Monday, 4 May
Tuesday, 5 May
Wednesday, 6 May
Thursday, 7 May
Friday, 8 May
Monday, 11 May
Tuesday, 12 May
Wednesday, 13 May
Monday, 4 May | |
---|---|
17:00 – 18:00 | NL Building an Intelligence-Driven Organization Anastasios Pingios (Booking.com, NL) |
18:00 – 19:00 | LU Alexandre Dulaunoy , Andras Iklody (CIRCL.LU, LU) |
Tuesday, 5 May | |
---|---|
17:00 – 18:00 | GB Deep Derp Web? - Is Criminal Intel from 'Dark Web' Really Still Effective? James Chappell (Digital Shadows, GB) |
18:00 – 19:00 | CA Lennart Maschmeyer (University of Toronto, CA) |
Wednesday, 6 May | |
---|---|
17:00 – 18:00 | NL CTI Collaboration Using STIX and Elasticsearch Chris O'Brien (EclecticIQ, NL) |
18:00 – 19:00 | US Sebastien Tricaud (Devo Inc., US) |
Thursday, 7 May | |
---|---|
17:00 – 18:00 | US MalDomain ML: A Machine Learning Model to Find Malicious Domains Before They Go Bad John Bambenek (Bambenek Consulting, LTD, US) |
18:00 – 19:00 | DE rcATT: Retrieving ATT&CK Tactics and Techniques in Cyber Threat Reports Marco Caselli (Siemens, DE) |
Friday, 8 May | |
---|---|
09:00 – 10:00 | JP Rethinking the Graph Visualization for Threat Reports Mayo Yamasaki (NTT-CERT, JP) |
10:00 – 11:00 | US xHunt... An Anime Fan's Attack Campaign in the Middle East Brittany Barbehenn, Robert Falcone (Palo Alto Networks, US) |
Monday, 11 May | |
---|---|
17:00 – 18:00 | NL Narrator: Generating Intelligence Reports from Structured Data Jörg Abraham, Sergey Polzunov (EclecticIQ, NL) |
18:00 – 19:00 | NL Obtaining Cyber Threat Intelligence through Reverse Engineering Matthijs Bomhoff (Tesorion, NL) |
Tuesday, 12 May | |
---|---|
17:00 – 18:00 | US Bringing Intelligence into Cyber Deception with MITRE ATT&CK Adam Pennington (MITRE, US) |
18:00 – 19:00 | NL Understanding What's Next; Combining Red Team Findings and Adversary Playbooks Gert-Jan Bruggink (Falconforce, NL) |
Wednesday, 13 May | |
---|---|
17:00 – 18:00 | US How I Became Our Own Worst Enemy, I Mean Adversary John Stoner (Splunk, US) |
18:00 – 19:00 | US From ‘Fog of War’ to Reducing Noise in Daily Operations Graham Westbrook (Living Security , US); Wilson Bautista (Jün Cyber, US) |
Lennart Maschmeyer (University of Toronto, CA)
Lennart Maschmeyer is a senior researcher at the Center for Security Studies. His current book project focuses on the nature of cyber power and the causes of escalation and restraint in cyber conflict. In particular, his research examines how and why operational constraints explain the puzzling dynamics of conflict at the strategic level. Lennart is also working on a second research project compiling a dataset of all public reporting on cyber attacks by commercial threat intelligence vendors. The purpose of this project is to identify sources of bias in the data and how such bias distorts threat perception among both scholars and policymakers.
Lennart recently completed his PhD at the University of Toronto and holds an M.Phil in International Relations from the University of Oxford. He previously held fellowships at the University of Toronto’s Citizen Lab and at Columbia University’s School of International and Public Affairs.
