How to Hunt for Lateral Movement on Your Network

Presented at DerbyCon 7.0 Legacy (2017), Sept. 23, 2017, noon (50 minutes)

"Once inside your network, most cyber-attacks go sideways. They progressively move deeper into the network, laterally compromising other systems as they search for key assets and data. Would you spot this lateral movement on your enterprise network? In this training session, we review the various techniques attackers use to spread through a network, which data sets you can use to reliably find them, and how data science techniques can be used to help automate the detection of lateral movement." Ryan is Sqrrl's primary security technologist and expert. He has previously held a variety of roles including threat research, incident response consulting, and every level of security operations. With over a decade in the infosec field, Ryan has been on the product and operations side of companies such as Carbon Black, Crossbeam Systems, SecureWorks and Fidelity. Ryan has been an active speaker and writer on threat hunting and endpoint security.

Presenters:

• Ryan Nolette

Links:

• https://www.derbycon.com/saturday-schedule/#event-87
• https://infocon.org/cons/DerbyCon/DerbyCon 7 2017/How to Hunt for Lateral Movement on Your Network Ryan Nolette.mp4

Similar Presentations:

• Black Hat USA 2017 / The Industrial Revolution of Lateral Movement
• GrrCON 2014 / Advanced Threats and Lateral Movement Protection
• Shakacon X (2018) / Network Defender Archeology: An NSM CaseStudy in Lateral Movement with DCOM