The Art of Threat Detection Engineering
DISCARDED: Tales From the Threat Research Trenches
00:00
Automated Miter Attack Detection at Proof Point
One way of understanding and delineating thread actor behaviors is using the mitre attack framework. I'm really excited about a project that you were working on, which was a incorporate in automated miter attack detections into the proof point sand box. And for example, let's say ransom ber often tries to it shadow copy files or tries to rename a lot of files with a certain extension. This is something you can detect generically, independent of the extension name. Also, typical persistence techniques, like scheduled tasks or ote run,. You can detect this very easy with dynamic signatures in the sand box.
Transcript
Play full episode
