Hunting Shadows: Detecting "Git-Native" Botnets with OpenSearch Ano...
summary
Claims a practical OpenSearch pipeline that detects "Git‑Native" botnets by math not signatures, ingesting Kubernetes audit logs, VPC flow logs and Fluent Bit into OpenSearch and Dashboards to run aggregations and anomaly queries. Repo Jitter identifies deterministic polling (example exact 600s heartbeat, stddev <0.5) ; User-Agent Anomalies flag go‑git/libgit2 in production pods ; temporal correlation shows a 100% CPU spike coincident with a git pull, proving the kill chain and successfully flagging infections.
AI-written summary · about
related talks
39mDemystifying Anomaly Detection in OpenSearch
01h 00mRock ‘Em Sock ‘Em Robots: Bot Swatting Like the Pros
32mGuardians of the Cloud Navigating the Depths of Cloud Threat Hunting
13mSecuring the Data Frontier: Real-World Strategies With OpenSearch
21mKubernetes Under the Magnifying Glass: Observability With OpenSearch
30mTrawling for IOCs: Catching C2 in a Sea of Data
42mTracking Attackers in Open Source Supply Chain Attacks: The New Frontier
23mBot or human? Detecting malicious bots with machine...