Threat Hunting like a Scientist

Presented at SAINTCON 2019, Oct. 22, 2019, 1:30 p.m. (30 minutes).

As environments become more complex and robust, how do threat hunters stay on their toes to remain quick and effective? The scientific method allows a threat hunter to develop a flow to their working process that ensures they remain on target while deepening their knowledge of the environment they're working in. This presentation will give an overview of how to adapt the scientific method to a threat hunting position on an IT security defense team, while providing a methodology for more effective detection of malicious actors.

Presenters:

• Kimber Duke

Links:

• https://saintcon2019.sched.com/event/W6Us/threat-hunting-like-a-scientist
• https://infocon.org/cons/SAINTCON/SAINTCON 2019/Kimber Duke - Threat Hunting like a Scientist.mp4
• https://infocon.org/cons/SAINTCON/SAINTCON 2019/Kimber Duke - Threat Hunting like a Scientist.eng.srt (subtitles)
• https://www.youtube.com/watch?v=KXr5HRWdZhU

Similar Presentations:

• Black Hat Europe 2017 / Accelerate the Hunt: Make Attackers’ Lives Harder with Effective Threat-Hunting
• Blue Team Con 2022 / Formulating An Intelligence-Driven Threat Hunting Methodology
• Black Hat USA 2022 / The Open Threat Hunting Framework: Enabling Organizations to Build, Operationalize, and Scale Threat Hunting