2026-04-13 01-48-09

May 25, 2026 14:12 · 8:53 · English · Whisper Turbo · 1 Дыбыс тақшалары
Бұл көшірменің мерзімі бүгін біткен. Қайталама сақтау үшін жаңарту →
Оқулық индексі
Тек көрсетілетін
0:11
S… Speaker 1 (2026-04-13 01-48-09)
In this video,
0:12
S… Speaker 1 (2026-04-13 01-48-09)
we're going to go over a quick introduction to what endpoint threat
0:16
S… Speaker 1 (2026-04-13 01-48-09)
hunting is before we start diving into it in a little more
0:21
S… Speaker 1 (2026-04-13 01-48-09)
detail.
0:21
S… Speaker 1 (2026-04-13 01-48-09)
So endpoint threat hunting is primarily performing
0:25
S… Speaker 1 (2026-04-13 01-48-09)
a threat hunt based on IOCs and hypotheses
0:30
S… Speaker 1 (2026-04-13 01-48-09)
and things like that that are typically geared just towards
0:34
S… Speaker 1 (2026-04-13 01-48-09)
your endpoints.
0:35
S… Speaker 1 (2026-04-13 01-48-09)
Now,
0:36
S… Speaker 1 (2026-04-13 01-48-09)
When you're performing a threat hunt in an enterprise environment,
0:40
S… Speaker 1 (2026-04-13 01-48-09)
you're not really going to be performing just an endpoint threat hunt
0:44
S… Speaker 1 (2026-04-13 01-48-09)
or just a network threat hunt.
0:46
S… Speaker 1 (2026-04-13 01-48-09)
You're going to be performing a threat hunt,
0:49
S… Speaker 1 (2026-04-13 01-48-09)
going to be combining both network type and endpoint
0:53
S… Speaker 1 (2026-04-13 01-48-09)
types of IOCs.
0:54
S… Speaker 1 (2026-04-13 01-48-09)
We're just kind of breaking it apart here just to make it a little easier to understand.
0:59
S… Speaker 1 (2026-04-13 01-48-09)
But when we're talking about our endpoint threat hunting,
1:02
S… Speaker 1 (2026-04-13 01-48-09)
we're primarily talking about the IOCs and such that are associated with
1:06
S… Speaker 1 (2026-04-13 01-48-09)
endpoint systems and that are also searched for on your endpoints
1:11
S… Speaker 1 (2026-04-13 01-48-09)
or from your endpoint logs.
1:13
S… Speaker 1 (2026-04-13 01-48-09)
These can be threat hunts that are geared primarily towards
1:18
S… Speaker 1 (2026-04-13 01-48-09)
looking for indicators of compromise or looking for
1:22
S… Speaker 1 (2026-04-13 01-48-09)
your TTPs as the kind of type of hunt you're
1:26
S… Speaker 1 (2026-04-13 01-48-09)
performing.
1:27
S… Speaker 1 (2026-04-13 01-48-09)
These IOCs,
1:28
S… Speaker 1 (2026-04-13 01-48-09)
again, can be either the endpoint types of IOCs or the network
1:33
S… Speaker 1 (2026-04-13 01-48-09)
types of IOCs.
1:34
S… Speaker 1 (2026-04-13 01-48-09)
It's mainly the focus of where the threat hunt
1:38
S… Speaker 1 (2026-04-13 01-48-09)
is looking for specific threats.
1:42
S… Speaker 1 (2026-04-13 01-48-09)
And your threat hunts,
1:44
S… Speaker 1 (2026-04-13 01-48-09)
just like any threat hunt at all,
1:45
S… Speaker 1 (2026-04-13 01-48-09)
can begin with many different types of triggers,
1:48
S… Speaker 1 (2026-04-13 01-48-09)
if you will.