Public and academic knowledge of cyber conflict relies heavily on data from commercial threat reporting. There are reasons to be concerned that these data provide a distorted view of cyber threat activity. Threat intelligence vendors only focus on a subset of the universe of cases, and they only report publicly on a subset of the subset. High end threats to high-profile victims are overrepresented in commercial reporting while threats to civil society organizations, which cannot afford high-end cyber defense, tend to be underrepresented. This selection bias not only hampers scholarship but also has concerning consequences for democracy. We present and analyze an original dataset of commercial threat reporting together with independent research centers. We also present three case studies tracing reporting patterns on a cyber operation targeting civil society. If we conceive of public threat reporting as a public good, then collective action theory leads us to expect that the commercial interests of firms will produce a systematic bias in reporting, which functions as much as advertising as intelligence. The result is a truncated sample of cyber conflict that risks distorting perceptions. We thus reflect on the role academia could play in alleviating this situation.
May 5, 2020 18:00-19:00
Adam PenningtonAdam Pennington (MITRE, US)
Adam Pennington (@_whatshisface), Principal Cyber Security Engineer, MITRE Adam Pennington is a member of the core ATT&CK team, and collected much of the intelligence leveraged in creating its initial techniques. He has spent much of his 10 years with MITRE studying and preaching the use of deception for intelligence gathering. Prior to joining MITRE, Adam was a researcher at Carnegie Mellon's Parallel Data Lab and earned his BS and MS degrees in Computer Science and Electrical and Computer Engineering as well as the 2017 Alumni Service Award from Carnegie Mellon University. Adam has published in a number of venues including USENIX Security and ACM Transactions on Information and System Security.
Deception has become a popular concept in cybersecurity, but are we really fooling adversaries? Honeypots and other technical solutions often don’t align with what real adversaries do. This presentation will examine how we can successfully deceive adversaries by using threat intelligence mapped to MITRE ATT&CK™.
In classical deception planning, intelligence serves a key role in understanding an adversary’s likely beliefs, expectations, and reactions, but this often hasn’t carried over into the cyber realm. In this talk, I’ll show how to bridge that gap and leverage ATT&CK for cyber deception planning. I’ll present a methodology for making decisions on where to focus deception resources based on adversary techniques and how to align deception capabilities with the expectations and visibility of real cyber threat actors. Attendees will learn how they can leverage cyber threat intelligence to deceive their adversaries and gain valuable new intelligence as they do so.
May 12, 2020 17:00-18:00
Pennington-ATTACK-Deception-FIRST-CTI-pr.pdf
MD5: 48886e1863b4c30c97029569180b4999
Format: application/pdf
Last Update: May 12th, 2020
Size: 18.87 Mb
Anastasios PingiosAnastasios Pingios (Booking.com, NL)
Anastasios Pingios is a security professional who started from the exploit development and vulnerability research side around 15 years ago and later on switched to the defensive side. He holds a M.Sc. in Secure Computing Systems from the University of Hertfordshire, numerous certifications on the subject of intelligence collection and intelligence analysis, and has presented a wide variety of topics from unconventional phishing techniques, to secure architecture in the cloud, and building successful intelligence teams. Currently, Anastasios is Principal Security Engineer at Booking.com and for the last few years he has been focusing on threat intelligence from a holistic perspective that takes into account all domains instead of just cyber.
The talk goes through the journey from having no dedicated threat intelligence resources, to having an intelligence-driven organization. We will go through the different phases, key challenges and how to overcome them, as well as how to measure and demonstrate the value and maturity of intelligence-driven security. The goal of this talk is to help you avoid common mistakes in the process of building a threat intelligence function, and later on maturing and expanding it to more areas within your organization and the community.
May 4, 2020 17:00-18:00
FIRST-2020-CTI-Webinar-Series-Building-an-intelligence-driven-organization-Pingios.pdf
MD5: 1bdb401b64bfa0d7f4c082eb9bfbd45f
Format: application/pdf
Last Update: May 4th, 2020
Size: 726.71 Kb
Chris O'BrienChris O'Brien (EclecticIQ, NL)
Chris O'Brien is a SANS Cyber Guardian and card-holding structured intelligence diehard. He has worked across public and private sectors as an intrusion analyst, incident responder and CTI specialist. Chris now dedicates his time to enabling practitioners through CTI tooling and structured data modelling.
