A|C — This Traffic Looks Suspicious... What Should I Do? | Bill Stearns
Want to level up your threat-hunting knowledge? Take our FREE, hands-on threat hunt training course: https://www.activecountermeasures.com...
0:00:00 - PreShow Banter™ — Spring Driven
0:03:27 - PreShow Banter™ — C2 You Later
0:06:36 - PreShow Banter™ — Shut Down The System
0:12:59 - FEATURE PRESENTATION: This Traffic Looks Suspicious…
0:16:32 - Overview
0:16:44 - Start With Shared Doc
0:19:31 - Pull Together Details
0:20:43 - Investigate Traffic
0:23:24 - Packet Capture
0:25:53 - Pcap Files
0:27:27 - Analysis Tools
0:28:38 - Investigate Hosts
0:30:02 - IP Information
0:30:46 - Investigate Processes
0:33:45 - Using BeaKer
0:35:35 - Compare To Policies
0:38:56 - Final Choice –Good Traffic
0:41:02 - Final Choice – Bad Traffic
0:43:27 - Final Choice – Indifferent
0:45:00 - Cleanup
0:52:13 - Prepare for the Next Time
0:53:53 - Writeup
0:56:00 - Other Things to Consider
1:01:17 - Additional Resources
1:01:48 - Wrap Up Questions
Video Description: Threat Hunting is the first in a series of steps - finding the traffic that might be malicious. But what's next? How do we turn the potential threats into actions?
In this Active Countermeasures (ACM) webcast, Bill Stearns will go over how to investigate the traffic, classify it, and handle it appropriately. We'll look at the traffic in more detail, including how to capture more of it. We'll also look at some excellent sources of information about the IP addresses in question. We'll also look at allow-listing approaches to handle legitimate traffic for your environment.
Active Countermeasures Socials
Twitter: / activecmeasures
LinkedIn: / active-countermeasures
Discord: / discord
Our Threat Hunting Tool ~ AC-Hunter (Formally AI-Hunter)
Features - https://www.activecountermeasures.com...
Interactive Demo Space - https://www.activecountermeasures.com...
Active Countermeasures Open-Source Tools
https://www.activecountermeasures.com...
Educational Threat Hunting Content
FREE 6-Hour Threat Hunt Training: https://www.activecountermeasures.com...
Active Countermeasures Blog: https://www.activecountermeasures.com...
Active Countermeasures YouTube: / activecountermeasures
Learn Threat Hunting Skills from Antisyphon Training
Entry-Level (Pay-What-You-Can): https://www.antisyphontraining.com/pa...
Advanced: https://www.antisyphontraining.com/ad...
Active Countermeasures Shirts
https://spearphish-general-store.mysh...
Our Tribe
Black Hills Infosec: https://www.blackhillsinfosec.com/
Wild West Hackin' Fest: https://wildwesthackinfest.com/
Antisyphon Training: https://www.antisyphontraining.com/