1:49
S… Speaker 1 (2026-04-13 01-48-09)
This can be specific intelligence information that the organization
1:53
S… Speaker 1 (2026-04-13 01-48-09)
receives,
1:54
S… Speaker 1 (2026-04-13 01-48-09)
either internally or externally through a vendor.
1:58
S… Speaker 1 (2026-04-13 01-48-09)
This can be information or reports from your
2:02
S… Speaker 1 (2026-04-13 01-48-09)
internal network team,
2:03
S… Speaker 1 (2026-04-13 01-48-09)
your security operations center,
2:05
S… Speaker 1 (2026-04-13 01-48-09)
anything like that.
2:06
S… Speaker 1 (2026-04-13 01-48-09)
There's a lot of different ways a threat hunt.
2:10
S… Speaker 1 (2026-04-13 01-48-09)
can begin and this is just a couple of different examples of that
2:15
S… Speaker 1 (2026-04-13 01-48-09)
Normally,
2:16
S… Speaker 1 (2026-04-13 01-48-09)
your endpoint threat hunts are going to be done on logs that have been
2:20
S… Speaker 1 (2026-04-13 01-48-09)
collected from various different types of endpoint systems.
2:24
S… Speaker 1 (2026-04-13 01-48-09)
This can be from your authentication logs,
2:27
S… Speaker 1 (2026-04-13 01-48-09)
web application logs,
2:29
S… Speaker 1 (2026-04-13 01-48-09)
any other application,
2:31
S… Speaker 1 (2026-04-13 01-48-09)
any included built -in system events that are built in,
2:35
S… Speaker 1 (2026-04-13 01-48-09)
for example,
2:35
S… Speaker 1 (2026-04-13 01-48-09)
Windows, any logs like that.
2:38
S… Speaker 1 (2026-04-13 01-48-09)
One important part when we're talking about Windows endpoint threat hunting
2:42
S… Speaker 1 (2026-04-13 01-48-09)
is PowerShell.
2:44
S… Speaker 1 (2026-04-13 01-48-09)
PowerShell is very commonly abused by attackers,
2:48
S… Speaker 1 (2026-04-13 01-48-09)
so it is important to make sure the proper PowerShell logging
2:52
S… Speaker 1 (2026-04-13 01-48-09)
is enabled and is going into your kind
2:56
S… Speaker 1 (2026-04-13 01-48-09)
of central logging location.
2:58
S… Speaker 1 (2026-04-13 01-48-09)
Again,
2:59
S… Speaker 1 (2026-04-13 01-48-09)
these logs are going to be collected from many different locations across
3:03
S… Speaker 1 (2026-04-13 01-48-09)
the enterprise.
3:04
S… Speaker 1 (2026-04-13 01-48-09)
We have plenty of other courses and videos at I
3:08
S… Speaker 1 (2026-04-13 01-48-09)
&E.
3:09
S… Speaker 1 (2026-04-13 01-48-09)
for log collection,
3:11
S… Speaker 1 (2026-04-13 01-48-09)
log analysis,
3:12
S… Speaker 1 (2026-04-13 01-48-09)
things like that.
3:13
S… Speaker 1 (2026-04-13 01-48-09)
So we're not going to go into kind of how to set up the logging infrastructure
3:17
S… Speaker 1 (2026-04-13 01-48-09)
in this course.
3:18
S… Speaker 1 (2026-04-13 01-48-09)
But typically these logs are going to be aggregated and collected
3:23
S… Speaker 1 (2026-04-13 01-48-09)
into some sort of a centralized location,
3:25
S… Speaker 1 (2026-04-13 01-48-09)
like a sim or a seam,
3:27
S… Speaker 1 (2026-04-13 01-48-09)
depending on how you want to pronounce it,
3:29
S… Speaker 1 (2026-04-13 01-48-09)
which a lot of times will be where the threat hunt takes place,
3:32
S… Speaker 1 (2026-04-13 01-48-09)
or at least one of the primary locations that you are performing the hunt
3:36
S… Speaker 1 (2026-04-13 01-48-09)
from.