The combined knowledge of the cyber security and intelligence community is vast and yet many teams still work in splendid isolation. This talk will work through an example, active intrusion set - worked on in separate teams - to show the highs and lows of parallel analysis. We investigate how multiple viewpoints increase intelligence quality but also introduce bias and data complexity - and then show how to solve that with (free) technology.
In this talk we explore the concepts that underpin true intelligence collaboration and describe a means to achieve it using STIX and elasticsearch. This method applies the core concepts of search (elasticsearch), provenance (in a git-like way) and data modelling (purist STIX) to produce a truly global and collaborative threat intelligence repository.
May 6, 2020 17:00-18:00
200211-FIRSTCTI-CTI_Collaboration_final.pdf
MD5: b4b50810003cccca11f93d57a6949df4
Format: application/pdf
Last Update: May 12th, 2020
Size: 1.43 Mb
James Chappell (Digital Shadows, GB)
James Chappell is the Co-Founder and Chief Innovation Officer at Digital Shadows. He has led teams in InfoSec and Cybersecurity since 1997, working across the private sector and government organizations helping them to understand the technical aspects of information security.
James spent over ten years of his career as a security architect and deputy head of the Information Security profession at BAE Systems Detica; he previously worked at Nortel Networks in the United States. James has always been fascinated by innovative ways of counteracting the growth of crime and fraud in computer networks and developing effective ways of measuring and managing the security big picture. In 2011 this journey led to an exploration of digital footprints, and their impact on the security of the modern business. James is a regular speaker at technology events and cybersecurity conferences across the globe and is regularly quoted in the press.
The cybercrime landscape persists, despite now frequent interventions by law enforcement. Still, as markets, forums, and other sources of information continue to persist online, defenders have the ability to use the information being discussed, traded, and harvested to their advantage. How have these interventions from Law Enforcement changed behaviours of criminals and can actionable intelligence still be drawn when the criminal groups exhibit an increased awareness that they are being observed? Actionable intelligence can be gained by studying these areas. The goals of this talk are to:
May 5, 2020 17:00-18:00
Graham WestbrookGraham Westbrook (Living Security , US), Wilson Bautista (Jün Cyber, US)
Graham J. Westbrook, Dir. of Intelligence & Content, Living Security. Graham is an intelligence analyst by training, cybersecurity analyst by trade and creative at heart. He is responsible for managing Living Security's threat intelligence program and content strategy for the Living Security (SaaS) platform. A writer with bylines at top cybersecurity firms, Graham holds a B.A. in Intelligence studies and Russian from Mercyhurst University and an M.S. in Criminal Justice and Forensic Psychology from Liberty University. Speaker at InfoSecWorld 2019, RMISC 2019, Toronto RiskSec 2017 & SANS Security Awareness Summit 2017.
Wilson Bautista, Jr. is a retired US military officer who is currently the founder of the consulting firm Jün Cyber. His expertise is in the domains of InfoSec leadership, policy, architecture, compliance, and risk. He holds multiple InfoSec and IT certifications as well as a Masters Degree in Information Systems from Boston University. He is an INTP on the Myers-Brigg Type Indicator test with a Driver-Driver personality. As a practitioner of Agile and SecDevOps, he develops innovative, integrated, enterprise-scale cyber security solutions that provide high value to businesses.
The fog of war is an old metaphor to describe uncertainty and fatigue during war-time. New research suggests that noise is a more accurate metaphor to describe the deafening uncertainty and alert fatigue we experience in daily operations. Cyber threat intelligence (CTI) is no exception. Our goal is to reduce uncertainty for decision-makers (human and machine) in combating cyber threats. But what if, before all else, that decision-maker is you?
We need to rethink what ""intelligence"" really means and how it is applied across our organizations. This session will zoom out from the CTI front-lines to help analysts and leaders alike understand the relationship between mind and machine, the necessity of separating noise from signal and the tools for acting with confidence. We will reimagine how we can develop priority intelligence requirements (PIRs) to address business risk, explore a new framework for reducing decision fatigue and understand how to use principles of intelligence analysis to achieve our mission. From hardware to end user, this is one discussion you don’t want to miss.
