December 23, 2019

Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK™ Framework [Splunk Enterprise, Splunk Enterprise Security]

Advanced attackers that live off your land add insult to what can be very serious injury. In this session we'll show you how to use behavioral analysis to identify advanced attackers that evade traditional signature-based detection methods. We do so in our organization by using Splunk to combine insights from traditional data sources to detect activity across multiple phases of the MITRE ATT&CK™ framework. We'll focus on how to build queries tune them for your environment, and start catching these threat actors with behavioral detections as soon as you get back from .conf.

Speaker(s)
Haylee Mills, Security Engineer, Charles Schwab

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1556.pdf?podcast=1577146233

...more

View all episodes

By Splunk

December 23, 2019

Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK™ Framework [Splunk Enterprise, Splunk Enterprise Security]

Speaker(s)
Haylee Mills, Security Engineer, Charles Schwab

Slides PDF link - https://conf.splunk.com/files/2019/slides/SEC1556.pdf?podcast=1577146233

...more

Share Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK™ Framework [Splunk Enterprise, Splunk Enterprise Security]

Sign up to save your podcasts

Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK™ Framework [Splunk Enterprise, Splunk Enterprise Security]

Building Behavioral Detections: Cross-Correlating Suspicious Activity with the MITRE ATT&CK™ Framework [Splunk Enterprise, Splunk Enterprise Security]