3:38
S… Speaker 1 (2026-04-13 01-48-09)
Now, every good threat hunt,
3:40
S… Speaker 1 (2026-04-13 01-48-09)
every effective threat hunt,
3:42
S… Speaker 1 (2026-04-13 01-48-09)
is going to start with some sort of a trigger or a hypothesis.
3:47
S… Speaker 1 (2026-04-13 01-48-09)
When we're talking about our endpoint threat hunting,
3:49
S… Speaker 1 (2026-04-13 01-48-09)
a couple of examples here.
3:51
S… Speaker 1 (2026-04-13 01-48-09)
You have a hypothesis that attackers have compromised a
3:55
S… Speaker 1 (2026-04-13 01-48-09)
workstation in the environment,
3:57
S… Speaker 1 (2026-04-13 01-48-09)
and they're executing malicious files that match these
4:01
S… Speaker 1 (2026-04-13 01-48-09)
specific file hashes.
4:04
S… Speaker 1 (2026-04-13 01-48-09)
and are sending communication to a command and control server located at
4:08
S… Speaker 1 (2026-04-13 01-48-09)
this specific IP address.
4:10
S… Speaker 1 (2026-04-13 01-48-09)
This is an actionable hypothesis.
4:12
S… Speaker 1 (2026-04-13 01-48-09)
It contains good information that you can use to start
4:17
S… Speaker 1 (2026-04-13 01-48-09)
the threat hunt.
4:18
S… Speaker 1 (2026-04-13 01-48-09)
Again,
4:19
S… Speaker 1 (2026-04-13 01-48-09)
you would have specific caches and specific IP or IPs in
4:24
S… Speaker 1 (2026-04-13 01-48-09)
this hypothesis to start that hunt.
4:26
S… Speaker 1 (2026-04-13 01-48-09)
You could also have something like attackers have already established a foothold
4:31
S… Speaker 1 (2026-04-13 01-48-09)
in the network,
4:31
S… Speaker 1 (2026-04-13 01-48-09)
and for persistence means or persistence techniques,
4:35
S… Speaker 1 (2026-04-13 01-48-09)
they've used...
4:36
S… Speaker 1 (2026-04-13 01-48-09)
I've created administrative accounts in order to maintain their
4:40
S… Speaker 1 (2026-04-13 01-48-09)
access.
4:41
S… Speaker 1 (2026-04-13 01-48-09)
So again,
4:42
S… Speaker 1 (2026-04-13 01-48-09)
you have an effective hypothesis.
4:44
S… Speaker 1 (2026-04-13 01-48-09)
You have specific things to search for.
4:46
S… Speaker 1 (2026-04-13 01-48-09)
In this case,
4:47
S… Speaker 1 (2026-04-13 01-48-09)
you are searching for new account creation.
4:50
S… Speaker 1 (2026-04-13 01-48-09)
And we'll get into detail as we go through this course about how
4:54
S… Speaker 1 (2026-04-13 01-48-09)
to search for all of these.
4:57
S… Speaker 1 (2026-04-13 01-48-09)
Let's look at just a couple of different types of IOCs that are typically
5:01
S… Speaker 1 (2026-04-13 01-48-09)
associated with your endpoints as well.
5:04
S… Speaker 1 (2026-04-13 01-48-09)
So we have your registry keys.
5:06
S… Speaker 1 (2026-04-13 01-48-09)
These are going to be commonly used by attackers or abused by
5:10
S… Speaker 1 (2026-04-13 01-48-09)
attackers for setting up things like auto -run or malicious services
5:15
S… Speaker 1 (2026-04-13 01-48-09)
for their persistence mechanism.
5:18
S… Speaker 1 (2026-04-13 01-48-09)
You also have things like your file names or your process
5:22
S… Speaker 1 (2026-04-13 01-48-09)
names.