May 13, 2020 18:00-19:00
MD5: 64a93b212baef6e9d7b6ff10ac6dc25c
Format: application/pdf
Last Update: May 12th, 2020
Size: 3.19 Mb
John Stoner (Splunk, US)
John Stoner is a Principal Security Strategist at Splunk. In his current role, he leverages his experience to educate and improve users’ capabilities in Security Operations, Threat Hunting, Incident Response and Threat Intelligence. He has authored multiple hands-on workshops that focus on enhancing these specific security skills. His writings can be found on Splunk blogs, most notably in the Hunting with Splunk: The Basics and Dear Buttercup: The Security Letters series. John developed and maintains a Splunk application that drives greater situational awareness and streamlines investigations. He enjoys problem solving, writing and educating. When not doing cyber things, John is often found reading or binge-watching TV series that everyone else has already seen. During the fall and winter, you can find him driving his boys to hockey rinks across the northeast part of the United States. John also enjoys listening to as his teammates call it "80s sad-timey music."
No, this isn't a tale about an impending downward spiral or a fictional story with the classic conflict between man versus self, this is an opportunity to share with you how I created an adversary based on CTI and the MITRE ATT&CK framework that we are using to educate blue teamers to be more effective hunting threats and conducting security operations!
During this talk, we will look at why we perform adversary emulations, how our adversary was constructed and how CTI reported TTPs were leveraged to create a realistic scenario for our adversary to carry out their attack. We will look at how a framework like MITRE ATT&CK can be used to help develop the scenario as well as how it can be used post attack to understand technique coverage across an organization. We will also talk about the challenges encountered along the way when constructing the scenario.
Coming out of this talk, you will have a better understanding of what it takes to create your own adversary, a better appreciation around the symbiotic relationship between threat hunting, security operations and threat intelligence as well as a model to create your own APT scenarios if you wish!
May 13, 2020 17:00-18:00
FIRST_CTI2020-Become-Your-Own-Adversary.pdf
MD5: be9085d662b7fb171b8fa23223020709
Format: application/pdf
Last Update: May 15th, 2020
Size: 49.41 Mb
John Bambenek (Bambenek Consulting, LTD, US)
John Bambenek is VP of Security Research and Intelligence at ThreatSTOP, a lecturer in the Department of Computer Science at the University of Illinois at Urbana-Champaign, and a handler with the SANS Internet Storm Centre. He has over 18 years experience in Information Security and leads several International investigative efforts tracking cybercriminals - some of which have lead to high profile arrests and legal action. He currently tracks neonazi fundraising via cryptocurrency and publishes that online to twitter and has other monitoring solutions for cryptocurrency activity. He specializes in disruptive activities designed to greatly diminish the effectiveness of online criminal operations. He has produced some of the largest bodies of open-source intelligence, used by thousands of entities across the world.
Machine learning is touted as a way for security teams to reduce their workload by creating smart systems that can do the work of analysts quickly so humans can focus on those things that truly require human analysis. This talk will cover a new machine learning tool called MalDomainML that uses a machine learning model produced using extracted DNS features to reliably (over 96% accuracy) predict whether an arbitrary domain is malicious.
May 7, 2020 17:00-18:00
Jörg Abraham
Sergey PolzunovJörg Abraham (EclecticIQ, NL), Sergey Polzunov (EclecticIQ, NL)
Mr. Jörg Abraham is a Senior Threat Intelligence Analyst in the EclecticIQ Fusion Center. He is responsible for analyzing Cyber Threats and providing accurate, timely and structured intelligence relevant to EclecticIQ's customers. Before joining EclecticIQ he has been working for Royal Dutch Shell for more than 10 years in various Cyber Defense positions. Mr. Jörg Abraham is a Certified Information System Security professional (CISSP) and GIAC Certified Forensic Analyst (GCFA).
