ELK-Hunting

Threat Hunting with ELK Workshop (InfoSecWorld 2017)

Slides

• https://drive.google.com/file/d/0Bw9IuzQzV-koeVNrRmt6TkxYY1k/view?usp=sharing

Download ELK VM

• Will be posted after workshop

Sysmon

• https://technet.microsoft.com/en-us/sysinternals/sysmon
• https://www.rsaconference.com/events/us17/agenda/sessions/7516-How-to-Go-from-Responding-to-Hunting-with-Sysinternals-Sysmon

Credits

Sample data from:

• http://rabidio.com
• http://www.secrepo.com/
• http://www.malware-traffic-analysis.net/