5:23
S… Speaker 1 (2026-04-13 01-48-09)
These can be ones that are made to look like
5:27
S… Speaker 1 (2026-04-13 01-48-09)
your more legitimate,
5:28
S… Speaker 1 (2026-04-13 01-48-09)
for example,
5:30
S… Speaker 1 (2026-04-13 01-48-09)
Windows services or Windows processes.
5:32
S… Speaker 1 (2026-04-13 01-48-09)
Or it could be an instance of using those
5:37
S… Speaker 1 (2026-04-13 01-48-09)
legitimate Windows files,
5:39
S… Speaker 1 (2026-04-13 01-48-09)
in this case,
5:40
S… Speaker 1 (2026-04-13 01-48-09)
for malicious purposes.
5:42
S… Speaker 1 (2026-04-13 01-48-09)
There's many different ways to abuse your files here.
5:46
S… Speaker 1 (2026-04-13 01-48-09)
But your file names,
5:47
S… Speaker 1 (2026-04-13 01-48-09)
your process names can be considered or are considered indicators
5:51
S… Speaker 1 (2026-04-13 01-48-09)
of compromise and can be used in searches for a
5:55
S… Speaker 1 (2026-04-13 01-48-09)
threat hunt.
5:56
S… Speaker 1 (2026-04-13 01-48-09)
You also have your file hashes.
5:58
S… Speaker 1 (2026-04-13 01-48-09)
These are used to uniquely identify specific files
6:03
S… Speaker 1 (2026-04-13 01-48-09)
and are very commonly used in your threat hunts.
6:07
S… Speaker 1 (2026-04-13 01-48-09)
You have things like scheduled tasks and services that can
6:11
S… Speaker 1 (2026-04-13 01-48-09)
be used or that are IOCs as well.
6:14
S… Speaker 1 (2026-04-13 01-48-09)
Again, these are used and abused by your attackers for
6:18
S… Speaker 1 (2026-04-13 01-48-09)
persistence mechanisms,
6:20
S… Speaker 1 (2026-04-13 01-48-09)
mainly when we're talking about our scheduled tasks.
6:22
S… Speaker 1 (2026-04-13 01-48-09)
And again, we'll get into the details of how to search for these.
6:26
S… Speaker 1 (2026-04-13 01-48-09)
And these IOCs can come from many different locations
6:30
S… Speaker 1 (2026-04-13 01-48-09)
to begin your threat hunt.
6:32
S… Speaker 1 (2026-04-13 01-48-09)
For example,
6:33
S… Speaker 1 (2026-04-13 01-48-09)
you can get these from various different intelligence sources,
6:36
S… Speaker 1 (2026-04-13 01-48-09)
from third -party intelligence vendors or intelligence
6:40
S… Speaker 1 (2026-04-13 01-48-09)
feeds that you're paying for.
6:42
S… Speaker 1 (2026-04-13 01-48-09)
These can come from your reports from your ISACs,
6:46
S… Speaker 1 (2026-04-13 01-48-09)
your information sharing and analysis centers.
6:50
S… Speaker 1 (2026-04-13 01-48-09)
And again,
6:50
S… Speaker 1 (2026-04-13 01-48-09)
you can get these from paid or free intelligence feeds.
6:55
S… Speaker 1 (2026-04-13 01-48-09)
These can,
6:56
S… Speaker 1 (2026-04-13 01-48-09)
again, come from an internal network team or your internal SOC.
6:59
S… Speaker 1 (2026-04-13 01-48-09)
They can have these IOCs that they relay to the
7:03
S… Speaker 1 (2026-04-13 01-48-09)
threat hunting team or threat hunting personnel to get a threat
7:08
S… Speaker 1 (2026-04-13 01-48-09)
hunt started.