Sergey Polzunov is a Senior Software Engineer in the EclecticIQ Intelligence Operations department. He is responsible for prototyping analyst-centric tools and for extending the Fusion Center Threat Intelligence Platform with new features. He is the author of OpenTAXII server and Stixview library, and has more than 10 years of software development experience.
Natural Language Generation (NLG) is the process of transforming structured data into narratives. Contrary to Natural Language Processing (NLP) that reads and analyses textual data to derive analytic insights, NLG composes synthesized text through analysis of pre-defined structured data. NLG is more than the process of rendering data into a language that sounds natural to humans. It can play a vital role in uncovering valuable insights from massive datasets (big data) through automated forms of analysis.
Adaption of NLG in other verticals has increased in recent years, yet applications of NLG technology in the Cyber Threat Intelligence (CTI) domain are sparse. On one hand, intelligence teams accumulate millions of information generated by security controls or obtained from intelligence source. On the other hand, the intelligence product is often a narrative report written by an analyst. With the influx of data, intelligence teams are confronted with challenges pertaining to data assessment and analysis, (near-) real-time creation of intelligence products targeted at the right audience; all while operating at scale and with accuracy.
We believe that the potential of NLG is vastly unexplored in CTI and want to share our research and a proof-of-concept tool demonstrating the potential value of NLG.
May 11, 2020 17:00-18:00
MD5: aadfb1ea9c967fcc1f2a0f97b89f60a1
Format: application/pdf
Last Update: May 15th, 2020
Size: 9.57 Mb
Matthijs Bomhoff (Tesorion, NL)
Matthijs Bomhoff has a background in mathematics with a PhD on graph theory and loves to apply scientific methodology to malware analysis and threat intelligence. His focus within the Tesorion Research team is mainly on analysis and innovation: coming up with new approaches to detect and identify malware-related behaviour in large datasets. He also occasionally likes to do some malware reverse engineering to keep up with the techniques used in today's threats.
In this session we will tell the story of a fictional struggle between a malware-building miscreant and a sole security analyst. Over the course of several attacks, our antagonist creates increasingly complex malware in an attempt to breach defenses and remain undetected. To keep up, our analyst soon has to resort to reverse engineering and gets to experience several common anti-analysis tricks as the attacks continue.
Originally, our submission was for a four hour workshop with a hands-on introduction into reverse engineering for CTI based on a fictional incident. Unfortunately this proved hard to scale back to 45 minutes. So we decided to take another approach: we will use a story-based presentation to show how reverse engineering is an important tool in gathering CTI. Malware writers are of course also aware of this, and often try to frustrate analysis. Over the course of our story we show by means of synthetic examples how reverse engineering can be used to gather actionable intelligence even when an adversary actively tries to counter this.
May 11, 2020 18:00-19:00
Marco CaselliMarco Caselli (Siemens, DE)
Marco Caselli joined Siemens in 2017 and he is the Senior Key Expert of the “Monitoring & Attack Detection” topic. He received his Ph.D. in computer security at the University of Twente with a thesis titled “Intrusion Detection in Networked Control Systems: From System Knowledge to Network Security”. His research interests focus on security of industrial control systems and building automation with a special focus on critical infrastructures. Before starting his Ph.D. he worked for GCSEC, a not-for-profit organization created to advance cyber security in Italy, and Engineering S.p.A., an international company for software development.
Threat intelligence sharing has been expanding during the last few years, leading us to have access to a large amount of open data. Unfortunately, this is usually provided as unstructured human-readable cyber threat reports and important information such as attack tactics, techniques and procedures is hidden within the text. Done manually, the analysis of such reports requires time and effort. To support this analysis, we created rcATT, an open-source tool which automatically classifies cyber threat reports according to MITRE’s Enterprise ATT&CK tactics and techniques. In this talk, we present the tool and we show how we were able to solve the challenges of working with hierarchical multi-label text classification of cyber threat reports, having access to a limited amount of labeled data. Finally, we demonstrate how rcATT performs on publicly-available cyber threat reports and how to take advantage of the classification results.
