Uploaded byDell EMC World
MT 69 Tripwire Defense: Advanced Endpoint Detection by a Thousand Tripwires
The document discusses an advanced endpoint detection strategy called tripwire defense, aimed at countering intrusions from hostile entities. It emphasizes the distinction between industry and adversary definitions of defeat, indicating that behaviors should guide detection efforts. Case studies highlight the importance of behavioral analysis in driving effective detection and investigation processes.
More Related Content
![Fermín J. Serna - Exploits & Mitigations: EMET [RootedCON 2010]](https://cdn.slidesharecdn.com/ss_thumbnails/ferminjserna-exploitsmitigationsemet-100328034335-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
Similar to MT 69 Tripwire Defense: Advanced Endpoint Detection by a Thousand Tripwires
MT 69 Tripwire Defense: Advanced Endpoint Detection by a Thousand Tripwires
- 1. Tripwire Defense: Advanced Endpoint Detectionby a Thousand Tripwires
- 2. Justin Turner CTU SpecialOperations Phil Burdette CTU Cyber Intel Cell • The Counter Threat Unit Special Operations team is dedicated to responding to intrusions from hostile Nation States and other advanced adversaries on a daily basis
- 3. 3 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Agenda Why are we losing? How do we win? Prove it!
- 4. 4 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Reconnaissance Lateral Movement Data Exfiltration Delivery Command & Control Credential Theft Host Enumeration Define Defeat
- 5. 5 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Reconnaissance Lateral Movement Data Exfiltration Delivery Command & Control Credential Theft Host Enumeration Define Winning
- 6. The industry’s definitionof defeat is different from our adversary’s definition of winning
- 7. Behaviors drive detections, indicatorsdrive investigations
- 8. 8 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Backdoor Credential Theft Defensive Evasion Host Enumeration Lateral Movement Exfiltration WMI Consumer
- 9. 9 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Backdoor Credential Theft Defensive Evasion Host Enumeration Lateral Movement Exfiltration
- 10. 10 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Backdoor Credential Theft Defensive Evasion Host Enumeration Lateral Movement Exfiltration
- 11. 11 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Backdoor Credential Theft Defensive Evasion Host Enumeration Lateral Movement Exfiltration
- 12. 12 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Backdoor Credential Theft Defensive Evasion Host Enumeration Lateral Movement Exfiltration
- 13. 13 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Backdoor Credential Theft Defensive Evasion Host Enumeration Lateral Movement Exfiltration
- 14. 14 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Case Study :: Behaviors Drive Detection
- 15. 15 Dell - InternalUse - Confidential Classification: //SecureWorks/Confidential - Limited External Distribution: Case Study :: Behaviors Drive Detection