time travel breach detection to find persistence and zero‑days.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:08Why Im here
- 6:22Myths about defense
- 9:00Foundation Concepts
- 11:41Attacker Actions
- 13:03Pivoting
- 14:31Zoom Out
- 16:01Sticky Keys Attack
- 17:50Attack Session
- 19:49Time Travel Breach
- 21:51Looking for Failure
- 23:15Induce Failure
- 24:27Honeypots
- 25:24Crash dumps
- 28:07Attack elements
- 30:39Bones of a skeleton
- 31:13Professional Attackers
related talks
29mThrough the Eyes of the Adversary: How to Build a Threat Intel Program
42mKeynote: The Expanding Universe of Cyber Threats
55mKeynote - The Future of Cybersecurity Needs You, Here is Why.
45mKeynote Address: Click Here to Hack Your Target: A Perspective on the Past...
40mHunt and Gather: Developing Effective Threat Hunting Techniques
42mStart Covering Your Bases And Stop Chasing APT Headlines
34mFormulating An Intelligence-Driven Threat Hunting Methodology
54mmacOS: Tracking High Profile Targeted Attacks, Threat Actors & TTPs