May 7, 2020 18:00-19:00
FIRST_CTI_2020_rcATT_Siemens.pdf
MD5: a8b08ee1519f08b1f8bece48efbc8bce
Format: application/pdf
Last Update: May 12th, 2020
Size: 988.58 Kb
Mayo YamasakiMayo Yamasaki (NTT-CERT, JP)
Mayo Yamasaki is a researcher at NTT Secure Platform Laboratories and also a member of NTT-CERT in Japan since 2015. He studied information science and natural language processing at NAIST (Nara Institute of Science and Technology). Since he joined NTT he’s been researching and developing software systems for cybersecurity-related information extraction and retrieval with machine learning.
Understanding threat intelligence is not an easy task for threat analysts even if they are structured. Therefore, many methods to automatically visualize the threat intelligence structure have been proposed. However, these methods utilize visualization methods developed for the general domain to support a wide variety of use cases for analyzing threat intelligence. This talk introduces a novel visualization method, for threat reports, based on simple observations obtained by a study of threat diagram characteristics of actual threat reports. Because threat report is a reasonable bundle of intelligence and one of the most common ways to share it, by capturing these characteristics, the method visualizes graph-structured STIX 2 as a concise overview of the threat structure. Also, this talk demonstrates the utility of the method by visualizing actual threat reports gathered from the ATT&CK knowledge base.
May 8, 2020 09:00-10:00
FIRST-CTI-2020_Rethinking-the-Graph-Visualization-for-Threat-Reports_paper.pdf
MD5: 8c788245a14ab652b10969df3cb2f50f
Format: application/pdf
Last Update: March 26th, 2021
Size: 922.13 Kb
FIRST-CTI-2020_Rethinking-the-Graph-Visualization-for-Threat-Reports_slide.pdf
MD5: 12cb04526ecada932712c18de1b5af58
Format: application/pdf
Last Update: May 15th, 2020
Size: 3.37 Mb
Sebastien TricaudSebastien Tricaud (Devo Inc., US)
Sebastien Tricaud is Director of Security Engineering at Devo. When he is not playing the jazz flute, he loves sharing and testing thoughts by making them publicly available in liberal licenses.
Sighting is a method to keep track of how many times something has been seen. This is particularly useful for indicators, especially if Sightings are not limited to indicators.
This presentation is very use-case oriented on our own use and feedback of SightingDB in MISP. Do you think TTP always fall in the tough category? Can anyone enrich Threat Data by just counting?
This talk will share our experience as a Vendor, a MISP Standard contributor (sightingdb) and also our integration in the MISP software.
This is also an opportunity to interact and learn from the audience to improve the SightingDB standard (https://www.misp-standard.org/rfc/sightingdb-format.txt).
May 6, 2020 18:00-19:00
FIRST-2020-CTI-Webinar-Series-Sighting-Use-Cases-Tricaud.pdf
MD5: 06485d3ebc96e01a23881017e5c19823
Format: application/pdf
Last Update: May 6th, 2020
Size: 638.3 Kb
Alexandre Dulaunoy
Andras IklodyAlexandre Dulaunoy (CIRCL.LU, LU), Andras Iklody (CIRCL.LU, LU)
Alexandre Dulaunoy encountered his first computer in the eighties, and he disassembled it to know how the thing works. While pursuing his logical path towards information security and free software, he worked as senior security network consultant at different places (e.g. Ubizen, now Cybertrust). He co-founded a startup called Conostix, which specialised in information security management. For the past 6 years, he was the manager of global information security at SES, a leading international satellite operator. He is now working at CIRCL in the research and operational fields. He is also a lecturer in information security at Paul-Verlaine University in Metz and the University of Luxembourg. He is also the lead developer of various open source tools including cve-search and member of the MISP core team.
As we, as the CSIRT community, mature, our needs for having the ability to extract more value and context from our data becomes more and more vital. MISP has been gradually expanded to reflect these needs, by incorporating features that ease indicator life cycle management, contextualisation and management of threat intelligence, collaboration and the filtered feeding of our collected data to our various protective tools. This talk aims to highlight some of the techniques we use via the platform.