7:08
S… Speaker 1 (2026-04-13 01-48-09)
And a lot of times you're going to search for these,
7:12
S… Speaker 1 (2026-04-13 01-48-09)
you know,
7:12
S… Speaker 1 (2026-04-13 01-48-09)
again, on your,
7:14
S… Speaker 1 (2026-04-13 01-48-09)
you know,
7:15
S… Speaker 1 (2026-04-13 01-48-09)
something like Splunk or Elk.
7:17
S… Speaker 1 (2026-04-13 01-48-09)
But these will be found in system logs primarily.
7:21
S… Speaker 1 (2026-04-13 01-48-09)
Again, there's a lot of different places to search for this.
7:24
S… Speaker 1 (2026-04-13 01-48-09)
Systems logs are a very good example,
7:26
S… Speaker 1 (2026-04-13 01-48-09)
and one of the primary places you'll be searching for these.
7:29
S… Speaker 1 (2026-04-13 01-48-09)
These can be built -in system events like your
7:33
S… Speaker 1 (2026-04-13 01-48-09)
Windows event logs.
7:35
S… Speaker 1 (2026-04-13 01-48-09)
These can be individual application events,
7:38
S… Speaker 1 (2026-04-13 01-48-09)
either from internal logging these applications do,
7:41
S… Speaker 1 (2026-04-13 01-48-09)
or perhaps they may send these logs.
7:44
S… Speaker 1 (2026-04-13 01-48-09)
to the Windows event logs as well.
7:46
S… Speaker 1 (2026-04-13 01-48-09)
We'll talk about what Sysmon is and how it's useful,
7:50
S… Speaker 1 (2026-04-13 01-48-09)
and there are several different events that are helpful to use,
7:54
S… Speaker 1 (2026-04-13 01-48-09)
event IDs that are helpful to use when we're doing threat hunts,
7:57
S… Speaker 1 (2026-04-13 01-48-09)
that are generated by Sysmon.
8:00
S… Speaker 1 (2026-04-13 01-48-09)
And again,
8:01
S… Speaker 1 (2026-04-13 01-48-09)
when we're performing a threat hunt,
8:06
S… Speaker 1 (2026-04-13 01-48-09)
you're going to be combining your endpoint IOCs with your network
8:10
S… Speaker 1 (2026-04-13 01-48-09)
IOCs.
8:10
S… Speaker 1 (2026-04-13 01-48-09)
Again, we've separated them out here just to make it easier to kind of grasp the
8:14
S… Speaker 1 (2026-04-13 01-48-09)
concepts.
8:15
S… Speaker 1 (2026-04-13 01-48-09)
But a lot of times you're going to be combining these IOCs with
8:19
S… Speaker 1 (2026-04-13 01-48-09)
others, especially for correlation purposes,
8:22
S… Speaker 1 (2026-04-13 01-48-09)
and to kind of build the story of what an attacker has
8:26
S… Speaker 1 (2026-04-13 01-48-09)
done as part of that threat hunt.
8:28
S… Speaker 1 (2026-04-13 01-48-09)
And again, there's a lot more IOCs in this.
8:31
S… Speaker 1 (2026-04-13 01-48-09)
This is just a few examples.
8:33
S… Speaker 1 (2026-04-13 01-48-09)
We'll start getting into more details and more IOCs
8:37
S… Speaker 1 (2026-04-13 01-48-09)
as we progress through the course.

Бұл транскрипт AI (автоматты дыбыс таныу) арқылы жасалды. Қателер болуы мүмкін - маңызды болса, бастапқы дыбыспен салыстырыңыз. AI ережесі

❤️ STT.ai-ды сүйесіз бе? Достарыңызға хабарлаңыз!
Тұжырымдама
Бұл транскрипттің AI тұжырымын құру үшін Тұжырымдау дегенді басыңыз.
Тұжырымдау...
Бұл транскрипт туралы ДК- дан сұрау
Бұл транскрипт туралы сұрақ қойыңыз - ИИ тиісті бөлімдерді тауып, жауап береді.
Басқасын көшіру