Threat Hunting: Network Data

Contents

• Introduction Introduction

  • Network threat hunting essentials: Staying proactive

    49s
  • The importance of network threat hunting

    2m 54s
• 1. Thinking like the Adversary: Threat Actors 1. Thinking like the Adversary: Threat Actors

  • Threat actor types and motivations

    4m 44s
  • (Locked)
    Crown jewel identification

    2m 33s
• 2. Network Data Sources 2. Network Data Sources

  • (Locked)
    Network threat hunting data sources

    2m 52s
  • (Locked)
    Threat hunting in packets

    4m 14s
  • (Locked)
    Threat hunting using network flow

    5m 17s
  • (Locked)
    Threat hunting in infrastructure logs

    3m 53s
• 3. Network Threat Hunting Tools 3. Network Threat Hunting Tools

  • (Locked)
    Use an SIEM (Security Information and Event Management) for threat-hunting

    4m 13s
  • (Locked)
    Use Wireshark for threat-hunting

    4m 27s
  • (Locked)
    Use IDS or IPS for threat-hunting

    6m 40s
  • (Locked)
    Use Bro or Zeek for threat-hunting

    3m 51s
  • (Locked)
    Security Onion

    4m 52s
• 4. Hunting the Undetected 4. Hunting the Undetected

  • (Locked)
    Leverage IOCs in threat hunting

    3m 52s
  • (Locked)
    Baseline to identify anomalies

    4m 7s
  • (Locked)
    Least frequency analysis to identify outliers

    4m 15s
  • (Locked)
    Hypothesis threat hunting

    3m 42s
• 5. How Hackers Abuse Protocols 5. How Hackers Abuse Protocols

  • (Locked)
    HTTP protocol attack methods

    5m 7s
  • (Locked)
    HTTPS protocol attack methods

    3m 58s
  • (Locked)
    SMB protocol attack methods

    3m 34s
  • (Locked)
    DNS protocol attack methods

    3m 27s
• 6. Network Threat Hunts 6. Network Threat Hunts

  • (Locked)
    Hunt command and control (C2)

    6m 8s
  • (Locked)
    Hunt lateral movement

    1m 30s
  • (Locked)
    Hunt remote desktop software

    4m 52s
• Conclusion Conclusion

  • (Locked)
    Continue with network threat hunting

    43s