May 4, 2020 18:00-19:00
FIRST-2020-CTI-Webinar-Series-Turning-Data-into-Actional-Intelligence-Dulaunoy-Iklody.pdf
MD5: 3be56bfa1026cb0c9a5fc25112f17ed3
Format: application/pdf
Last Update: May 4th, 2020
Size: 2.04 Mb
Gert-Jan BrugginkGert-Jan Bruggink (Falconforce, NL)
Gert-Jan Bruggink is a security specialist and researcher with over 10 years of information security experience at the crossing of offense, defense & strategic risk management. Gert-Jan’s primary role at FalconForce is to assists leaders in making informed decisions by utilizing cyber threat intelligence. In addition to that he’s helping those leaders implement relevant and sustainable cyber defences through strategic change. Before co-founding FalconForce, Gert-Jan led a CTI team specialized in strategic & operational intelligence products, cyber-reconnaissance and CTI enablement. If he wasn’t working on that then he probably was supporting organizations in augmenting cyber transformation program or security operations.
Have you ever thought about what would happen if you could compare adversaries targeting your organization with how well you are doing? Understanding the objectives of adversaries would certainly help you invest resources in the right controls and counter measures right? In this talk we will break down how you can leverage red teaming to complement your cyber threat intelligence activities.
When developing your adversary tracking mechanism, regardless of your security maturity, one of the most resource effective ways to do so is to focus on the ‘how do they do it’ or in other words their playbooks. Now when combining the trade of cyber threat intelligence with red teaming, we’re getting the opportunity to incorporate red team data into our adversary playbooks.
When a red team is pursuing a certain goal and simulating a specific adversary playbook, an organization can use the data and results to understand how for the real adversary would come and where to increase defences. Armed with these playbooks, your defensive teams can more effectively connect the dots from observed activities in your environment. Your detection and incident response teams can also more efficiently understand what adversaries do and what the TTP’s look like if they are active in their network, or even utilize automated adversary data sets for continuous validation. Finally, one can use this understanding to benchmark their strategic investments of their security program.
There’s just one thing: This is not easy.
May 12, 2020 18:00-19:00
FIRST-CTI-Gert-Jan-Bruggink.pdf
MD5: 4550cba5c1c255f47efba613373138fd
Format: application/pdf
Last Update: June 29th, 2020
Size: 3.95 Mb
Brittany Barbehenn
Robert FalconeBrittany Barbehenn (Palo Alto Networks, US), Robert Falcone (Palo Alto Networks, US)
Brittany Barbehenn is a Cyber Threat Intelligence Analyst with Palo Alto Networks' Unit 42 team. She is responsible for the collection, analysis, and production of intelligence on adversaries targeting organizations around the world. Her background spans over 10 years supporting many disciplines in both the private and public sectors including Cyber Threat Intelligence, Network Defense Architecture Engineering, Cyber Operations Planning, Business Continuity, IT Disaster Recovery, and Whole-of-Organization security assessments.
Robert Falcone is a Threat Researcher on Palo Alto Network's Unit 42 team who has spent over 10 years focusing on malware analysis, reverse engineering and tracking threat actors, primarily those associated with cyber espionage and targeted attacks. He has also worked as a security engineer within an operations center for a managed security service focused on intrusion detection and prevention.
In threat research, we rarely get to see the interests of the actors involved come to the surface; however, this past year we observed tools used in targeted attacks that were named after objects and characters from popular anime series. This talk will discuss these targeted attacks that we tracked in what we call the xHunt Campaign, which targeted Kuwaiti organizations in 2018 and 2019 that involved tools that were clearly named after persons and objects from the Hunter x Hunter and Samurai X. We will dive into the attacks they carried out, including the actor's development activities, initial attack vectors, toolset and some novel command and control mechanisms used in these attacks. We will also discuss the threat actor's cheat sheet, which gave us unprecedented insight into the activities the actors would carry out after gaining access to the targeted system and network.
May 8, 2020 10:00-11:00