Watch Threat Hunting Web Shells With Splunk in New Channel | Channify

Threat hunting is a proactive search for signs and artifacts of malicious activity. This is rather different than responding to a signature based alert that we typically see in a SIEM or IDS/IPS. Because of this proactive approach, the “hunter” spends most of their time combing through very large datasets looking for a needle in a haystack. These datasets could be almost anything from DNS queries for a given enterprise to Sysmon logs for all the servers and workstations. Because of the sheer amount of data the hunter needs to sift through it’s important to have a way to index, store, and search through that data. This is where Splunk really saves the day. In this talk we’ll be going through some easy but powerful hunts using Splunk and Bro IDS logs to find common web shells. This is just a taste of what you can build on your own and will hopefully show you the extremely high ROI that Threat Hunting can provide. ******************** ABOUT JAMES BOWER James Bower is a Managing Partner at Quantum Security - a strategic Threat Hunting and Threat Intelligence consulting firm based in Atlanta, GA. He is also the creator of Engaged Threat, a counter deception technology that aids in the attribution of cyber criminals. With over 15 years of hands-on Information Security experience, James’s versatility allows him to move seamlessly between the trenches and the board room giving him a truly unique perspective. He has applied his innovative and resourceful background across multiple sectors for a diverse list of Fortune 500 companies. When not consulting James maintains a steadfast focus on advancing various areas of InfoSec including, adversary hunting, threat intelligence, big data, and machine learning. Since 2015, James has lead the Threat Intelligence and Threat Hunting Meetup Group, where he manages various events and workshops for the Atlanta cyber security community. ******************** SUBSCRIBE FOR FUTURE INFOSEC VIDEOS: LET'S CONNECT! Twitter ► https://twitter.com/jamesbower Web ► https://www.jamesbower.com Linkedin ► https://www.linkedin.com/in/jamesbower/ Quantum Security ► http://www.quantsecurity.com